top of page

Marketing Procedure  

 

Company Name: Teachers Together Ltd (“the Company”) 

​

Use: Internal Policy

​

Model Policy No.  MP01

​​

Model Policy Name: Marketing Procedure

​​

Date: February 2025

 

Version: 2.0

 

 

1. Overview

​

All organisations that are involved in Direct Marketing are required to comply with marketing legislation. This includes the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) which outlines the rules around unsolicited Direct Marketing by electronic means. If Direct Marketing involves the processing of personal data, then the Company must comply with data protection laws which include the General Data Protection Regulation (GDPR) and the Data Protection Act 1998 [1].

 

The Company may market its products and services to individuals. This policy sets out the Company’s procedures to comply with the marketing rules outlined in PECR. All Company staff (whether employees, temporary staff, or contractors) must adhere to this policy – any questions should be directed to the Company Director.

​

​

​

​

​

​

[1] Expected updates to legislation: The Data Protection Act 1998 will be replaced by the Data Protection Bill which is still in draft form at the time of writing (May 2018).  The EU directive which is the basis for PECR is also being updated and will be replaced by a new E-Privacy Regulation. This Marketing Procedure will be reviewed considering those changes.

 

2. Definitions used in this document

 

‘Data Protection Laws’ means the General Data Protection Regulation (EU2016/679) and any applicable statutory or regulatory provisions in force from time to time relating to the protection and transfer of personal data.

​

'Direct Marketing’ means the communication of any unsolicited advertising or marketing material which is directed to particular individuals.

​​

‘Personal Data’ means any data relating to an individual who can be identified, such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

 

‘You’ means company staff including employees, temporary workers and contractors.

 

‘We’ means the Company.

 

3. ​Direct Marketing - general

 

The Company will only send Direct Marketing to individuals and organisations in compliance with PECR and the Data Protection Laws.

​

Direct Marketing under PECR covers any marketing by electronic means such as marketing calls, texts, emails and faxes.

 

Messages with marketing elements such as hyperlinks leading to marketing, comments which are not factual in a piece of correspondence and which promote our services will be classed as Direct Marketing.

​

The GDPR and PECR rules on Direct Marketing do not cover leaflets, circulars, inserts, field marketing, media adverts or other marketing channels which are not individually addressed.

 

4. Direct Marketing - Individuals

 

Obtaining consent to direct market to individuals by text and email.

For the purposes of marketing by email, individuals are defined in PECR as a living individual, including an unincorporated body of such individuals. Individual therefore cover individual customers (e.g. sole traders) and other organisations (e.g. other types of partnership).

 

We must obtain the individual’s consent to send marketing by text and email. This consent must meet the higher threshold under GDPR in that it must be informed, clear, freely given, and specific and include an affirmative action (e.g. by opt-in, response to an email or clicking on an icon). The consent must cover the exact type of marketing material and the type of communication that We want to use. In addition, We should document and record how and when We obtained consent and what the individual has consented to. We may obtain consent via the registration form, an email or the website. 

 

We must tell individuals that they can withdraw their consent for Direct Marketing at any time. We should make sure that an individual is reminded of this right at least once every six months.  

 

If an individual withdraws their consent or asks not to receive Direct Marketing from the Company then you will (1) update the data relating to that individual immediately, (2) inform the Company Director will place that individual on a suppression list. On no account must you continue to send marketing communications to that individual.

 

 

If an individual requests that their Personal Data be erased from the Company’s database (as is their right under the GDPR) then You must check if:

  • they just do not want to receive marketing information – if this is the case, update their records accordingly.

  • they want all their Personal Data to be removed from the database - You should tell them that We will delete what information We can subject to the Company’s Retention Policy.  However if We remove them entirely from the database We may inadvertently contact them again if We come across their details from another source, such as a jobs board.

 

Soft-opt in exception for emails

In circumstances where there is a previous commercial relationship, meaning where there was a sale or negotiation of a sale of a product or service, then the Company will be able to market to the individual or organisation on the basis that the individual has given their ‘implied consent’. However, We will only be able to rely on the soft-opt if there has been a commercial relationship (selling of a service or product) and therefore, this exception will only be available to recruitment businesses in limited circumstances when dealing with individuals.

 

Marketing by post, telephone calls, fax or automated calling systems to individuals

You may send marketing by text, telephone calls, fax or automated calling systems without the prior consent of the individual provided they have not registered with the relevant preference service.  Therefore before You make any Direct Marketing approach to an individual, you must first obtain the authorisation of the Company Director and check the individual’s preference against the table below.

​

Please see Table 1 for an outline what needs to be checked/done before Direct Marketing to an individual.

​

TABLE 1​

You must always comply  with this Procedure, the Company’s Data Protection Policy and Procedure and Email, telephone, computer facilities and social media policy.  A failure to observe these procedures and policies will be treated as a disciplinary offence.

Marketing Means of Communication
Check the Telephone Preference Service (TPS)
Check Mailing Preference Service (MPS)
Check the Fax Preference Service (FPS)
Gain consent before marketing?
Provide option to opt-out of receiving marketing?
Disclose the company's identity and contact details (including number for telephone calls or automated calling systems)
By automated calling system (not live calls)
No
No
No

Yes

Yes
Yes
By fax
No
No
Yes

Yes


Yes
Yes
By telephone call
Yes
No
No

Yes *

Yes
Yes
By post *
No
Yes
No

If not listed on Mailing Preference service, then no.


Yes
No

* We can market to individuals who are listed on the TPS, MPS or FPS, if they have given their express consent for us to market to them via the relevant means of communication.

*PECR does not cover mail marketing, but We must comply with Data Protection Laws. We must not mail market to anyone who has opted out.

 

*Please note, although We can generally rely on a legitimate interest to telephone market, if they are on the Telephone Preference Service, We will not be able to.

​

5. Handling opt-outs

 

If the Company receives a request from an individual or organisation to opt-out of receiving Direct Marketing, you should add their names to a ‘do-not-contact’ list so that the Company no longer markets any of our services or products to them.

 

Once they have been ‘unsubscribed’ We must not contact them at a later date unless they ask us to.

​

If an individual or organisation asks us to remove their details, then You will need to explain that you will have to keep their details in a ‘do not contact’ list to make sure you comply with your obligations under PECR.

 

6. Marketing the product or service of a third party

​

We need specific consent to market the products or services of third parties or business partners.  We should name those organisations where we can, or for precisely defined categories of organisations if We market products or services for a group of different organisations.

​

7. Direct Marketing to organisations

 

Generally We do not need consent to send Direct Marketing to an organisation.  However, We do need to identify the Company and provide our contact details when sending Direct Marketing to organisations.

​

8. Marketing via email

​

For the purposes of marketing via email, an organisation is any corporate body (an entity with a separate legal status) with its own phone number or internet connection. This includes:

​

  • companies;

  • Scottish partnerships;

  • limited liability partnerships (LLPs);

  • corporations sole; and

  • some government bodies.

​

A company email address such as jo.bloggs@xcompany.co.uk  will fall under this. We do not need consent to market organisations by email but We must identify the individual sender as well as the organisation in our emails.  We must not conceal our individual or corporate identities and must provide contact details in every marketing email that We send.

 

Individual staff (e.g. jo.bloggs@xcompany.co.uk) can make a written request to stop receiving marketing emails. If We receive such a request We must also stop using that email address for marketing purposes. It is also good practice to stop sending emails to generic company addresses (e.g. info@xcompany.co.uk) when requested to do so.

 

If the email contains an individual’s personal data such as firstname.lastname@company.com then that individual can make a written request to opt-out of any Direct Marketing from us. If the individual requests to opt-out You must inform the Company Director immediately and cease Direct Marketing to this individual.

​

9. Marketing by post, telephone calls, fax or automated calling systems to organisations

 

Please see Table 2 for an example of what needs to be checked or done before marketing to an organisation.

​

TABLE 2

Marketing means of communication
Check the CPTS and TPS*
Check the MTS*
Gain consent before marketing?
Provide an option to opt-out of receiving marketing?
Disclose the Company’s identity and contact details
Check the FPS*
By automated calling system
No
No
Yes
Yes
Yes
No
By fax
No
Yes
If not listed on FPS, then no
Yes
Yes
Yes
By telephone call
Yes
No
If not listed on TPS or CTPS, then no
Yes
Yes
No
By post*
No
Yes
No
Yes
No
No

* We are not allowed to market to individuals who are listed on the CTPS (Corporate Telephone Preference Service) or FPS (Fax Preference Service) unless they have given their express consent for us to market to them via the relevant means of communication.

​

TPS - Telephone Preference Service

​

*PECR does not cover mail marketing, but you must comply with Data Protection Laws. You must not mail market to anyone who has opted out.

​

10. Marketing via LinkedIn

 

When Direct Marketing via LinkedIn You must check if you are marketing to an individual or a corporate LinkedIn account. You must not send Direct Marketing to an individual via LinkedIn without receiving their prior consent. Before Direct Marketing to an individual via LinkedIn You must first obtain the authorisation of the Company Director.

 

 

If you connect with an individual on LinkedIn, this does not mean that the individual has consented to receiving Direct Marketing from the Company.

 

If We hold the individual’s details we must give them a privacy notice.

​

NOTE: You should also read the Company’s Email, telephone, computer facilities and social media policy for further information on how the Company uses networking sites such as LinkedIn. 

 

11. Marketing via jobs boards

 

The Company can send information about relevant vacancies to individuals who have applied via a jobs board without consent as this does not constitute marketing material (We rely on the “legitimate interest” legal basis to send information about job opportunities - see also Note below). However, if you send any other information that promotes or advertises our services (sending information about CV writing workshops for example) then this does constitute marketing and you must obtain the individual’s prior consent before sending them such information.

 

If the Company has obtained data, including CVs and contact information, of an individual from a jobs board then before Direct Marketing to them via telephone You must:

 

  • Check that the person is not on the TPS; and,

  • Telephone call the individual to ask for their consent to direct market to them via email.

 

If You do not receive a response or receive a negative response, then You will not send any further marketing information to this individual. You will inform the Company Director that the individual does not want to receive further marketing from us.

 

NOTE:

You should also read the Company’s Email, telephone, computer facilities and social media policy for further information on how the Company uses jobs boards. 

 

12. Marketing online

 

The Company will comply with the GDPR when targeting online adverts to an individual using their Personal Data. When targeting specific users with online adverts from information obtained via cookies the Company will comply with PECR.

 

The Company does not have to comply with PECR when displaying the same marketing material to every user (non-targeted marketing) or the marketing material is targeted to the content of the page itself rather than the identity or characteristics of the users (contextual marketing). 

 

13. Penalties for non-compliance

 

Incorrect marketing may give rise to:

  • A claim due to negligence against the company for damages;

  • A complaint to the Information Commissioners Office which could result in:

    • an Enforcement Notice, requiring the business to take corrective action or;

    • a monetary fine by the ICO. Fines under GDPR can be up to €20 million or 4% of global turnover, whichever is the highest, depending on the seriousness of the activity concerned.

bottom of page