Consent & compliance
Consent & compliance: The gate before sending has no switch.
Before the PBM Campaign Platform triggers an email, a letter or an SMS, it checks each recipient individually: consent per channel, withdrawal, contact frequency, approved content. This check cannot be switched off. For us, data protection is not an add-on module but the architecture.
Consent per channel · Withdrawal stops immediately · Every decision logged
Send preparation · batch “Reminder 2”12,480 contacts
- only letter permitted → fallback to letter 2,604Why?
- Withdrawal → stopped 41Why?
- Frequency limit reached → postponed 523Why?
This gate cannot be deactivated.
The problem
Why is a tick in the database not enough?
Most consent problems arise not when consent is obtained but when messages are sent. The information exists – but not at the point where the decision is made.
“The consent is in the CRM. The sending system doesn’t know about it.”
The check happens where sending happens.
The gate reads consent per channel directly before every sending step.
“The withdrawal came by letter. The campaign kept running.”
A withdrawal stops all journeys.
Immediately, across all campaigns, without exception.
“The audit asks for the evidence. Nobody can find it.”
Every decision has a log.
Who, when, what, why – in the audit log.
The compliance gate
What does the PBM Campaign Platform check before every send?
Before every send, each recipient passes through a compliance gate. There is exactly one point that triggers a send – and this check always comes before it. The result is unambiguous for each person: send, redirect to a permitted channel, postpone or stop.
-
Consent per channel – Is there consent for this channel? If not, the fallback defined in the journey applies, for example the letter.
-
Withdrawal and opt-out – Has the person objected or withdrawn consent? Then it stops. Always.
-
Contact frequency – Has the agreed upper limit for this period been reached? Then it is postponed (→ contact frequency management).
-
Checked, approved content – Has the content passed the compliance and tone check, and is it approved? No content goes out unchecked.
Example
Batch “Reminder 2” of Regionalbank Musterstadt eG, 12,480 recipients. 9,312 receive the email. 2,604 have no email consent but do have letter permission – they receive a letter. 41 have withdrawn consent and are stopped. 523 have reached their contact limit and are postponed. (Sample data)
Gate simulator
Marlene Hoffmann · Email ✗ · Letter ✓
- Consent redirected
- Withdrawal passed
- Frequency passed
- Content passed
Result: letter instead of email – no email consent.
Thomas Brandt · Email ✓ · 3 contacts in 30 days
- Consent passed
- Withdrawal passed
- Frequency passed
- Content passed
Result: email is sent – consent available, contact 4 of a maximum of 4 in 30 days.
Contact 4711 · Withdrawal 11 Sep
- Consent passed
- Withdrawal stopped
- Frequency not checked
- Content not checked
Result: stopped – withdrawal 11 Sep
- Marlene Hoffmann: letter instead of email – no email consent.
- Thomas Brandt: email is sent – consent available, contact 4 of a maximum of 4 in 30 days.
- Contact 4711: stopped – withdrawal 11 Sep
Send preparation · batch “Reminder 2”12,480 contacts
- only letter permitted → fallback letter 2,604Why? Why?No email consent · Letter permitted · Fallback as per journey step ‘Announcement’
- Withdrawal → stopped 41Why?
- Frequency limit reached → postponed 523Why?
This gate cannot be deactivated.
This is where the switch would be.
There is no ‘Deactivate gate’ toggle in the settings. Not even administrators can bypass the check. That is intentional.
Not configurable – always applies
Withdrawal
What happens when a customer withdraws their consent?
A withdrawal immediately stops all of that person’s running journeys, across all campaigns and channels. It blocks re-entry until the person consents again. No other rule takes precedence – neither campaign priority nor the re-entry setting.
- Applies across campaigns, not just to the campaign the withdrawal came from.
- Also removes the person from advertising audiences for paid media.
- Recorded with a timestamp in the audit log.
| 09:12 | System | Service account | Withdrawal processed · journey stopped |
Consent per channel
Why does Ms Hoffmann receive a letter instead of an email?
Fixed-term deposit expires 31 Mar
Email consent no
Letter permitted
Because the PBM Campaign Platform checks consent per channel, not per person. Ms Hoffmann has not agreed to email advertising. For this case, the journey provides for the letter. So she receives a personal letter from her adviser – with an access code for the landing page. She is reached, and nobody has to break a rule.
Which data may play a part?
Which data is used for personalisation?
Only attributes that you have approved for it. Individual for every recipient – but only with data that is approved for this purpose. Anything not approved shapes neither text nor image, argument or choice of channel.
-
Personalisation
Attributes from your customer base are specifically approved for personalisation. Before sending, content passes through the compliance and tone check – including purely rule-based content, even when the AI is switched off.
-
Paid media
Audiences for advertising platforms only contain people with advertising consent. Identifiers are hashed before transfer. A withdrawal immediately removes the person from the audience.
More on personalisation in the introductory article AI with approval
- Contacts with advertising consent
- 3.120
- Identifiers hashed
- yes
- transferred without consent
- 0
Evidence
How do you provide evidence of consent and sending decisions?
With two logs that work together. The consent documentation records when which consent was given or withdrawn. The audit log records who did what and when, and who accessed which personal data – people, service accounts and AI agents.
-
Every line has a “Why?”
In the gate result, you can trace for each person why a message was sent, redirected, postponed or stopped.
-
Approvals are logged
including the four-eyes principle and language version.
-
An import never deletes
New files update contacts but do not remove any. Deletion is always an explicit, logged process.
- All
- Human
- Service account
- AI agent
| Time | Actor | Type | Action |
|---|---|---|---|
| 09:12 | System | Service account | Withdrawal processed · journey stopped |
| 10:42 | C. Reuter | Human | Content approved (four-eyes) · Wiederanlage/DE |
| 10:40 | ‘Compliance check’ | AI agent | Tone notice generated |
| 10:31 | “Core banking system” | Service account | 1,204 contacts imported (upsert) |
Data subject rights & retention periods
How do you handle access, rectification, erasure and data portability?
As guided processes in the PBM Campaign Platform. The request is created, handled step by step and logged. Where retention obligations exist, data is anonymised instead of being physically deleted.
| Stage | What happens | What for |
|---|---|---|
| 1 · Block (soft delete) | No more sending, running journeys end, data remains recoverable | Everyday use, mistakes can be corrected |
| 2 · Erase (anonymisation) | Personal reference becomes unrecognisable, analytics remain correct anonymously | Right to erasure despite retention obligation |
| 3 · Remove (exception) | Physical deletion | Incorrect imports, test data without retention obligation |
You set retention periods once centrally and refine them per customer list – for example, if different periods apply to vehicle data than to health insurance data. When they expire, data is erased automatically.
Legal framework · As of: September 2026
Which requirements does the PBM Campaign Platform specifically support?
The platform does not replace a legal assessment. It ensures that your decisions are implemented and documented with every send.
| Requirement | Provision | What the platform contributes |
|---|---|---|
| Provide evidence of consent | Art. 7(1) GDPR | Consent documentation, audit log |
| Withdrawal possible at any time | Art. 7(3) GDPR | Withdrawal immediately stops all journeys and blocks re-entry |
| Objection to direct marketing | Art. 21(2) and (3) GDPR | Opt-out takes precedence over all campaign rules |
| Email advertising only with consent, exception for existing customers | Section 7(2) no. 2, (3) UWG | Check per channel, fallback to a permitted channel |
| Response to data subject requests within one month | Art. 12(3) GDPR | Guided processes for access, rectification, erasure, portability |
| Erasure despite retention obligation | Art. 17(3)(b) GDPR | Erasure by anonymisation instead of physical deletion |
| Storage limitation | Art. 5(1)(e) GDPR | Automated retention periods, configurable per list |
| Accountability | Art. 5(2) GDPR | Audit log covering people, service accounts and AI agents |
As of: September 2026. This overview does not replace legal advice. All details and documents (DPA, TOMs) in the Trust Centre.
Where consent matters most
-
Banks & cooperative banking groups
Reinvestment with letter fallback
-
Statutory health insurers & healthcare
sensitive data, clear boundaries
-
Contract renewal & reinvestment
-
Churn prevention
Frequently asked questions about consent & compliance
Can the compliance gate of the PBM Campaign Platform be switched off?
No. Before every send, the compliance gate checks consent per channel, withdrawal, contact frequency and approved content. There is no switch for it, not even for administrators. This also applies when the AI functions are switched off.
What happens if there is no consent for email?
Then the PBM Campaign Platform does not send an email. If a fallback such as a letter is defined in the journey and this channel is permitted, the person receives the letter. Otherwise, nothing is sent for this step. The decision can be traced per person in the log.
How quickly does a withdrawal take effect?
Immediately. A withdrawal stops all of the person’s running journeys across all campaigns and channels and blocks re-entry until they consent again. It also removes the person from advertising audiences for paid media. No other rule can override this.
Is the PBM Campaign Platform GDPR-compliant?
The PBM Campaign Platform is built so that data protection is enforced in the sending path: consent check per channel, withdrawal as the top rule, audit log, guided data subject rights, retention periods, single-tenant operation with hosting in Germany. Whether your processing is lawful overall also depends on your legal bases and processes. As of: September 2026, does not replace legal advice.
Does a new data import delete contacts that are missing from the file?
No. An import into the PBM Campaign Platform updates existing contacts and creates new ones, but never deletes. Deletion is always an explicit process – via the interface, the API or a data subject request – and is logged.
How are retention periods implemented when retention obligations exist?
The PBM Campaign Platform deletes in three stages: blocking, erasure by anonymisation and, only in exceptional cases, physical removal. This makes it possible to fulfil the right to erasure while data subject to retention obligations and statistical data is retained anonymously. You set the periods centrally and refine them per customer list.