A lot of B2B sales caution is second-hand fear, not law. Below is a practical map of what you can typically do after your tool identifies a company that visited — and where the line is.
The framing that helps
Identifying a company from an IP address is not the same as identifying a person. B2B account intelligence has been standard for years. The GDPR care mostly kicks in when you start attaching person-level data: name, email, phone.
What you can typically do (in the EU/EEA)
- Log the company name, industry, size, country, and which pages of your website they visited.
- Keep that information for a reasonable, documented time (12 months is a common default).
- Use it to decide who to reach out to on LinkedIn or via publicly listed business email.
- Add the company to a sales-CRM company record — as a company, not as a person profile.
Where you get careful
| Action | Usually OK | Get careful / seek advice |
|---|---|---|
| Company + pages logged | Yes | — |
| Public business email (info@) | Yes | — |
| Named person on LinkedIn | Yes (public source) | Don't scrape at scale |
| Cold email to a specific employee | Depends on country and existing relationship | Verify local rules |
| Combine person + behaviour publicly | No | No |
Not legal advice
Rules vary by country and situation, and B2B email rules differ across Germany, France, Italy, and beyond. Check locally when in doubt — this article is a starting map, not counsel.
Practical do's
- Do use company visits to prioritise. Fewer, better outbound emails beat larger, colder ones.
- Do reference behaviour by inference, not surveillance: "companies in your space often ask us about X", not "I saw your team on our pricing page".
- Do publish an opt-out on your privacy page so any business can ask to be excluded.
Practical don'ts
- Don't blast personal emails scraped from a data broker.
- Don't reveal to a prospect that you're tracking specific individuals — you're not, and saying you are looks bad.
- Don't store visitor data "forever". Set a retention window and delete on schedule.
The bottom line
B2B sales in the EU is very much alive. The rules aren't there to stop you from doing your job; they're there to stop the shady versions of it. Company-level identification with a documented retention policy fits comfortably inside the lines.
- Related: [Is visitor identification GDPR-compliant?](/blog/is-website-visitor-identification-gdpr-compliant)
- Related: [Legitimate interest, plainly explained](/blog/legitimate-interest-plainly-explained)
- Related: [Compliance questions your CFO will ask](/blog/compliance-questions-your-cfo-will-ask-and-the-answers)
Published by
lead.box Team
More articles
See lead.box on your own traffic
Start free — no card, no sales call required. Or book a 20-minute walk-through if you want the guided tour.