GDPR and LinkedIn outreach: what to check in a tool
A checklist for EU outreach teams: controller or processor, lawful basis, notice and opt-out, data location, export and erase, and DPA questions, then what Mako Reach does. Not legal advice.
On this page
When you message people on LinkedIn from the EU, you usually act as the controller of their data, and your tool acts as a processor. Check the lawful basis, the notice, opt-outs, where data is stored, export and erase, and the processing terms. This is a checklist, not legal advice.
We are a software vendor, not lawyers. Ask your own counsel or data protection officer what applies to you. Below we separate general GDPR points, which we link to the text of the regulation, from the facts about Mako Reach that we can check in the product.
Who is the controller and who is the processor?
For the people you contact, you are normally the controller: you decide why and how their data is used. The outreach tool processes it on your behalf, which makes it a processor. Article 28 of the GDPR (text) says that a processor must work under a written contract that sets out the subject, duration, nature and purpose of the processing, the data types and the controller's rights. It also says that a processor needs the controller's authorization before it uses a sub-processor.
For your own team's account and billing data, the tool is a controller of its own. A tool that says it is only a processor for everything, or only a controller for everything, deserves a follow-up question.
Ask the vendor: which role do you take for each kind of data, and where is that written down?
What lawful basis can B2B outreach use?
Every use of personal data needs a lawful basis under Article 6. For B2B outreach, many teams rely on legitimate interests, Article 6(1)(f), which allows processing that is necessary for the controller's legitimate interests unless the person's interests or rights override them. Consent is the other basis people mention, and some rules for electronic marketing are stricter than the GDPR alone.
Legitimate interests is not a free pass. It asks you to weigh your interest against the person's, usually in a short written assessment. Whether it fits your case depends on who you contact, why, how, and in which country. Check this with counsel.
Ask the vendor: what do you ask me to confirm before I import people? Mako Reach asks you to confirm that you have a lawful basis whenever you import a list, and it leaves the judgment to you.
What notice and opt-out do people need?
If you collect someone's details from LinkedIn rather than from them, Article 14 (text) says you must tell them who you are, why you use the data and how to object. The timing is the earliest of: within a reasonable period and at most one month, the time of the first communication with them, or the first disclosure to someone else. There are exceptions, so ask counsel.
Article 21 (text) gives people the right to object to direct marketing at any time, and once they object their data must no longer be processed for that purpose.
Regulators act on this. In December 2024 the French authority, the CNIL, fined a company that collected contact details from LinkedIn, and one of its findings was a failure to inform people as Articles 12 and 14 require (CNIL decision).
Ask the vendor: can I put a notice in the first message, and will the tool stop contacting someone who opts out, in every campaign and every account?
Where is the data stored?
Ask where the application, the database and background jobs run, and whether any part sits outside the EU, including a service the vendor depends on. Be wary of any promise that data never leaves a region: a tool that connects to LinkedIn depends on third parties.
Ask the vendor: list every location and every third party that touches my data.
Can you export and erase data?
The GDPR gives people rights to access and erasure, and you have to answer them. Your tool should let you find and delete one person across all your campaigns, chats and lists, and let you leave with your data.
Ask the vendor: can I erase one person completely, and can I export everything we hold?
What to ask about a DPA and sub-processors
A data processing agreement (DPA) is the Article 28 contract. A sub-processor is any company the vendor uses to deliver the service. Use this checklist:
| Topic | What to ask |
|---|---|
| DPA | Is there a signed DPA, and does it name the data types and the purpose? |
| Sub-processors | Is there a list, including the hosting provider and any provider that connects to LinkedIn or runs AI? |
| Changes | How are you told before a sub-processor is added? |
| Location | Where does each part run, and where do sub-processors host? |
| Retention | How long is data kept, and what happens to it afterwards? |
| Rights | Can one person be found, exported and erased? |
| AI | Which AI provider receives lead data, and who holds the key? |
| Security | How are credentials and tokens stored? |
What does Mako Reach do?
These are facts we can check in the product today. None of them is a claim that Mako Reach, or you, comply with the GDPR.
| Point | What Mako Reach does |
|---|---|
| Hosting | The app, the database and the background workers run in the EU (Frankfurt and Amsterdam). LinkedIn sessions are handled by a third-party service whose hosting region we do not control, so we do not say that all data stays in the EU. |
| Export | A workspace admin can download the workspace's data from Settings. The export does not include account session cookies or two-factor secrets. |
| Erase | An admin can erase the whole workspace, including the LinkedIn accounts it connected. A single person can be erased by their LinkedIn id, which removes their chats, messages and lead rows in the workspace. |
| Opt-out | A suppression list keeps people from being contacted in any campaign. A reply with a stop word, such as "stop" or "unsubscribe", adds the person to the list before the AI agent runs. The stop-word list is in English. |
| Notice | An optional merge tag, off by default, can add a short data notice with an opt-out link to a message. The text is a template: have your counsel review what you send. |
| Lawful basis | Importing a list asks you to confirm you have a lawful basis to contact the people. |
| Retention | A scheduled cleanup anonymizes data once it is past its retention period. |
| Isolation | Each workspace's data is separated at row level in the database. |
| Credentials | LinkedIn session cookies, proxy passwords, bot tokens and your AI key are stored encrypted. |
| AI | AI features run on the AI provider you connect, with your own key. The lead data used for a draft or an AI-written step goes to that provider. |
You can read the same facts, kept short, on the security page, and the controls on the account safety page.
What we do not claim
We do not describe Mako Reach as compliant with the GDPR, and no tool can make your outreach lawful for you. The privacy policy and terms on our site are still being finalised with legal review, and the processing terms and sub-processor list are not published on the site yet. If you need a DPA or a sub-processor list before you sign, write to us through the contact page and ask for them in writing.
Mako Reach is not affiliated with LinkedIn. LinkedIn's own terms restrict automated tools, so using any of them carries a risk. Read the account-safety playbook for the limits and pacing habits.
FAQ
Is legitimate interest enough for LinkedIn outreach in the EU?
Many teams use legitimate interests for B2B outreach, but it needs a balancing test and does not cover every case. Rules for electronic marketing can be stricter than the GDPR. Ask counsel for your country and your message type.
Am I the controller or the processor when I use an outreach tool?
Usually you are the controller of the people you contact and the tool is your processor. A DPA under Article 28 should say so.
Does Mako Reach keep all data in the EU?
The app, the database and the background workers run in the EU (Frankfurt and Amsterdam). LinkedIn sessions are handled by a third-party service whose hosting region we do not control, so we do not claim that all data stays in the EU.
How do I delete a person who asks me to?
A workspace admin can erase a single person by their LinkedIn id, and can add them to the suppression list so no campaign contacts them again.
Does Mako Reach send a privacy notice for me?
Only if you turn on the optional merge tag and put it in your message. It is off by default, and you should have the wording reviewed.