Cold-outreach email campaigns — DPIA v1

Controller

Mentionhub OÜ — Estonian registry code 17503260, registered office Narva mnt 5, 10117 Tallinn, Estonia

Scope of this DPIA

B2B cold-outreach email campaigns sent from Mentionhub-OÜ-controlled secondary domains via Instantly.ai, with contact data sourced from SignalHire and personalisation data generated by the Mentionhub product itself.

Author

Emelie Löfdahl, founder + acting Data Protection Officer

Date of this assessment

2026-05-08

Review cadence

Annually, or whenever processing scope materially changes (new sub-processor, new country, new data category).

Legal basis

Legitimate interest under Article 6(1)(f) GDPR, balanced against the data subject's rights under Article 21 (right to object).

1. Purpose of the processing

Mentionhub OÜ sends cold-outreach emails to people who hold marketing, communications, or PR-related corporate roles at European mid-market companies, in order to introduce the Mentionhub brand-monitoring SaaS product. The intended outcome is for the recipient to evaluate whether the product is useful in their professional role.

Each email is targeted at the recipient's professional capacity only. Personal email addresses (gmail.com, hotmail.com, etc.) are excluded by automated filter at the source-list stage.

2. Categories of personal data processed

No special-category data (Art. 9 GDPR) is processed. No data about the recipient's private life, finances, health, beliefs, or political views.

3. Sub-processors

Each sub-processor has a current DPA stored at /legal/dpa-archive/ (controller's file system). Adding a new sub-processor requires this DPIA to be updated.

4. Necessity and proportionality test

Why is the processing necessary for the legitimate interest?

Without contact data we cannot reach decision-makers about a product that is professionally relevant to them. Generic advertising (paid social, search) is materially less efficient at the company stage we are at and would not allow per-recipient personalisation that demonstrates the product's value.

Could we achieve this with less data?

Yes — we already exclude phone numbers from sends, exclude special-category data, exclude personal email addresses, and exclude tracking pixels in the highest-risk markets. We do not buy or generate behavioural-profile data. We use the minimum dataset that allows targeted, role-relevant outreach.

Could we use opt-in (consent) instead?

No effective alternative exists — opt-in lists at this market segment are sold by data brokers under questionable consent provenance, which would create greater risk than role-targeted legitimate-interest outreach. We accept the higher disclosure burden of legitimate interest in exchange for cleaner data hygiene.

5. Risks and mitigations

6. Data subject rights — how each is honoured

• Right to information (Art. 13/14): the cold email itself contains the controller name, contact, purpose, and link to full Privacy Policy.
• Right to access (Art. 15): requests to privacy@mentionhub.ai are responded to within 30 days. Data export in CSV / JSON.
• Right to rectification (Art. 16): same address, same SLA. We update or delete on request.
• Right to erasure (Art. 17): processed within 30 days. Suppression-list entries are kept after erasure to honour the opt-out — explained in the response.
• Right to object (Art. 21): one-click unsubscribe in every email. Effect: instant + permanent.
• Right to data portability (Art. 20): CSV export of held data on request.
• Right to lodge a complaint: recipients are informed they may complain to their national supervisory authority (e.g. Estonia AKI, Spain AEPD, France CNIL).

7. Retention and deletion

• Active prospect data: retained while the campaign cohort is live, max 18 months from initial reveal.
• Suppression-list data: retained indefinitely; needed to honour opt-out under Art. 21.
• Engagement event logs (open/click): rotated after 12 months.
• Snapshot cache (`prospect_snapshots` table): TTL 7 days, then auto-purged.
• On controller dissolution or business sale: personal data is destroyed or transferred only as part of the asset sale, with successor controller bound by the same DPIA.

8. International transfer assessment

The two non-EU sub-processors (SignalHire and Clay, both US-based) operate under SCC 2021/914 with supplementary measures: data is transferred only as required for the specific operation (contact reveal, list enrichment), not retained beyond the operation, and is segregated by customer. We have reviewed each sub-processor's government-access disclosures (FISA 702, EO 12333) and concluded the residual risk is acceptable for B2B corporate-role contact data, given the limited data categories and short retention.

9. Conclusion

The processing described is necessary for the legitimate interest of Mentionhub OÜ to introduce its product to professional decision-makers. The risks have been identified and mitigated. Data subjects retain meaningful control through the right to object (one-click) and other GDPR rights. The processing is approved subject to ongoing monitoring and the annual review schedule above.