A Practical Guide for MarketerM8 / HighLevel Users

Important Disclaimer:
The following information is provided for general educational and informational purposes only and does not constitute legal advice. GDPR compliance can vary depending on your business activities, industry, location, and how you collect and process data. You should seek professional legal advice from a qualified solicitor or GDPR specialist regarding your specific circumstances and compliance obligations.

If you use HighLevel through MarketerM8 to collect, store and manage customer or prospect data, then GDPR applies to how that information is used.

One of the most important GDPR concepts to understand is your “lawful basis” for processing personal data.

In simple terms, GDPR says you must have a valid legal reason every time you collect or use somebody’s personal information.

You cannot simply say:

“They gave me their email address.”

That alone is not enough.

For most MarketerM8 and HighLevel users, the four most relevant lawful bases are:

• Consent
• Contractual Necessity
• Legitimate Interests
• Legal Obligation

Below is a practical explanation of each.

1. Consent

Consent means a person has clearly agreed for you to process their personal data for a specific purpose.

This is the lawful basis most commonly used for marketing activity.

Valid Consent Must Be:

• Freely given
• Specific
• Informed
• Clear and unambiguous
• Easy to withdraw

Good Example

A visitor completes a form and ticks a box saying:

“Yes, I would like to receive marketing emails and updates.”

Bad Examples

• Pre-ticked checkboxes
• Hidden consent in terms and conditions
• Automatically adding all enquiries to marketing campaigns
• Purchased contact lists

Common HighLevel / MarketerM8 Examples Using Consent

Consent is commonly used for:

• Newsletter subscriptions
• Webinar registrations
• Lead magnet downloads
• Promotional email campaigns
• SMS marketing
• Workshop registrations
• Marketing automation nurture sequences

Recording Consent

It is important to keep records of consent.

HighLevel can help by storing:

• form submission timestamps
• source tracking
• IP addresses
• campaign information
• opt-in fields

This creates an audit trail should you ever need to demonstrate how consent was obtained.

Withdrawal of Consent

Under GDPR, people must be able to withdraw consent easily.

If somebody unsubscribes from marketing:

• you must stop sending promotional communications
• you should not manually re-add them to workflows
• you should not override unsubscribe settings

Transactional or service-related messages may still be permitted where appropriate.

2. Contractual Necessity

This lawful basis applies where processing personal data is necessary to fulfil a contract or provide a requested service.

This is extremely common for CRM users.

Common HighLevel / MarketerM8 Examples

• booking appointments
• client onboarding
• delivering purchased services
• membership access
• customer support
• sending invoices
• appointment reminders

If somebody requests your services, you are allowed to process their information to provide those services.

Important Limitation

Contractual necessity does not automatically allow unlimited marketing.

For example:

• a customer purchases a service from you

You may send:

• service updates
• appointment confirmations
• onboarding information
• customer support messages

However, this does not automatically mean you can add them to unrelated long-term marketing campaigns without another lawful basis.

3. Legitimate Interests

Legitimate interest is one of the most misunderstood lawful bases under GDPR.

It allows businesses to process personal data where:

• there is a genuine business reason
• the processing is necessary
• the individual’s rights and privacy do not override that interest

This is commonly used for:

• sales follow-up
• customer relationship management
• some forms of B2B communication

Legitimate Interest Is Not a Free Pass

Many businesses misuse legitimate interest to justify excessive marketing.

Before relying on legitimate interest, you should consider:

1. Do we have a genuine business reason?
2. Is this processing necessary?
3. Would the person reasonably expect this?
4. Could this be considered intrusive or harmful?

Common HighLevel / MarketerM8 Examples

Examples that may be reasonable include:

• following up a sales enquiry
• sending a requested quotation
• calling back a missed call
• short-term follow-up after an enquiry
• relevant B2B communication

Example:

A business owner requests information about CRM software. A short follow-up email sequence may be considered a legitimate interest.

Higher Risk Examples

• long-term automated marketing after a single enquiry
• purchased lead databases
• cold SMS campaigns
• scraping online contact data
• aggressive automation sequences

The more intrusive or unexpected the marketing becomes, the weaker the legitimate interest argument usually becomes.

Legitimate Interest and Automation

HighLevel makes automation extremely easy, but businesses should avoid over-automation.

Sensible Example

• a short follow-up sequence after a quote request

Riskier Example

• automated marketing campaigns continuing for many months after a single enquiry with little engagement

Businesses should regularly review workflows to ensure communications remain reasonable and proportionate.

4. Legal Obligation

This lawful basis applies where businesses are legally required to process or retain certain information.

Examples include:

• tax records
• financial records
• insurance documentation
• safeguarding records
• anti-money laundering requirements

Common HighLevel / MarketerM8 Examples

You may need to retain:

• invoices
• contracts
• payment records
• important customer communications

…even if somebody later requests deletion, where another legal obligation requires those records to be retained.

How HighLevel Can Help Support GDPR Compliance

While using a CRM system does not automatically make a business GDPR compliant, HighLevel includes several useful features that can help businesses manage consent, communication preferences, and customer data more responsibly.

These tools can help reduce risk when used correctly as part of a wider GDPR process.

DND (Do Not Disturb) Settings

HighLevel includes built-in DND functionality which allows businesses to suppress certain types of communication to specific contacts.

For example, contacts can be marked as:

• DND for email
• DND for SMS
• DND for calls
• DND for Facebook messages
• DND for all communications

This helps businesses:

• respect unsubscribe requests
• prevent accidental marketing
• avoid repeatedly contacting people who no longer wish to hear from them

Email Preferences & Subscription Management

HighLevel also includes improved email preference management features which allow contacts to:

• unsubscribe from marketing emails
• manage communication preferences
• selectively opt in or out of certain communication categories

This can improve:

• GDPR compliance
• customer experience
• email engagement
• sender reputation

List Hygiene & Reconfirmation Workflows

One highly recommended best practice is to run a regular list hygiene or reconfirmation workflow.

For example:

• every 3 to 6 months
• send a simple email asking contacts whether they still wish to remain subscribed

This has two major advantages.

1. Helps Support GDPR Compliance

A reconfirmation email helps demonstrate that:

• consent remains current
• contacts still wish to hear from you
• your database is being actively maintained

2. Improves Email Deliverability

If large numbers of contacts:

• never open emails
• ignore campaigns
• delete messages
• mark emails as spam

…this can negatively impact your sender reputation with email providers and ISPs.

In simple terms:

• if too many people ignore your emails, future emails are more likely to land in spam folders

Why Smaller, Engaged Lists Often Perform Better

A smaller list of genuinely engaged subscribers will usually outperform a much larger inactive list.

Using HighLevel Automation for List Hygiene

HighLevel workflows can help automate this process.

Examples include:

• tagging inactive contacts
• monitoring opens and clicks
• triggering re-engagement campaigns
• automatically applying DND status
• unsubscribing inactive users after repeated non-engagement

Practical Examples for MarketerM8 / HighLevel Users

Activity	Likely Lawful Basis
Newsletter signup	Consent
Webinar registration	Consent
Discovery call booking	Contractual necessity
Customer onboarding	Contractual necessity
Appointment reminders	Contractual necessity
Following up an enquiry	Legitimate interest
Existing client communications	Contract / legitimate interest
SMS marketing	Usually consent
Invoices and payment records	Legal obligation

Recommended Best Practice

Use Consent For:

• marketing emails
• newsletters
• SMS campaigns
• promotions
• long-term nurture campaigns

Use Contractual Necessity For:

• active customers
• appointments
• service delivery
• customer support

Use Legitimate Interest Carefully For:

• short-term enquiry follow-up
• relevant B2B communication
• customer relationship management

Use Legal Obligation For:

• financial records
• compliance requirements
• tax documentation

Final Thoughts

Owning a CRM system does not automatically make a business GDPR compliant.

HighLevel and MarketerM8 provide tools that can support compliance, but each business remains responsible for:

• how data is collected
• how consent is obtained
• how automation is used
• how customer data is stored and protected

Businesses should regularly review:

• forms
• workflows
• email campaigns
• SMS activity
• user permissions
• privacy policies

…to ensure they remain compliant with GDPR and related regulations such as PECR.

Good GDPR practice is not just about avoiding legal problems.

It is also about:

• respecting customer preferences
• improving communication quality
• reducing spam complaints
• protecting sender reputation
• building trust with your audience

When used properly, HighLevel’s automation, DND controls, preference management tools, and list hygiene workflows can help businesses achieve both better compliance and better marketing performance at the same time.