How confident are you that you are allowed to use leads generated online for the purposes you have in mind?

With great astonishment, we repeatedly discover that lead forms in exhibitor directories at trade fairs or online portals are not GDPR-compliant. This means that the leads generated this way are worthless for you, as they may not be used for marketing and sales purposes.

Companies may only process data from lead forms if the prospect consented to the processing. Article 7 of the GDPR describes all the conditions required for consent. As an advertising company, you are legally obligated to prove that the prospect has consented to use his data from the lead form. However, the online provider provides the lead form, and you have little to no influence on its design.

For you to use the data from online lead forms in a GDPR-compliant manner, the following requirements must be met

1. The operator of the online portal or exhibitor directory requires the interested party’s consent to pass on their data from the lead form to your company.
2. According to the GDPR, to process and use the data from the lead form in your company (for example, to send e-mailings, contact them by phone, etc.), you must prove that you have the user’s consent. So you must ensure that the lead form provider obtains consent for the types of data processing you want! Otherwise, you may not use the leads as you intended.

Lead form on chemeurope.com: Example of a GDPR-compliant declaration of consent

Quick test: Is the lead form compliant with the GDPR?

But how can you quickly tell whether a lead form is GDPR-compliant and whether you can use the generated leads?

To do this, check whether the lead form contains a consent form and whether it meets all of the following conditions:

• Is the consent form visibly included in the lead form? Hiding it in the terms and conditions or the privacy policy is not GDPR-compliant.
• Does the declaration of consent contain permission to pass on the prospect’s data to your company? Your company must be explicitly mentioned. Formulations like “We will pass on your data to our advertising customers” are not GDPR-compliant!
• Does the declaration of consent contain a clear and comprehensible list of all processing purposes (e.g. contact by telephone, e-mail, letter, newsletter, etc.) of the prospect data by your company?
• Is a reference to the possibility of revocation according to GDPR included?

Only if all these conditions are met by the declaration of consent in the lead form is the lead generation GDPR-compliant, and they are allowed to process the leads from online providers and use them for your purposes.

GDPR-compliant lead generation on the industry portals of LUMITOS

On the industry portals of LUMITOS, we generate GDPR-compliant sales leads for our advertising customers. Which form of advertising best suits your goals? Take a look at our Media Kit 2023.