Tools and providers
How to vet the tools behind lead generation networks
A vetting method for the tools behind lead generation networks: gates, UK GDPR and PECR checks, security evidence, acceptance tests and export proof.
What to take away
- A pass in one gate cannot cancel a fail in another.
- No price, ranking or performance figure appears here; no supplier was tested.
- HubSpot, Pipedrive, Zoho CRM and Dynamics 365 differ in form-to-record behaviour and export evidence.
- Ask for scoped security evidence and a restored export before signature, not after.
Lead generation networks in the UK: the shape of the market
The category runs from consumer enquiry marketplaces such as Bark, MyBuilder, Rated People and Checkatrade, which pass a submitted enquiry to tradespeople who have joined the network, to business-to-business platforms that pass a company's enquiry to a partner. The network holds the record first; the recipient holds a copy.
Those examples show the shape of the market, not a ranking. This method vets the tools behind the flow: the form, the matching and routing layer, the record store, the disclosure log, the suppression list and the export path. HubSpot, Pipedrive, Zoho CRM and Dynamics 365 appear later only as record-layer products, not as lead networks.
Scope of this method
The four record-layer products below are described from first-party documentation, not from a trial. This is a vetting method for a decision taken now, so it carries no forecast and no performance claim.
Define the buying case first
Assume the operator publishes a service-enquiry form, checks whether a request falls inside its scope, and may introduce it to an eligible business. Retain what the person saw, which recipient got the record, and what followed an objection.
Later marketing needs a separate UK GDPR and PECR assessment.
Write the journey as states:
- A submitted record enters quarantine.
- Validation checks format and approved service scope.
- Matching selects only an approved recipient.
- Disclosure records recipient, fields and time.
- Acceptance or rejection uses the contract's defined unit.
- Suppression prevents prohibited reintroduction.
- Retention review ends in justified preservation or deletion.
Each state needs an owner, an input, an evidence event, an exception route and a stop authority. The record layer below is where those states leave their evidence.
Gates that do not compensate
Score each gate pass, fail or unresolved; do not total the columns into a percentage.
- Data sourcecollection wording, timestamp, provenance, withdrawal.
- Rolesan activity map checked against the contract.
- PECRa separate decision for the message and subscriber.
- Securityscoped reports, tenant tests, logs, a recovery exercise.
- Accessibilitytests on the configured page, with defects recorded.
- Portabilitya restored export, a deletion process, suppression continuity.
- Lead termswhether a lead goes to one buyer or several, what counts as a quality lead, the replacement or credit rule, geographic coverage and the complaint route.
A failure in one row stays a failure. A certificate cannot repair an inaccessible form, and a low price cannot repair a missing audit trail.
Data, permission and what software cannot settle
Software does not decide whether an organisation may collect or disclose personal information. The ICO's direct marketing guidance expects clear collection information and buyer-side checks on supplied data.
Public contact details are not blanket authority for a new use. A checkbox records an input, not proof that the wording, organisation and collection history meet the applicable PECR rule. Lead network data protection traces that route rather than the labels.
Where the record comes from someone else, UK GDPR Article 14 puts the notice duty on the organisation that receives the data, and PECR regulation 22 governs the electronic marketing that follows. Check the supplying organisation on the ICO's register of fee payers, and keep the wording the person actually saw.
The record layer: HubSpot, Pipedrive, Zoho CRM and Dynamics 365
Four tools compared
Form to record
- HubSpot Forms
- Forms collect visitor information and create or update CRM records.
- Pipedrive Web Forms
- Forms collect visitor information into leads or deals, with embed and share routes.
- Zoho CRM Webforms
- Webforms create records in several modules, with assignment and embed settings.
- Dynamics 365
- Microsoft describes Contact, Lead or combined targets, record matching and embedded publishing.
Export evidence
- HubSpot Forms
- An export guide describes routes by category of account content.
- Pipedrive Web Forms
- Spreadsheet exports with visibility limits; linked material handled separately.
- Zoho CRM Webforms
- Export covers module, report and backup routes, with edition limits.
- Dynamics 365
- Microsoft states Dataverse table data can be exported to CSV.
HubSpot's form documentation is the source for that row.
Lead sellers, contact databases, enrichment tools and API-only services were excluded; every candidate had first-party documentation for a form and an export route. No licence was purchased and no supplier was tested.
Security evidence to request and test
Start with data sensitivity, availability needs and the administrator model. The NCSC's cloud security principles ask buyers to examine provider safeguards and their own secure configuration, covering separation, identity, audit information and incident handling.
Request the scope and date of each certification rather than badge names. In a trial tenant, create least-privilege roles, revoke a user, retrieve an audit event and rehearse recovery. Stop if the buyer cannot investigate a disclosure or restrict exports.
Name what is being certified. ISO/IEC 27001, SOC 2 Type II and Cyber Essentials Plus answer different questions, and a badge without a scope statement says little about the service you are buying.
Exit proof: export, deletion and suppression
A documented export option is not a completed migration. Restore one into a clean environment and check that associations, consent wording and suppression history arrive intact.
The schedule should name the edition, usage unit, support channel, incident notice, export help, deletion and termination. Obtain current documents and a dated quote. Commercial contract records lists the clauses that define a lead, its data and its exit.
Example: synthetic fixtures for acceptance
Create synthetic cases: a valid request, a duplicate, a missing field, a withdrawn request, a suppressed identity and an unavailable buyer. Record the expected state and the evidence each case must produce. For the unavailable-buyer case, the platform should show the record state and the audit event.
Common questions
Is a price or a cheapest-supplier ranking given here?
No. No licence was purchased and no quote was obtained, so no price, saving, conversion or return is stated. Ask for a dated quote naming the edition, usage unit and implementation boundary.
Can supplier documentation replace a test?
No. Documentation describes what the supplier says it does, not what it does under test. It is not independent evidence of performance, security, accessibility or service quality.
What ends a pilot?
A restored export, working suppression and a retrievable audit event for the test enquiry. A failed export or a missing audit trail ends the pilot.
In this guide
- Lead generation networks: the record fields and PECR screening a B2B lead list needsThe record fields a B2B lead list from a lead generation network needs: PECR subscriber type, CTPS and TPS screening, soft opt-in basis, six worked contacts.
- Lead generation networks vendor due diligence checklistLead generation networks vendor due diligence: check UK GDPR, PECR, assurance reports, lead provenance, suppression and exit evidence before approval.
- Implementing a lead network tool as a testable state machineLead generation networks tool implementation uses controlled states, synthetic acceptance tests, evidence owners, rollback triggers and verified exit rehearsal.
