GDPR & CAN-SPAM
Regulatory Compliance Framework.
MARS maintains strict technological, operational, and legal adherence to global data privacy statutes including the European Union General Data Protection Regulation (EU GDPR), the UK Data Protection Act 2018, the United States CAN-SPAM Act (15 U.S.C. 7701), and the California Consumer Privacy Act (CCPA/CPRA).
Multi-Jurisdictional Scope & Regulatory Harmonization
MARS operates a global B2B demand generation network engaging business professionals in over 120 countries. Recognizing that commercial electronic messaging and data privacy are subject to distinct statutory regimes across jurisdictions, MARS implements a unified, highest-common-denominator standard designed to satisfy the most stringent privacy frameworks globally.
This Framework applies unconditionally to all processing of business contact records, electronic communications, telemarketing calls, and content syndication programs conducted across MARS media properties and client campaigns.
Lawful Bases for Processing Under GDPR (Article 6)
Under Regulation (EU) 2016/679 (GDPR) and the UK GDPR, MARS processes professional business contact data strictly under verified, legally defensible Article 6 grounds:
1. Explicit Consent — GDPR Article 6(1)(a) Primary Standard
Where the data subject has affirmatively registered for a sponsored whitepaper, report, webinar, or software consultation, explicit consent is captured and preserved with immutable audit telemetry.
2. Legitimate Interests Assessment (LIA) — GDPR Article 6(1)(f) B2B Context Only
In targeted B2B outreach (Recital 47), MARS conducts formal Legitimate Interests Assessments verifying: (i) the processing relates strictly to the individual's business capacity, (ii) content aligns directly with their professional job function, and (iii) fundamental privacy rights are safeguarded by immediate 1-click opt-out rights.
Data Subject Rights Management (GDPR Chapter III & CCPA)
MARS maintains an automated Subject Rights Management (SRM) portal ensuring swift, guaranteed compliance with all statutory subject requests:
CAN-SPAM Technical Architecture & Opt-Out Execution
Under the United States CAN-SPAM Act (15 U.S.C. § 7704), every commercial electronic transmission dispatched by MARS enforces four mandatory technical guardrails:
- Non-Deceptive Routing Headers: The "From", "To", "Reply-To", and originating domain accurately identify MARS Network or the designated campaign entity.
- Transparent Subject Lines: Email subject lines reflect the authentic substance of the B2B marketing collateral without deceptive phrasing.
- Valid Physical Postal Address: Every outbound email footer contains the verified legal postal headquarters of Mars Solution / MARS (Core Lattitude 208-210, NIBM Road, Kondhwa, Pune - 411048, India / 71 -75 Uxbridge Rd, Suite 144, Ealing, London W5 5SL, GB).
- Instant 1-Click Unsubscribe Mechanism: Unsubscribe links require zero logins, passwords, or multi-step surveys. Opt-out processing executes immediately via API across all active sending nodes in under 24 hours (exceeding the statutory 10-day requirement).
Cross-Border Data Transfers & Standard Contractual Clauses
Where professional personal data originating within the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred to servers located in the United States or other third countries:
- • EU Standard Contractual Clauses (SCCs): We execute the European Commission Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 1 Controller-to-Controller and Module 2 Controller-to-Processor).
- • UK International Data Transfer Addendum: Transfers from the UK incorporate the UK Information Commissioner’s Office (ICO) approved Addendum.
- • Supplementary Technical Safeguards: In accordance with the EDPB Recommendations 01/2020, all cross-border payload data is encrypted in transit (TLS 1.3) and at rest (AES-256).
B2B Email Governance & Deliverability Standards
To protect recipient corporate domains and uphold inbox trust, MARS enforces industry-leading email authentication protocols across 100% of sending infrastructure:
72-Hour Security Incident & Breach Notification SLA
Pursuant to GDPR Article 33 and Article 34, in the improbable event of a confirmed personal data security incident affecting Client campaign data or subscriber identities, MARS guarantees written notification to competent lead supervisory authorities and affected enterprise Clients within seventy-two (72) hours of forensic confirmation, accompanied by an initial mitigation report.
Data Protection Officer & Statutory Inquiries
For regulatory filings, supervisory authority communications, or individual rights enforcement:
Authorizing Legal Counsel: Corporate Compliance & Regulatory Affairs