AI agents for GTM and RevOps · Part 13 of 13

Why did it email this person? The record behind each contact

What to keep for each contact and each message, so that “where did you get my data?”, a complaint or an access request is answered from the record: where each field came from, why the person was chosen, and which rule allowed each message.

Aakash William
· 5 min read

The short version

Someone who asks “where did you get my data?” is asking about a field, such as their email. So keep where each field came from and when, why each person was chosen, and which rule allowed each message, with the count it saw. Then a question, a complaint or an access request is answered from the record. Four steps:

  1. Keep where each field came from
  2. Keep why this person was chosen
  3. Keep which rule allowed each message
  4. Answer from the record

Step 1Keep where each field came from

A contact’s fields can come from different places on different days: the email from one data provider, the title from another, the size from the company’s website. So record a source and a date for each field as it’s written. How far to trust each one is part 4.

The GDPR names the source twice. Article 14, for data not obtained from the person, lists among what they are told “from which source the personal data originate, and if applicable, whether it came from publicly accessible sources”. Article 15(1)(g) gives the person, when they ask, “any available information as to their source”.

A FINANCE DIRECTOR AT A 300-PERSON LOGISTICS FIRM FIELDVALUECAME FROMWHEN Work email Job titleEmployees name@firm.exampleData provider A2 October 2026 Finance directorData provider B5 October 2026 300The firm’s website, a public page2 October 2026 “Where did you get my email?” The record: data provider A, on 2 October 2026.

A finance director at a 300-person logistics firm

Work email

name@firm.example, from data provider A, on 2 October 2026.

Job title

Finance director, from data provider B, on 5 October 2026.

Employees

300, from the firm’s website, a public page, on 2 October 2026.

“Where did you get my email?”

The record: data provider A, on 2 October 2026.

One contact’s fields, each with its own source and date, as an example. A single source for the whole contact couldn’t answer a question about the email.

Article 14(3)(b) gives the time for that information: “if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject”.

Regulation (EU) 2016/679 (GDPR), article 14(3)(b)

So the source belongs in the record before the AI SDR’s first message. In HubSpot, a property’s history shows “Changed to, Date, and Source values”, but a source such as “Integration: a connected app.” says only how the value reached HubSpot. Add your own properties for where it came from, such as Email source and Email source date, written with the email.

Step 2Keep why this person was chosen

A complaint asks why you wrote at all. The answer is the ICP or list that picked the person, as it read that day, and it changes: raise the minimum company size next quarter, and today’s contact may no longer match. So keep with each contact the ICP as it read then, and the values that matched. Writing the ICP in versions is part 5; why a record keeps facts as values, and how long to keep it, is support part 14.

6 October: chosenDecember: it changes January: “Why me?” Employees: 300, in theICP’s 200 to 2,000Industry: logisticsTitle: finance director The ICP’s range is now500 to 5,000 employees.Read today, it would leavethis contact out. The record keeps the ICPas it read on 6 October,and the values thatmatched it.

6 October: chosen

Employees: 300, in the ICP’s 200 to 2,000. Industry: logistics. Title: finance director.

↓

December: it changes

The ICP’s range is now 500 to 5,000 employees. Read today, it would leave this contact out.

↓

January: “Why me?”

The record keeps the ICP as it read on 6 October, and the values that matched it.

Why this person, as an example. The ICP changed after the contact was chosen, so only the ICP as the record kept it can answer.

Step 3Keep which rule allowed each message

For each message, keep the rule that allowed it and the facts it was checked on, the count among them. Example Software, this series’ invented company, caps each contact at three messages in any 14 days and counts them “across everyone on the team” (part 8). So the count covers messages from everyone, the AI SDR included: an SDR’s email by hand counts too.

Record rec-5108 message 3 to the contact, 19 October THE CONTACTTHE COUNTSENT CHECKED Finance director at a300-person logistics firmUnsubscribed: no, inHubSpot on 19 OctoberChosen: the ICP as itread on 6 October Messages in the last 14days, from anyone onthe team: 28 October: the AI SDR14 October: the AI SDRLimit: 3, in clause 2.2 Example Software’soutbound playbook,version 1.0.0Answer: allowedClause 2.3: no approvalneeded within the limitsApproved by: none needed Message 3, by theAI SDR, on 19 OctoberThe text as sentReply and unsubscribe,if any, each with itsown time

Record rec-5108

message 3, 19 October
The contact
Finance director at a 300-person logistics firm. Unsubscribed: no, in HubSpot on 19 October. Chosen: the ICP as it read on 6 October.
The count
Messages in the last 14 days, from anyone on the team: 2, on 8 and 14 October, both from the AI SDR. Limit: 3, in clause 2.2.
Checked
Example Software’s outbound playbook, version 1.0.0. Answer: allowed. Clause 2.3: no approval needed within the limits. Approved by: none needed.
Sent
Message 3, by the AI SDR, on 19 October. The text as sent. Reply and unsubscribe, if any, each with its own time.
The record of one message, as an example. The count is the team’s, whoever sent; here both earlier messages came from the AI SDR. The answer, and the clause it cites, are what the rules engine returned for these facts; the limit is the playbook’s own clause 2.2.

Add the reply and any unsubscribe to the record with their own times: “I unsubscribed and you wrote again” turns on which came first. In HubSpot, take the time from the contact’s subscription history (the “History tab”), since in the marketing email recipients report, “Unsubscribe events include the date the email was sent, rather than the date the contact unsubscribed.”

Step 4Answer from the record

Each question is answered from parts of the record you already keep, and the GDPR sets a time for the access request.

THE QUESTIONANSWERED FROM THE RECORD Where did you get my data?Why do you keep emailing me?I object to direct marketing. What do you hold on me? A prospect’s questionA complaintAn access request, article 15An objection, article 21 Field sources Why chosenRule and countMessages Field sourcesWhy chosenRule and countMessages Article 15(1)(g): “any available information as to their source” Article 12(3): “within one month of receipt of the request”,and it “may be extended by two further months where necessary” Article 21(3): “the personal data shall no longer be processedfor such purposes.” Record it with its own time.

“Where did you get my data?”

Field sources

A prospect’s question. Article 15(1)(g): “any available information as to their source”.

“Why do you keep emailing me?”

Why chosenRule and countMessages

A complaint.

“What do you hold on me?”

Field sourcesWhy chosenRule and countMessages

An access request, article 15. Article 12(3): “within one month of receipt of the request”, and it “may be extended by two further months where necessary”.

“I object to direct marketing.”

An objection, article 21. Article 21(3): “the personal data shall no longer be processed for such purposes.” Record it with its own time.

Three questions and an objection, as examples, traced to the parts of the record that answer them. Only the access request needs all four.

What to answer, and how long to keep the record, your company decides with whoever handles data protection there.

The whole series

This is the last of 13 parts. Start again with part 1: how to set up an AI SDR, or see all 13 parts.

Where Himmel fits

When the AI SDR asks before a message, Himmel checks it against your own contact rules and keeps the answer with its facts, the rule and its version, who approved and who asked. The AI SDR puts the check’s ID on the message, so the answer can be reproduced later. The answer in the record card above, allowed under clause 2.3, is the one Himmel’s engine returned for that case.

Sources

  1. Regulation (EU) 2016/679 (GDPR), Article 14, as adopted, read on 21 October 2026.
  2. Regulation (EU) 2016/679 (GDPR), Article 15, as adopted, read on 21 October 2026.
  3. Regulation (EU) 2016/679 (GDPR), Article 12, as adopted, read on 21 October 2026.
  4. Regulation (EU) 2016/679 (GDPR), Article 21, as adopted, read on 21 October 2026.
  5. HubSpot knowledge base, “View a record’s property history”, read on 21 October 2026.
  6. HubSpot knowledge base, “HubSpot’s change sources”, read on 21 October 2026.
  7. HubSpot knowledge base, “Manage your contacts’ messaging subscriptions”, read on 21 October 2026.
  8. HubSpot knowledge base, “Analyze marketing email recipients”, read on 21 October 2026.

Why we write these guides