It can be, if your use passes a legitimate interest assessment, you honour objections, and you follow your country's e-marketing rules, which in some countries require prior consent even for B2B email.
The GDPR (General Data Protection Regulation) is the EU law that gives people control over their personal data. Saving prospects, keeping them in your CRM and emailing them all count as processing personal data. When you do this, you are the controller of that data, separately from GetProspect.
One lawful basis is processing that is "necessary for the purposes of the legitimate interests pursued by the controller" (Article 6(1)(f)). Recital 47 adds that direct marketing may be regarded as a legitimate interest. It also says the interest needs careful assessment, including whether the person can reasonably expect this use of their data.
In practice:
- Contact people in their professional role, about something relevant to that role.
- The person can object at any time. When they do, stop and delete their data.
- Add an unsubscribe or opt-out line to every email.
- Check national e-marketing rules (ePrivacy in the EU, PECR in the UK) before you send.
This is general information, not legal advice.