Yes, buying a company database is legal, as long as the provider processes the data lawfully. Firmeo collects the data from public sources and from users’ own profile updates and processes it on the basis of legitimate interest (Art. 6(1)(f) GDPR). What matters, however, is how you use the list: calls made by a person and offers sent by post are allowed, provided you inform the person contacted and respect any refusal, while commercial emails and text messages require the recipient’s prior consent, including when the recipient is a company (Romanian Law 506/2004, Art. 12).
What you can do with the list, by channel
The rule depends on the channel you use to contact the company.
AllowedAnalysis and prospecting
- select companies by CAEN code, county, turnover
- analyse the market and your competitors
- check customers and partners
Allowed, with conditionsPhone, calls made by a person
- introduce yourself and say where you got the data
- if they refuse, do not call again
- automated calls require consent
Allowed, with conditionsPost (printed offer)
- identified sender
- information about the data at first contact
- if they refuse, remove the company from the list
Requires consentMarketing email and SMS
- the recipient’s consent, before sending
- also applies to company addresses
- in every message: real sender + unsubscribe option
Your obligations after buying the list
For the individuals in the list (for example directors, with their name, business phone and business email) you become a data controller. This means four things:
- You inform the person at the latest at the first contact and within one month of receiving the data: who you are, why you are contacting them, the legal basis, where you got the data and what rights they have (Art. 14 GDPR).
- You respect objections. If someone no longer wants to be contacted for marketing purposes, you stop immediately and no longer use the data for that purpose (Art. 21 GDPR).
- You keep a record of refusals and of the consents received, so that you can prove them.
- You document the legitimate interest: why the contact is relevant to the company concerned and why it does not disproportionately affect the people contacted.
How to obtain consent for email
The list shows you the right companies and who runs them. You make the first contact by phone or post and introduce yourself; if the company wants to receive offers by email, you ask for its consent and record it (date, person, address). The exception provided by law covers only your own customers: an address received from a customer in the context of a sale may be used for similar products, provided you offer a simple, free way to unsubscribe from the start and in every message (Law 506/2004, Art. 12(2)).
What to ask a company list provider
A B2B database built from public sources is normally used on the basis of legitimate interest, not of consent given by each person on the list. Before you buy, ask the provider for six clear answers:
- The data source: where the identification and financial data come from and, separately, where the contact details come from.
- The declared legal basis for processing (for example legitimate interest, Art. 6(1)(f) GDPR) and where it is explained, usually in the privacy policy.
- The date of the last update and how often the database is updated: old data means wasted calls and people who no longer have anything to do with the company.
- How the right to object is exercised: the address where people on the list ask for deletion, and whether the provider removes those who have objected.
- What kind of email addresses it contains: generic company addresses (office@, contact@) or named ones (firstname.lastname@). Named addresses are personal data and require you to inform the person at the first contact (Art. 14 GDPR).
- The invoice and written terms: an invoice in your company’s name and the terms of use for the data, i.e. what you may do with the list.
Firmeo’s answers: the data comes from public sources, such as the Trade Register (ONRC), the Ministry of Finance, ANAF, companies’ official websites and Google, plus updates made by users on their profiles; the legal basis is legitimate interest; the database is updated daily; objection and deletion requests go to [email protected]; the terms are in the privacy policy.
What Firmeo does with the data
Firmeo, operated by Kendall Enterprise Group S.R.L., collects data from public sources (the Trade Register, ANAF, the Ministry of Finance, companies’ official websites, Google), as well as from updates users make to their own profiles. The database is updated daily. Firmeo publishes only business data: the company name and details, the management and their position, the business phone and business email. Requests concerning personal data (access, rectification, objection, erasure) are sent to [email protected], the address dedicated to these requests, using the GDPR request form (in Romanian). The reply comes within one month of receipt at the latest; in complex cases the deadline may be extended by two further months, and we announce any extension within the first month (Art. 12(3) GDPR). The details are in the privacy policy. Complaints may be addressed to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP). Firmeo cannot give consent on behalf of the companies in the list: each buyer obtains the email consent for their own campaigns.
Select companies by criteria and receive the list in Excel immediately after payment, or check a company by CUI for free.
GDPRFrequently asked questions
Short answers about company databases and data protection.
Is it legal to buy a database of company emails?
Yes, as long as the provider processes the data lawfully. Firmeo uses data from public sources and from users’ own profile updates, on the basis of legitimate interest (Art. 6(1)(f) GDPR). After the purchase, using the emails for commercial messages requires the recipient’s prior consent (Romanian Law 506/2004, Art. 12).
Can I send presentation emails to the companies in the list?
Not without their prior consent. Law 506/2004 (Art. 12(1) and (4)) prohibits commercial communications by email without consent, including to companies. Contact the company first by phone or post and ask for its consent to email; record the date and the person who gave it.
Do generic addresses such as [email protected] fall under GDPR?
GDPR protects natural persons: a personal address (
[email protected]) is personal data, while a company’s generic address usually is not. For commercial messages, however, Law 506/2004 also applies, and it requires prior consent for legal-entity recipients too, so for generic addresses as well.
Can I call the companies in the list?
Yes, calls made by a person are allowed: you introduce yourself, say where you got the data and, if the other party refuses, you do not call again. Automated calls without a human operator and commercial text messages require prior consent.
What do I have to tell the people I contact?
At the first contact, and within one month of receiving the data at the latest: who you are, the purpose of the contact, the legal basis (legitimate interest), the source of the data, how long you keep it and that they can object to direct marketing at any time (Art. 14 and Art. 21 GDPR).
How do I have my data removed from Firmeo?
Fill in the
GDPR request form (in Romanian) and send it to
[email protected], the address dedicated to requests concerning personal data. We reply within one month of receipt at the latest; in complex cases the deadline may be extended by two further months, with notice within the first month. The conditions are in the
privacy policy. If you receive no reply, you can contact ANSPDCP, the Romanian data protection authority.
What should I ask a company database provider?
The data source, the declared legal basis (usually legitimate interest), the date of the last update, how the right to object is exercised, whether the email addresses are generic or named and what terms of use you receive in writing. At Firmeo: public sources and user updates, legitimate interest, daily updates, objections to
[email protected].
General information about GDPR and Romanian Law 506/2004, not legal advice. For your own campaigns, check your specific situation with a lawyer or with your data protection officer.
