list-build

---
name: list-build
description: Turns the email addresses your business already touches into one list you are lawfully allowed to email, with the route recorded against every address. Use when you want to start emailing customers and are not sure which addresses you may actually use.
---

# Build the one list you are allowed to email, without annoying anybody

You give this the places your business already collects an email address: the booking system, the till, the wifi login, the gift voucher page, the Christmas enquiry inbox, the box of business cards behind the bar. You get back one file with every address, the lawful route it sits on, the exact words the person saw when they gave it, the date, and a second file of the addresses you must not use and why. It never tells you to buy a list.

## What it does

1. **Sort every address you already hold into one of three routes before you collect a single new one.** Route A is consent: they actively ticked a box or clicked a button to receive your emails. Route B is the soft opt-in, which regulation 22(3) of the Privacy and Electronic Communications Regulations allows where "that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient", the marketing is for "that person's similar products and services only", and they were given a simple free way to refuse both at collection and in every message since. Route C is corporate subscribers: a limited company, LLP, Scottish partnership or government body, where the ICO says "You can email or text any corporate body". Everything that fits none of these is route D, do not send. A diner who left a card with the waiter is route D. A supplier's sales rep who emailed you a quote is route D.

2. **Test route B against all five requirements, not the one you remember.** The ICO breaks the products and services soft opt-in into five: you obtained the details directly from that individual subscriber; you did it during a sale or negotiations for a sale, meaning "they must have bought something from you or have actively expressed an interest in buying"; the marketing is for your similar products and services; you gave a clear simple opt-out at the moment you collected the details; and you give an opt-out in every message after. A table booking that was honoured is a sale. A booking enquiry that asked about a private dining price is negotiations for a sale. A wifi login is neither, so wifi addresses are never route B. If you cannot evidence the fourth requirement, the opt-out at collection, the address drops to route D even if the person is a regular.

3. **Check whether each address belongs to a person or to a company, because the answer changes the rule.** The ICO is explicit that "Sole traders and some partnerships are treated as individuals", so the chef who trades as a sole trader has the same protection as a private diner. A named employee at a limited company is a corporate subscriber for the electronic mail rules, and CAP Code rule 10.14 says "Consent is not required when marketing business products by fax or by electronic mail to corporate subscribers (see III j), including to their named employees", but it adds that you must still screen against suppressions and still offer opt-outs. Mark the route on the row, never on the whole list. A hotel's corporate bookings list and its weddings list are two different legal populations sitting in one spreadsheet.

4. **Write the wording that sits next to the box, and keep it out of the terms and conditions.** The ICO requires consent requests to be "prominent, concise, easy to understand and separate from any other information such as general terms and conditions", and says you cannot rely on "silence, inactivity, pre-ticked boxes, opt-out boxes, default settings or a blanket acceptance of your terms and conditions". Draft one line per collection point naming your business, what you will send, and roughly how often: "Yes, email me the monthly menu change and one offer a month from The Fox, Hackney. Unsubscribe any time." A tick box that says "I agree to the terms" is not consent and never was, even where the terms mention marketing.

5. **Name every collection point that actually exists in a hospitality business and say what each one produces.** Walk the building and the software: the booking system's guest record, the deposit or pre-authorisation email, the EPOS emailed receipt, the gift voucher checkout, the function and Christmas enquiry inbox, the online ordering account, the review request, the wifi captive portal, the feedback QR on the table, the tasting or quiz night sign-up sheet. For each one, write down whether it is a sale, a negotiation for a sale, or neither, and whether an opt-out box was shown at the time. Most kitchens find two or three genuine route B sources and four or five route D sources they had assumed were fine. The wifi portal is the one that catches people out most often.

6. **Confirm the address before you count it.** Send one plain confirmation message asking the person to click to confirm, and only move them into the sending list when they do. Yahoo's sender requirements page recommends exactly this: "When users subscribe to your mailing list, send them an email asking them to click to confirm their opt-in. This will improve the experience for users (who won't sign up accidentally or get signed up maliciously) and for your list (which won't contain uninterested people, fake email addresses, or most robots)." Google's sender guidelines say the same in one line: "Confirm each recipient's email address before subscribing them." A typed address on a paper sheet at a quiz night is wrong about one time in ten, and every bounce damages the reputation that decides whether your next email reaches anybody.

7. **If you build the list with a prize draw, run it to the promotions rules or do not run it.** CAP Code rule 8.28 requires prize promotions to specify, clearly before or at the time of entry, any restriction on the number of entries, whether cash may be substituted, how and when winners will be notified, and the date prizewinners will get their prizes if it is more than 30 days after the closing date. Rule 8.15.1 requires prizes to be awarded "normally within 30 days". Rule 8.17.9 requires the promoter's full name and correspondence address. And the entry mechanic must not make marketing consent the price of entry: the ICO says consent must be "freely given", with genuine choice, and warns against "unduly incentivising people to consent". Offer the draw and the marketing tick separately on the same form.

8. **Screen the finished list against your own do-not-contact list before anything is sent.** The ICO tells you to keep a suppression list rather than deleting people who opt out, and gives the reason plainly: a company that deleted a number instead of suppressing it bought the same number back on a screened list months later and called it again, which "has breached PECR". Run every new address against suppressions, including addresses that arrived through a booking platform, and keep the suppression entry to the minimum, usually the address and the date. Deleting someone who opted out is how you email them again next year.

9. **Produce two files and a one-page note.** File one, `email-list.csv`, one row per address with columns: email, first name, route (A, B, C or D), collection point, date collected, exact wording shown, opt-out offered at collection (yes or no), confirmed (yes or no), last transaction date, suppressed (yes or no). File two, `do-not-use.csv`, every route D address with the single reason it cannot be used and what would have to happen for it to become usable. The note names how many addresses you hold, how many are actually sendable today, and the three changes to your collection points that would move the biggest group across. The number of sendable addresses is usually between a third and a half of what the owner thought they had, and the file is worth more than the assumption.

## Then it checks

1. Every row carries a route of A, B, C or D, a named collection point and a date, with no row left blank and no row reading "probably fine" or "from the system".
2. Every route B row can name all five soft opt-in requirements as met, including the opt-out shown at the moment of collection, and any row that cannot is moved to route D rather than kept with a note.
3. No address on the sendable list came from a purchased list, a rented list, a scraped website, a data broker, an appended third-party source or a friend's list, and no address was traced after a bounce.
4. The exact wording column contains the words the person actually saw, copied from the form, the sign-up sheet or the booking flow, and not a description of them.
5. Every address on the sendable list has been screened against the do-not-contact list, and every previously unsubscribed address appears in `do-not-use.csv` rather than being absent.
6. Sole traders and partnerships are marked as individuals and not as corporate subscribers, and no row is marked route C on the strength of the email address looking like a business one.

Any check fails: name it, redo that step once. Failed twice: say what is wrong and stop.

## Rules
- Public information only.
- Never invent a fact, a number or a quote.
- Anything sent in someone's name says whose name it is.
- Never buy, rent, scrape or append an address, and never trace a new address for someone whose old one bounced. The ICO says you "should not seek out new contact details from other sources or use the tracing services of other organisations for direct marketing", and a bought list also puts every address you own at risk, because one spam report from a stranger is scored against the same sending domain your real customers receive.
- Never put a marketing tick box behind a prize, a discount or a wifi login in a way that makes it the price of the thing. Consent taken that way is not freely given, so the address it produced cannot be used, and you will have annoyed the person as well as wasted the sign-up.
- Never carry an address from one business to another, even where the same owner runs both. A guest who gave their address to the hotel did not give it to the sister restaurant, and the ICO requires the consent request to name "the name of your organisation and the names of any other controllers who will rely on the consent".
- This output is a working document prepared for the owner's solicitor or data protection adviser to check before the list is used. It sorts addresses against published guidance and states what was recorded; it is not legal advice on your own compliance.

## Built from
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 22, https://www.legislation.gov.uk/uksi/2003/2426/regulation/22, in force text showing amendments made 5 February 2026, read 14 September 2026: the statutory wording of the consent rule and the three-part exception, which is the whole of steps 1 and 2.
- Information Commissioner's Office, "Electronic mail marketing", Guide to PECR, https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/, no publication date shown on the page, read 14 September 2026: the corporate subscriber position and the sole trader trap in step 3, and the checklist behind step 8.
- Information Commissioner's Office, "Plan direct marketing", Direct marketing and PECR guidance, https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/plan-direct-marketing/, latest update shown 20 August 2025, read 14 September 2026: the five requirements of the products and services soft opt-in used in step 2, and the freely given test in step 7.
- Information Commissioner's Office, "Collect information and generate leads", https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/collect-information-and-generate-leads/, no publication date shown on the page, read 14 September 2026: the due diligence list that makes bought lists impractical, and the ban on tracing new details after a bounce, which is why step 5 and the rules are written as they are.
- Committee of Advertising Practice, CAP Code (Edition 12), Section 10 "Use of data for marketing" and Section 8 "Promotional marketing", https://www.asa.org.uk/type/non_broadcast/code_section/10.html and https://www.asa.org.uk/type/non_broadcast/code_section/08.html, no publication date shown on the pages, read 14 September 2026: rule 10.14 on corporate subscribers in step 3, and rules 8.15.1, 8.17.9 and 8.28 in step 7.
- Yahoo, "Sender Best Practices", Sender Hub, https://senders.yahooinc.com/best-practices/, no publication date shown on the page, read 14 September 2026, and Google, "Email sender guidelines", https://support.google.com/a/answer/81126, no publication date shown on the page, read 14 September 2026: the confirmation step in step 6, in the mailbox providers' own words.

# list-build

## You are given
A folder from one UK hospitality business holding every place an email address has ever been collected: a booking system export, an EPOS or till export, a wifi portal log, a gift voucher checkout export, the Christmas and function enquiry inbox, an online ordering export, a review request list, photographs of paper sign-up sheets from a quiz night, and a spreadsheet somebody keeps behind the bar. Plus screenshots or copies of the sign-up wording at each collection point, the existing suppression or do-not-contact list, and a plain-text note from the owner saying, for each collection point, whether it was a sale, a negotiation for a sale or neither, and whether an opt-out was shown at the moment of collection. Column names differ between every file and dates are in mixed formats.

## Produce
Write into a `./list-build-output/` folder. Every file whose name carries `PERSONAL-DATA` holds contact details and is stored, moved and deleted as personal data.

1. `email-list-PERSONAL-DATA.csv` with these columns in this order: `email_lower`, `first_name`, `route`, `subscriber_type`, `collection_point`, `date_collected`, `exact_wording_shown_verbatim`, `opt_out_offered_at_collection`, `confirmed`, `last_transaction_date`, `suppressed`, `source_file`, `source_row`. `route` is exactly one of `A-consent`, `B-soft-opt-in-PECR-22(3)`, `C-corporate-subscriber`. `subscriber_type` is exactly one of `individual`, `sole trader or partnership treated as individual`, `corporate subscriber`. `opt_out_offered_at_collection`, `confirmed` and `suppressed` are `yes` or `no`.
2. `do-not-use-PERSONAL-DATA.csv` with the same columns in the same order, plus `reason` and `what_would_have_to_change`. Holds every route D address. `reason` is exactly one of `no lawful route recorded`, `soft opt-in limb not met`, `no opt-out shown at collection`, `wording not supplied`, `date of collection not recorded`, `on the suppression list`, `address not confirmed`, `address malformed`, `duplicate with conflicting route`, `source is a purchased, rented, scraped or appended list`.
3. `soft-opt-in-test.csv` with columns: `email_lower`, `obtained_directly_from_this_individual`, `during_a_sale_or_negotiation_for_a_sale`, `marketing_is_similar_products_and_services`, `opt_out_given_at_collection`, `opt_out_given_in_every_message_since`, `all_five_met`, `limb_that_failed`, `source_file`. One row per address considered for route B. Every row where `all_five_met` is `no` appears in `do-not-use-PERSONAL-DATA.csv`.
4. `collection-points.csv` with columns: `collection_point`, `what_it_produces`, `sale_negotiation_or_neither`, `opt_out_shown_at_collection`, `exact_wording_shown_verbatim`, `wording_source_file`, `addresses_read`, `addresses_to_route_A`, `addresses_to_route_B`, `addresses_to_route_C`, `addresses_to_route_D`.
5. `exceptions.csv` with columns: `source_file`, `source_row`, `field_missing_or_unreadable`, `raw_value`, `reason`. Holds every row that could not be placed at all, and every field that could not be read.
6. `counts.txt` - rows read per source file, distinct addresses after deduplication, the count on each of routes A, B, C and D, the suppression matches removed as its own number, the addresses sendable today, and a line stating whether the four route counts sum to the distinct address count.

## Rules
- Codex writes files only. Never send an email. Never connect to an email platform, a marketing API, a booking system API or any sending service to send, schedule, queue or import. Never add anybody to a list, an audience or a segment anywhere.
- Never scrape, guess, construct, correct or complete an email address. Never derive an address from a name and a company domain. Never look up a new address for anybody whose old one bounced.
- Never buy, rent, append or accept a purchased or brokered list. An address from such a source goes to `do-not-use-PERSONAL-DATA.csv` with the reason set, and never onto the send list.
- Never infer a route. A route is assigned only where the supplied note or the supplied wording evidences it. Anything else is route D. An address that looks like a business one is not route C without the subscriber type being evidenced, and a sole trader or partnership is `individual`.
- `exact_wording_shown_verbatim` carries the words the person actually saw, copied from the form, sheet or booking flow. Never write a description of the wording, never paraphrase it, and never reconstruct it. Missing wording sends the row to route D.
- Deduplicate on lowercase trimmed email address. Where duplicates disagree on route, collection point or date, keep neither: send both to `do-not-use-PERSONAL-DATA.csv` with the reason `duplicate with conflicting route`.
- Screen every address against the supplied suppression list on lowercase trimmed address before counting. Never delete a suppressed address, and never leave it out of the output.
- Never carry an address from one business, site or brand to another, even where the same owner runs both.
- Every date, route and wording must trace to a supplied input file named in the row. Never fill a gap from what is likely.
- Use British English, £ where money appears and DD Month YYYY dates in `counts.txt`. No em dashes.
- Every file ends with this line: this is a working document prepared for the owner's solicitor or data protection adviser to check before the list is used. It sorts addresses against what was recorded and is not legal advice or a finding of compliance.

## Return
The absolute path of each file written, the row count of each CSV, rows read per source file, the distinct address count, the count on each of routes A, B, C and D with the sum check stated explicitly, the suppression matches removed as a separate number, the addresses sendable today, the breakdown of `do-not-use-PERSONAL-DATA.csv` by reason, and the three collection points producing the most route D rows. Name any input file you could not parse and why rather than skipping it silently.