I want to understand what the implications are for user emails with the onset of GDPR.
It's a bit of a strange question but here is the scenario.
We run a Software as a Service platform when a user can invite other users to a team. They do this by email, at which point we have a user's "personal information" in the form of their email and we have issued them an email invite. We have to keep the email address on record for a period of time, say 7 days, for that invite to be accepted at which point we delete it if no action has been taken.
I understand the restrictions on me in terms of not marketing to this email address etc. I want to understand if I am even allowed to send the invite email in the first place. That is to say, if someone hasn't explicitly given me their email address, am I allowed to use it.
Logic would indicate that this should be fine as it really makes the user experience of inviting people very poor, however, the question has been asked by a member of my team and so I thought I'd seek some clarity.