The question: am I allowed to write to these people?
A French, German or Italian founder opening Apollo sees millions of professionals: names, titles, emails. The temptation is to consider that a US vendor's database settles the matter. It does not: you send the message, so you must be able to justify having sent it. Our article on Apollo vs Ember Lead Intelligence for Founder Conversion covers the tool question; this one covers the legal question. For how these rules relate to email routers, read our article on the CNIL and router blocks. It does not replace a lawyer's advice, especially if you target several countries.
What Apollo says about its data
In its privacy policy, Apollo states that it processes personal information of people in the European Union, the United Kingdom and Switzerland in accordance with applicable data protection law, including GDPR, UK GDPR and Swiss data protection law. It says it obtains business contact information from publicly accessible websites, professional directories, public regulatory and government sources, and vetted third-party data providers. For some processing it relies on legitimate interest, notably to create, verify, enrich and maintain business contact information and to provide business-to-business sales, marketing and recruiting services.
A person can request deletion of their information, including from Apollo's service providers, through its Privacy Center or by emailing privacy@apollo.io, subject to certain exceptions. They also have a right of access, a right of erasure and the right to lodge a complaint with a data protection authority.
What the CNIL expects of you
The CNIL, France's data protection authority, summarises the rules for email prospecting of professionals (quotes translated from French):
- Legal basis: legitimate interest replaces prior consent, provided that "the subject of the solicitation relates to the profession of the person approached".
- Right to object: the person must be able to object simply and free of charge, at collection and at any time.
- Data coming from a third party: check that the person was informed of the possible use of their address for prospecting and can object to it.
- Every message must let the person identify the organisation sending it and express a refusal by a simple means.
- Deadline: one month at most to answer a request to exercise rights.
Example: you sell payroll software and write to a finance director in Belgium. The subject (payroll) relates to their profession, which is consistent with the rule. The same message sent to an art director because their email was in the database is not.
What Apollo implies day to day
On its pricing page, Apollo states that export credits are consumed whenever a contact is exported outside Apollo. For you, this means a list exported to a file or a CRM leaves Apollo's perimeter: it is up to you to keep it current, remove people who objected and keep a record of their refusal. No tool synchronises a person's deletion across your CRM, your exports and the source database for you.
What Lead Intelligence handles, and what it does not
According to Ember's technical documentation, Lead Intelligence provides:
- a do-not-contact list attached to the mission owner's organisation, which stops you from recontacting a person;
- a per-prospect rights request (objection to prospecting, access, export or erasure, rectification), logged and sent to Ember support for manual handling with a 30-day target;
- a public "Prospect data and rights" page on ember.do describing the module's framework.
It discovers prospects through a LinkedIn or Sales Navigator account you connect, or from files you import. The data source is therefore not a third-party database but your account or your files: you must have a legitimate reason to contact these people. Ember gives no compliance guarantee in your place.
| Obligation | Apollo | Ember Lead Intelligence | You |
|---|---|---|---|
| Source of contact data | Public sites, directories, regulatory sources, third-party providers, per its policy | Your connected LinkedIn or Sales Navigator account, or your imported files | Choose the source and be able to justify it |
| Deletion on request | Privacy Center or privacy@apollo.io | Do-not-contact list and per-prospect rights request | Stop all contact and record it |
| Link between message and profession | Not applicable to the tool | Not applicable to the tool | Check before each send |
| Sender identification and simple refusal | Not applicable to the tool | Not applicable to the tool | Build it into every message |
Our recommendation
- Before choosing the tool, write your rule: which professionals, for which subject, from which source, with which objection message, and who answers requests within a month.
- With Apollo, keep a record of each exported list and of objections received.
- With Lead Intelligence, use the do-not-contact list at the first refusal and the rights request for wider requests.
- If in doubt about a country or sector, ask a lawyer: rules for email prospecting differ across member states, and this article only covers what the CNIL says.
Sources
FAQ
Do I need each professional's consent to write to them?
According to the CNIL, email prospecting of professionals rests on legitimate interest rather than consent, provided the subject relates to the person's profession and they can object simply and free of charge.
Is Apollo GDPR-compliant on my behalf?
Apollo says it processes data of people in the European Union under GDPR and offers a deletion channel. That does not relieve you: sending the message is attributable to you.
What should I do if a recipient asks for deletion?
Stop contacting them, delete their details from your exports and CRM, record the request and answer within a month, the deadline the CNIL sets for requests to exercise rights.
Does Lead Intelligence handle objections?
It provides a do-not-contact list that stops you from recontacting a person, and a per-prospect rights request sent to Ember support for manual handling. It does not replace your internal procedure.
Are the rules the same in every European country?
No, this article only reports the CNIL's rules for France. Email prospecting rules may differ by member state: check your recipients' country.
Can I buy a list and use it as is?
For data coming from a third party, the CNIL asks you to check that the person was informed of the possible use of their address for prospecting and can object. Ask the provider to demonstrate it.