We are putting together a service for use both internally and for our clients using GoPhish to test users' awareness of phishing. Basically, the users will receive a phishing email and we will measure how many users open the email, click links, and disclose information.
I have two concerns from a legal perspective (we are based in the UK and only have UK based clients).
1) If I put together an email that looks like it comes from Amazon, could they sue me for using their brand without permission?
2) In order to conduct the campaign we will need to store users' names, email addresses and other information. Once GDPR comes into effect we would need consent to store these details (AFAIK), but if we ask the user first that defeats the objective. Is there any way around this restriction?