Skip to content 
Running email marketing without proper legal cover is like driving in a snowstorm on bald tyres. It might be fine for a while, but when something goes wrong, it really goes wrong. If your welcome flows, abandoned carts and Christmas promos are all humming away, yet your privacy policy for an online business is one vague page, you have a gap the ICO could easily question.
We want to show a different way to fix that gap. Instead of trying to rewrite your whole privacy policy from scratch, you can turn your real email marketing flows into a clear PECR and UK GDPR annex. That annex plugs into what you already have on your website and turns your daily marketing work into compliance proof you can actually understand and update.
This sits alongside your wider online compliance work, like keeping your core privacy policy, cookie policy and website notices up to date, so your business looks joined-up and compliant across all touchpoints.
Turn Messy Email Flows Into Ready-Made Compliance Gold
Most UK SMEs run all sorts of flows without thinking too hard about the legal side, for example:
- Welcome and onboarding series
- Abandoned cart and browse recovery
- Seasonal and Black Friday blasts
- Win-back, reactivation and VIP offers
Then they have a privacy policy that just says something like, “we may send you marketing communications”. That does not match reality.
A smarter way is to:
- List your real flows in tools like Klaviyo, Mailchimp, HubSpot or Shopify
- Note who is in each flow and why they get those emails
- Turn that list into a clear, annex-style section you attach to your current policy on your website
As we head into Q4, when Christmas offers, wet weather and long dark evenings hit, inboxes fill up and complaints rise. That is exactly when regulators look closely at email and SMS marketing. Cleaning up your consent and mapping your flows into an annex now means you go into peak season ready.
Why Your Email Journeys Belong Inside Your Privacy Policy
A single line about “marketing emails” is not enough when your automations follow people for weeks. Under UK GDPR, people should understand:
- What types of emails you send
- Why they get them
- How they can say no
A detailed annex makes this clear. It can break emails into categories, for example:
- Transactional or service messages
- Account and security emails
- Product education or onboarding
- Newsletters and promotions
- Seasonal or limited-time campaigns
- Win-back and reactivation flows
This helps your business as well. It gives your marketing team a simple rulebook, makes vendor checks easier, and gives you something you can update quickly when you add a new journey or switch platforms, keeping your website privacy information in step with your actual practices.
Mapping Lawful Basis and Getting PECR Right
Under UK GDPR, most email marketing sits on one of three legal bases:
- Consent
- Legitimate interests
- Legal obligation or contractual necessity
In practice, that usually works like this:
- Order confirmations, receipts, password resets and security alerts: sent because they are needed to perform a contract or meet legal duties
- Onboarding and product education for recent customers: often based on legitimate interests and, for B2C, linked to PECR soft opt-in rules
- Newsletters, VIP content and promo blasts: based on consent, or soft opt-in if the person is an existing customer and the rules fit
PECR sets extra rules for electronic marketing. For individuals, you usually need either:
- Clear consent, for example a tick box that is not pre-ticked, with simple wording, or
- Soft opt-in, where someone bought something or nearly bought, you gave them a fair chance to say no at that point, and your messages are about similar products or services
In your annex, you can create a simple structure so every flow has:
- Name or short description of the flow
- Purpose of the emails
- Lawful basis under UK GDPR
- Whether PECR consent or soft opt-in applies
- Audience, for example prospect, existing customer, B2B contact
- How they can unsubscribe or object
You can also list your sign-up sources, like:
- Checkout boxes
- Lead magnets
- Black Friday waitlists
- Pre-order or back-in-stock lists
- Referral or loyalty schemes
Next to each one, note:
- Whether you rely on consent or soft opt-in
- The wording used at sign-up
- Any limits or time frames, for example “Christmas offers only”
This gives you a clear record that expectations were managed and supports your wider online compliance record-keeping.
Suppression Lists, Unsubscribes and Vendor Transparency
Suppression lists are not extra marketing fuel. Under PECR and UK GDPR, they are a safety net that helps you avoid emailing people who:
- Unsubscribed
- Objected to marketing
- Complained or were marked as spam
Your annex should say:
- How people can unsubscribe, for example a one-click unsubscribe link, preference centre, or reply by email
- How quickly you act on opt-outs
- How you deal with partial limits, for example stopping newsletters but still sending important service messages
- How you make sure these settings sync across tools like your email platform, CRM and helpdesk
This matters a lot during Q4. Unsubscribe rates rise when inboxes fill with Black Friday and Christmas offers. You want clear, simple wording and strong internal habits so every opt-out is honoured.
You should also be open about your email stack. Instead of saying “we use email providers”, list your key vendors in the annex, for example:
- Email service platforms
- E-commerce platforms
- Payment providers
- CRM tools
- Customer support tools
Next to each vendor, record:
- Their role, for example processor or independent controller
- What they do with email-related data, for example sending emails, tracking opens and clicks, helping with segmentation
- The types of data they see, for example email address, order history, engagement data
- Whether data leaves the UK and on what basis
When tools change, you just update this vendor schedule without tearing up the full privacy policy on your website, helping you stay compliant online with minimal disruption.
Key Takeaways
Your real email marketing work is the best place to start when you want a stronger privacy policy for an online business. Instead of guessing, you follow what is already happening in Klaviyo, Mailchimp, Shopify, your CRM and other tools, and turn that into an annex you can stand behind.
Key takeaways:
- Map every flow to a lawful basis under UK GDPR
- Be clear on when you use PECR consent and when you rely on soft opt-in
- Keep suppression lists and unsubscribe routes clean and reliable
- Document vendors and data sharing in a vendor-by-vendor schedule
- Refresh the annex regularly, for example before and after peak seasons, and make sure your website privacy notices reflect those updates
FAQ
Q: How is PECR different from UK GDPR for email marketing?
A: PECR decides when you can send electronic marketing, like email and SMS, and to whom. UK GDPR sits on top and covers how you handle personal data in general. For email marketing, you need to meet both sets of rules at the same time.
Q: Do I really need consent for every marketing email?
A: No. For B2C emails, you either need valid consent or you need to meet the soft opt-in rules for existing customers. For B2B contacts at work addresses, the rules can be a bit more flexible, but UK GDPR still applies, so you must have a lawful basis and respect objections.
Q: What should my unsubscribe process look like to be compliant?
A: It should be simple, clear and quick. A one-click link in every marketing email is common. You should act on requests as soon as you can, keep a record so they are not added again, and make sure people can still get necessary service messages if those are needed.
Q: How often should I update my email annex and privacy policy?
A: At least once a year and whenever something big changes, like new tools, new high-volume flows or a shift in legal guidance. Many teams find it helpful to review the annex before Black Friday and Christmas campaigns and again once the dust settles, then update the privacy and cookie information on their website so it stays accurate.
Q: Can professional support help if we use multiple email and CRM tools?
A: Yes. A legal team that understands online marketing can audit your full stack, map each flow and vendor to lawful bases, draft the annex, and keep it aligned with your main privacy policy and other website policies as your business and tools change over time.
Protect Your Online Business With The Right Legal Documents Today
If you are ready to safeguard your customers’ data and build trust, we can help you put a compliant privacy policy for an online business in place quickly and clearly. At Stay Legal, we focus on straightforward documents that fit the way you actually operate online. Let us take care of the legal detail so you can concentrate on growing your business with confidence.
