How to send emails via an API in a GDPR-compliant way: a guide for small sales teams

BOTrento Team12 October 20269 min read

Transactional, reply or marketing: sort your emails first

Before you look at any tool, sort your outgoing emails into three groups. The rules differ for each, and most compliance problems come from mixing them up.

The practical lesson: a follow-up on a quote someone requested is a very different thing from a cold sequence sent to a bought list, even if both go through the same API. Tag each automated flow with its type so you know which rules apply.

Legal basis: which one fits which email

Under GDPR, every processing activity needs a legal basis. For sales email, three are relevant in practice.

Steps before a contract

When a prospect asks for a quote, you can process their contact details to answer and send the quote. This covers the reply and a reasonable follow-up on that specific request. It doesn't cover adding them to a newsletter.

Legitimate interest

Often used for B2B follow-ups and some outreach to business contacts. It requires a short written balancing test: what your interest is, why email is necessary, and why it doesn't override the person's rights. Keep it on file. National e-marketing rules may still require consent for unsolicited messages, so check the rules in the countries you send to.

Consent

Needed for most newsletters and promotional campaigns to individuals, and in some countries to business addresses too. Consent has to be recorded: when, how and to what text the person agreed.

If you're unsure which basis covers a flow, don't automate it yet. Settle that first, with legal advice if needed.

Processors: who touches the email on its way out

When an email goes via an API, several companies may process personal data: the email delivery provider, your CRM, an AI tool that drafts the text, and possibly a hosting provider behind each of them. Each one is a processor (or sub-processor), and you remain the controller.

For each processor, check:

• A data processing agreement (DPA) signed or accepted, describing what data they process and for what purpose.
• A list of sub-processors, including the AI model provider if text goes to a language model.
• Where data is stored and where it is processed. These can be different places: storage on an EU server doesn't mean every processing step happens there. We explain the difference in where your data is when you use AI.
• Transfer safeguards if any processing happens outside the EU.
• Whether your data is used for training models, and how to switch that off.

If you're comparing tools, our list of seven questions to ask a vendor before you sign includes an email you can send to them as it is.

Logging, retention and opt-out

Automation makes it easy to send more email and harder to explain later what happened. Three habits keep you on the right side of GDPR.

Log what matters, not everything

For each automated send, keep: recipient, date, email type, the legal basis, and which template or draft was used. That's enough to answer a complaint or an access request. Don't copy full email bodies into extra spreadsheets "just in case"; every copy is another place you must protect and delete.

Set retention periods

Decide how long you keep enquiries that didn't turn into business, and delete or anonymise them after that. Make sure the same rule applies in your mailbox, CRM, email API dashboard and any AI tool.

Make opt-out work across systems

An unsubscribe that only removes someone from one tool isn't enough. If a person says "stop emailing me", that needs to reach your CRM, your email API suppression list and anyone drafting follow-ups by hand. A simple footer for sales follow-ups could look like this:

You're receiving this because you asked us for a quote on [date]. If you'd rather not hear from us about it again, just reply "no thanks" and we'll stop. How we handle your data: [link to privacy notice].

Step-by-step checklist before you switch on an email API

1. List every automated flow (enquiry acknowledgement, quote email, follow-up, newsletter) and tag each as transactional, reply or marketing.
2. Write down the legal basis for each flow. For legitimate interest, add a short balancing test.
3. Map the processors: email API, CRM, AI tool, hosting. Collect a DPA and sub-processor list for each.
4. Check storage and processing locations, including where the AI model is called.
5. Minimise the data sent to each system. The AI drafting a reply doesn't need the client's bank details or full history.
6. Update your privacy notice so it mentions the processors and the use of AI for drafting, where relevant.
7. Set up logging (recipient, date, type, basis, template) and a retention period.
8. Connect opt-outs so one "stop" reaches every system.
9. Keep a human check on anything that isn't purely transactional. A wrong price or a promise in an automated email is a business problem as well as a data problem.
10. Brief your team on what may and may not go into AI tools. Our overview of the EU AI Act for small businesses includes an internal policy template.

For a shorter yes/no version, see the GDPR checklist for AI sales tools.

Where AI fits: drafting is not the same as sending

A lot of risk disappears if you separate two jobs: preparing an email and sending it. An AI tool that drafts a reply from the text of an enquiry processes personal data, so it needs a DPA and data minimisation. But if a person reviews the draft and sends it from your normal mailbox, you keep control over what goes out, to whom and when.

Fully automatic AI sending is where things get harder. You have to be sure the model didn't invent a price, quote the wrong client, promise a date you can't keep or ignore an opt-out. For small B2B teams answering real enquiries, approval by a person is usually the simpler and safer setup. It also fits the AI Act's general expectation that people stay in charge of decisions that affect customers.

How BOTrento handles this

BOTrento Chief of Staff is a managed process for enquiries, quotes and follow-ups, built around the separation above:

• It doesn't send anything on its own. It prepares drafts of replies, quotes and follow-ups in four languages (English, German, French, Czech), and a person approves them. Nothing goes out without that approval.
• It tracks what was promised. If someone wrote "I'll get back to you by Friday", it reminds you. Every working morning you get a Today 1+3 overview in the app and by email.
• Data is stored on EU servers (Germany, with the application database in Ireland). The language model only gets the text needed for the task, through a commercial provider's API, and those providers don't use the data for training. To be clear: an EU server that calls an external AI API is not a closed system, and we don't claim it is.
• AI usage is included in the plan with a monthly limit. You can optionally use your own Anthropic API key; see how own API keys work.
• Connection: IMAP mailboxes directly; Gmail, Google Workspace and Microsoft 365 for now via forwarding or import; CRM or spreadsheet data as CSV/XLSX. It doesn't replace your CRM.

You can see a sample of the process, read how it works for B2B service companies, or start the 14-day free trial: no card and no API key of your own needed. The 14 days start only when your data is first uploaded, and someone from our team gets in touch within 24 hours on working days to help connect your mailbox. Plans are listed on the pricing page.