Compliance
Outreach that follows UK rules before every send.
PECR and UK GDPR applied as fixed rules at the moment each message is sent. AI never makes these decisions and cannot override them.
- Rules, not AI judgement
- Companies House check
- Opt-outs honoured at once
- Database hosted in London
Checked before every message
At send time- Is this address suppressed on this channel?
- Is there a recorded, permitted source for the data?
- Is the recipient a company, or a sole trader or individual?
- Does the relationship allow this message on this channel?
- Is a platform window open (WhatsApp, Instagram, Messenger)?
- Are quiet hours in force?
- Does a cold first contact carry the source line?
- Does marketing email carry an unsubscribe?
Each check can allow, block or hold a message for a person. The reason is always recorded.
PECR
A limited company and a sole trader are not the same inbox.
PECR lets you email a corporate subscriber (a limited company, LLP or Scottish partnership) without prior consent, if they can opt out. A sole trader or ordinary partnership counts as an individual and needs consent first.
- Status comes from Companies House, never an import column.
- An unmatched company is unknown, never assumed incorporated. Nothing is sent until resolved.
- Set your caution level in Settings → Data Controls; asking you about unclear cases is the default.
- No setting can loosen a rule that refuses a message.
Cold outreach, by recipient type
| Recipient | Cold email |
|---|---|
| Limited company | Allowed |
| LLP | Allowed (treated as a company) |
| Scottish partnership | Allowed (treated as a company) |
| Sole trader | Blocked |
| Ordinary partnership | Blocked |
| Private individual | Blocked |
| Not yet known | Held for your review |
A sole trader who connects or follows you on LinkedIn can get one non-promotional opener; marketing waits for a reply. Read the detail.
UK GDPR
Legitimate interests, written down.
Emailing a named person uses personal data, so UK GDPR applies even where PECR needs no consent. Most B2B outreach relies on legitimate interests, backed by a legitimate interests assessment (LIA).
Your basis is recorded
State your basis and summarise your assessment in Data Controls. Until then, every cold contact waits for a person.
Evidence of every decision
Each send records the decision, the rule version in force and the facts it relied on.
AI voice calls
Every AI call says it is an AI. Every AI call was asked for.
The AI Voice Sales Agent only calls people who asked for a call or agreed to one on your form. It never makes cold calls, and its opening cannot be edited, shortened or skipped.
Only what follows the opener is yours to word. ClientTurn is not named unless someone asks who built the assistant.
How every call opens
“This is an AI assistant calling from {your business} about the enquiry you sent us {day}. Is now an OK time for a couple of minutes?”
When recording is on, it continues:
“Just so you know, this call is recorded so we have an accurate note of what we discuss.”
{your business} is your trading name; {day} reads as “earlier today”, “yesterday” or a date.
Consent before any AI call
PECR regulation 19 requires prior consent for automated calls, which very likely covers an AI agent, for companies too. The agent only calls leads who asked or agreed on your form, with evidence recorded. A number alone is not consent, and none come from enrichment or imports.
Calling hours in the lead's own time
Default: weekdays 09:00 to 20:00, Saturdays 10:00 to 16:00, no Sundays or UK bank holidays. You can narrow them, never beyond 08:00 to 21:00. If the lead's time zone is unknown, no call is made.
Recording notice, straight after the opener
With recording on, the call says so right after the opener, before anything else. With it off, nothing is recorded.
Your own number, and who you are on request
Each business calls from its own dedicated UK number, never shared, rotated or disguised. Your legal name and a contact address or freephone number are required, and read out on request.
Opt-outs end the call and stick
If someone asks not to be called, the call ends politely and the lead is suppressed. Attempts are capped, and each call has a 5 minute budget.
Rules the AI cannot override
Consent, calling hours, suppression and attempt limits are fixed rules checked before every dial, not by the model. Human calls without call consent are screened against TPS and CTPS first.
This describes product behaviour and is not legal advice. You remain responsible for the consent you collect and calls made in your name. See the ICO’s guidance on telephone marketing.
Built into every message
The safeguards you would otherwise run by hand.
The source line on the first message
UK GDPR Article 14: the first cold email says where their details came from and links your privacy notice. Never AI-written. Held if the source or notice URL is missing.
Opt-outs on every message, honoured at once
Marketing email carries an unsubscribe link and one-click header. STOP ends that channel; STOPALL, a written request or email unsubscribe ends everything.
Suppression that survives deletion
Suppression is by address, so re-adding someone does not bypass it. After erasure, a one-way hash keeps them blocked without storing the address.
Quiet hours for texts and WhatsApp
Automated SMS and WhatsApp wait until quiet hours end, re-checked immediately before each send.
Consent records for SMS and WhatsApp
Texts and WhatsApp only go to mobiles people gave you themselves, with how and when recorded. No evidence means no consent. WhatsApp needs an explicit opt-in, as Meta requires.
No phone numbers from enrichment
Cold outreach is business email only. ClientTurn never buys or looks up phone numbers.
Data rights
Requests reach the business that holds the data.
Anyone can make a privacy request through our public form. Once verified, every workspace holding them gets its own copy, dated from the first request, so deadlines run from the right day.
Export, suppress, restrict, anonymise or erase any lead, with what is removed and kept shown before you confirm. How data rights work.
Where data is held
A London database, and a published supplier list.
The application database, holding your leads, messages and audit records, is hosted in London (Supabase, eu-west-2). Optional AI assist runs on Microsoft Azure in the EU; uploaded files stay in EU-restricted storage.
Some suppliers process data outside the UK. Each one, where, and the transfer safeguard relied on are listed on our sub-processor register.
What stays with you
We help you comply. You remain responsible.
This page is not legal advice.
For the leads and prospects in your workspace, your business is the controller and ClientTurn is your processor. The product enforces rules and keeps records; it cannot decide whether your outreach is lawful. You are responsible for:
- Your legitimate interests assessment. ClientTurn records it; it does not assess it.
- An accurate privacy notice, with your legal name and notice URL kept current.
- Which data sources you permit, and truthful consent and relationship records.
- What your messages say, including claims, prices and messages you send yourself.
- Answering privacy requests on time, and ICO registration where it applies.
ClientTurn holds no compliance certification it could evidence, so it claims none. The ICO is the authoritative source; see its guidance on the PECR email marketing rules.
Reach decision makers the right way
Outreach you can explain. Every time.
Set up Data Controls once; every message is checked against it at send time.
- Fixed rulesPECR and UK GDPR checks AI cannot override.
- Cold email done rightSource line, unsubscribe and suppression built in.
- Company or sole traderChecked against Companies House, not guessed.
- Evidence on fileEvery decision recorded with the rule behind it.