Last reviewed: 5 October 2026. This guide is general information, not legal advice. The UK GDPR and the Data Protection Act 2018 apply across the UK.
TL;DR
- The best sourcing starts with your own database: people you already know are faster to place than strangers on LinkedIn.
- When you go to LinkedIn, search through your own account, add only the profiles you will actually contact, and fetch an email or phone number only when you need it.
- A multichannel sequence (email, LinkedIn, WhatsApp) works when each step reacts to the last one: accepted, replied, not replied after a few days. A reply should stop everything.
- Sending limits are a safety limit, not a volume target. They protect the account you send from.
- Under the UK GDPR, contacting someone who never applied needs a lawful basis, privacy information at the latest at first contact, and a quick response when they object.
Start with the people you already hold
Before opening LinkedIn, search your own CRM. A candidate you placed three years ago, or one who reached a final interview last spring, already trusts your agency, and you already hold their data under your privacy notice.
In Marvin, Scout puts this first. You describe the role in plain English, for example “senior management accountant, Manchester, open to interim”, and AI turns it into search criteria. Scout then looks at three levels, from the closest to the widest:
- Your database: the candidates your firm already has in Marvin.
- LinkedIn profiles already fetched for your firm in earlier searches or imports, kept for your organisation only.
- A live LinkedIn search through the recruiter’s own connected LinkedIn account, to find people you have never seen.
The first two levels show results straight away. The live search is never automatic: the recruiter starts it. If your firm uses Sales Navigator, searches and lists can also be brought in from Marvin’s browser extension, where this is enabled for your firm.
Add on purpose, enrich on demand
Finding a profile is not the same as storing it. In Scout, a profile becomes a candidate record only when a recruiter adds it to Marvin. The record is checked for duplicates against the LinkedIn URL and marked with Scout as its source, which is the information you will need when you tell the person where you got their data.
Email addresses and phone numbers are not collected automatically. They come from a separate enrichment step that the recruiter triggers on a record, which uses credits from your plan or, for some providers, your own key.
Two habits keep your database lawful and useful:
- Collect what you need. Do not add fifty profiles to contact five.
- Set a retention period. Marvin lets an administrator switch on automatic deletion of candidate records with no activity after a period they choose (24 months by default). It stays off until an administrator has previewed the records concerned and confirmed. The retention of a specific record can be extended.
Building a multichannel sequence
A sequence in Marvin is a series of steps that you draw in a visual editor. Each enrolled person moves through it at their own pace.
Steps available
- Email, sent from the recruiter’s own Gmail, Outlook or SMTP mailbox.
- LinkedIn: profile visit, invitation, message, voice note, and InMail where the recruiter’s LinkedIn plan and your firm’s settings allow it.
- WhatsApp, from the recruiter’s connected account.
- Delays, tasks for the recruiter (for example a call) and an enrichment step.
Conditions and branches
Each channel has its own branches: invitation accepted or not accepted after 7 days, already connected, message replied or not replied after a set number of days. A typical UK perm sequence might be a profile visit, an invitation with no note, a short message once accepted, then an email if there is no reply after five days.
A reply stops everything. When a person replies by email or on LinkedIn, Marvin takes them out of all their active sequences, not just the one they replied to. Replies arrive in a shared inbox in Marvin, synced with Gmail and Outlook for email and with your connected accounts for LinkedIn and WhatsApp.
Each message goes from the recruiter’s own account, the one who enrolled the person: their mailbox, their LinkedIn, their WhatsApp. Marvin does not send from a generic address of its own. The candidate sees a real consultant, and replies come back to them.
Sending windows and limits
Each sequence has a sending window and a time zone: set it to Europe/London and working hours so that a candidate in Leeds does not get a LinkedIn message at 11pm.
Marvin also applies limits per connected account for each channel and action, such as invitations per day and per week, with lower caps for LinkedIn accounts without a premium plan, messages per day, and emails per day and per hour. Actions are spaced with random delays so that an account does not fire twenty messages in a minute.
Treat these limits as a safety limit, not a target. They are there to protect the account you send from and the people you contact; reaching them every day is a sign that a campaign is too broad. They cannot guarantee how LinkedIn, Google, Microsoft or WhatsApp will treat an account. WhatsApp in particular is best kept for people who have already engaged with you.
UK GDPR: contacting people who never applied
Sourcing means processing personal data that the person did not give you. Three questions come up every time.
1. What is your lawful basis?
Most agencies rely on legitimate interests for sourcing. The ICO’s guidance on legitimate interests sets a three-part test: identify a legitimate purpose, show the processing is necessary for it, and balance it against the person’s interests and reasonable expectations. Record that assessment. Someone with a public profile listing their skills may reasonably expect an approach about a relevant role; they would not expect you to keep their data for years after they say no.
2. When do you tell them?
When data does not come from the person, Article 14 of the UK GDPR requires you to give privacy information within a reasonable period and at the latest within one month. If you use the data to contact the person, you must give it at the latest at that first contact. The information includes who you are, why you hold the data, your lawful basis, the source of the data, how long you keep it and their rights, including the right to object and to complain to the ICO. The ICO explains this in its guidance on the right to be informed.
In practice, add a short line and a link to your candidate privacy notice in your first message, whatever the channel.
3. What happens when they object?
Under Article 21, a person can object to processing based on legitimate interests. Unless you have compelling grounds, which an agency approach rarely has, stop processing for that purpose.
Marvin does not add an unsubscribe footer to emails: a person asks you to stop by replying, and a reply by email or on LinkedIn takes them out of all their active sequences. Your first message should therefore say plainly that a reply is enough. Agree how your team records an objection so that nobody enrols that person again.
By default, Marvin tracks opens and link clicks in the emails it sends, which is what feeds conditions such as “opened”; tracking can be switched off for an individual email in the composer. The ICO’s guidance on storage and access technologies covers tracking pixels in emails, so cover open and click tracking in your assessment and your privacy information.
If an email also promotes your agency’s services, for example an approach to a hiring manager, the electronic marketing rules of PECR may apply as well. Check the ICO’s direct marketing guidance before you email personal addresses.
What Marvin does not do for you
Marvin does not choose your lawful basis, write your privacy notice, send privacy information to sourced candidates or record a lawful basis per candidate. It does not make your outreach compliant: your agency is the controller and stays responsible. What it gives you is the plumbing that makes good practice easier: searches you start yourself, records added on purpose with their source, sequences that stop on a reply, messages from real consultants, and retention settings.
If you plan to use AI on this data, read our guide to AI, MCP and UK GDPR and the one on Marvin’s AI copilot. Setting up a new desk? See our guide to starting a recruitment agency in the UK. To see Scout and a sequence on one of your live roles, book a demo.
Frequently asked questions
Is it lawful to contact candidates found on LinkedIn under the UK GDPR?
It can be. Most agencies rely on legitimate interests, which means running the ICO’s three-part test (purpose, necessity, balancing) and recording it. You must also give the person privacy information, at the latest when you first contact them, and stop if they object. Take advice on your own set-up.
When must we tell a sourced candidate that we hold their data?
Under Article 14 of the UK GDPR, within a reasonable period and at the latest within one month of obtaining the data. If you use the data to contact the person, at the latest at that first contact.
Does Marvin search LinkedIn with a shared account?
No. Scout’s live LinkedIn search runs through the recruiter’s own connected LinkedIn account, and only when the recruiter starts it. It is never automatic.
Which channels can a Marvin sequence use?
Email from the recruiter’s Gmail, Outlook or SMTP mailbox; LinkedIn invitations, messages, profile visits, voice notes and InMail where the account allows it; WhatsApp. Steps are combined with delays and conditions such as accepted, replied or not replied after a number of days.
Are Marvin’s sending limits a guarantee that LinkedIn will not restrict an account?
No. The limits and random delays keep each connected account at a measured pace and reduce risk. They are safety limits, not targets, and they cannot guarantee how LinkedIn or any other platform will treat an account.
Does Marvin make our outreach GDPR compliant?
No tool can do that for you. Marvin stops sequences when someone replies, sends from your own accounts and offers retention settings, but your agency remains the controller: you choose the lawful basis, write the privacy information and handle objections.
