Purpose and Scope

This policy governs business email sent on behalf of THE·TEAM, including individual correspondence, marketing, sales outreach, event invitations, newsletters, automated sequences and bulk or semi-bulk communications. It applies to all employees, officers, contractors, temporary personnel and other authorized senders worldwide.

All email must be professional, accurate, lawful and consistent with THE·TEAM’s Information Technology, Security, Confidentiality and Data Protection policies. The United States CAN-SPAM Act establishes THE·TEAM’s global minimum for commercial email. Stricter regional and local requirements must also be followed.

Mandatory Employee Requirements

Employees must comply with the following requirements before sending commercial, marketing or bulk email:

• Use only THE·TEAM-approved accounts, sending platforms and services. Obtain required internal authorization from the Email Governance and Information Technology Teams before initiating a campaign or automated sequence.
• Confirm the recipient data was lawfully obtained, is relevant to the communication and has been validated using ZeroBounce or another authorized service. Remove invalid, duplicate, bounced and suppressed addresses.
• Confirm and document any consent, lawful basis or authorization required for the recipient and message. Prior opt-in consent is required where applicable regional law requires it.
• Accurately identify the sender and any party represented. Use truthful subject lines, identify advertising where required and include a valid physical postal address.
• Provide a clear, conspicuous, free and readily usable unsubscribe method for commercial marketing email. Keep the mechanism and required sender contact information operational for at least sixty (60) days after sending.
• Honor unsubscribe requests and marketing objections without delay and no later than ten (10) business days, or sooner if local law requires. Maintain suppression records and do not contact opted-out recipients again without a new lawful basis and consent where required.
• Protect confidential and personal information, maintain appropriate compliance records and promptly report suspected violations or sending problems.

Prohibited Conduct

Employees must not:

• Use personal email accounts, unapproved third-party platforms or bulk-sending services for THE·TEAM business without prior written authorization from THE·TEAM’s Data & Technology Advisory Group (DTAG) and Email Governance Team.
• Use CC or BCC recipient lists to bypass an approved bulk-sending platform; send misleading, deceptive or unlawful content; or disguise marketing as transactional correspondence.
• Guess, harvest or generate addresses to bypass data requirements, or use purchased, scraped, rented or third-party lists without required Legal and Email Governance review.
• Send to unsubscribed or suppressed recipients, circumvent sending restrictions, or move recipient data into unapproved systems.
• Rely on implied consent, soft opt-in, corporate B2B exceptions or other regional consent exceptions without prior written approval from Legal or Email Governance Team.

Approvals, Data and Sending Controls

Approval of a sending platform does not authorize every campaign. Employees must follow THE·TEAM’s review procedures for commercial, marketing and bulk email, including the intended purpose, audience and geography, data source, consent or lawful basis, sending volume, platform, suppression process and responsible business owner. Employees must not materially change an approved activity or engage an external sending vendor without required authorization.

Recipient records must be accurate, current and appropriately segmented. Evidence of consent or other authorization, campaign activity, unsubscribe requests, suppression, vendor approval and relevant delivery or complaint issues must be retained and protected in accordance with applicable law and THE·TEAM requirements.

Sales Outreach, Vendors and Monitoring

Cold outreach, individual sales prospecting and automated sequences are subject to commercial email rules even when messages are sent one at a time. Senders must comply with regional consent requirements, approved platform and volume controls, and all recipient objections. Employees may not rotate accounts or platforms to avoid restrictions.

External agencies and vendors sending on behalf of THE·TEAM must be approved, contractually accountable for applicable privacy and security obligations, and required to honor recipient preferences. Outsourcing does not remove THE·TEAM’s compliance responsibilities.

THE·TEAM may monitor sending activity, delivery failures, complaints and compliance, subject to law. Employees must suspend affected activity when a material compliance or security concern is identified and promptly escalate the issue.

Reporting, Training and Enforcement

Employees who send commercial, marketing, automated or bulk email must complete required training and cooperate with compliance reviews. Supervisors are responsible for ensuring that employees follow approved procedures. THE·TEAM may restrict or terminate sending privileges and may take disciplinary action, up to and including termination of employment, to the extent permitted by law.

Questions about email classification or approval should be directed to Email Governance at [email protected] or Information Technology at [email protected]. Suspected technical or security issues must be reported to [email protected] and [email protected]. Employees may also raise policy concerns with Legal, Security, their supervisor or The People Team. THE·TEAM prohibits retaliation for good-faith reports.

THE·TEAM may modify this policy at any time, subject to applicable law.

Regional Regulations – Summary and Legal Requirements

The table summarizes material regional distinctions. CAN-SPAM remains THE·TEAM’s global minimum; stricter local law controls. Any reliance on a regional consent exception requires prior written Legal or Privacy approval.

United States – CAN-SPAM Act

Commercial messages, including B2B email, must use accurate sender and routing information, truthful subject lines, required advertising identification, a valid physical postal address and a functioning opt-out method. CAN-SPAM generally does not require prior opt-in. Certain qualifying transactional or relationship messages may be exempt from specific commercial-email requirements; promotional messages must not be misclassified. CAN-SPAM requires the opt-out mechanism to function for at least 30 days and requests to be honored within 10 business days; THE·TEAM’s 60-day global operational rule still applies.

Canada – CASL

Commercial electronic messages generally require express or qualifying implied consent, subject to statutory conditions, time limits and exceptions. Messages must identify the sender and any represented party, provide required contact details and a no-cost unsubscribe method. Required contact information and unsubscribe facilities must remain valid for at least 60 days. Requests must be honored without delay and within 10 business days. Employees must obtain written Legal or Privacy approval before relying on implied consent or another exception.

European Union – GDPR and ePrivacy

National ePrivacy rules generally require prior opt-in for direct electronic marketing unless an applicable exception, such as a qualifying existing-customer soft opt-in, applies. GDPR separately requires a lawful basis for processing personal data. Consent, when required, must be freely given, specific, informed and affirmative. Employees must identify the sender, offer effective unsubscribe, honor direct-marketing objections promptly and maintain suppression and appropriate data records. National requirements vary; Legal or Email Governance approval is required before using an exception.

United Kingdom – UK GDPR and PECR

PECR generally requires prior consent for unsolicited marketing to individual subscribers, subject to exceptions. Qualifying corporate B2B messages may not require prior PECR consent, but identification, objection rights and UK GDPR obligations still apply. A qualifying soft opt-in may also apply. Employees must provide accessible opt-out, honor objections promptly and maintain suppression records. Prior written Legal or Email Governance approval is required before relying on an exception.