<\/span><\/h2>\r\n\r\n\r\n\r\nUndoubtedly this is probably the part that is understood most clearly by businesses and consumers, and yet we still see it overused or used incorrectly in a lot of sign-up and GDPR compliance emails. In terms of compliance, you should only ask someone to opt-in if you plan to send them communications about something other than the topic they\u2019ve enquired about.
<\/p>\r\n\r\n\r\n\r\n
For example:
<\/p>\r\n\r\n\r\n\r\n
A customer sends an email to an appliances company about a toaster through the company’s website using an embedded enquiry form. The form will send the name, email address, subject line, and message to the company\u2019s help desk and a customer service agent will reply to the customer by email.<\/em>
<\/p>\r\n\r\n\r\n\r\nThere\u2019s a tick box asking the customer if they are happy to receive a response from the customer service agent.<\/em>
<\/p>\r\n\r\n\r\n\r\nDoes there need to be an opt-in tick box?
<\/p>\r\n\r\n\r\n\r\n
No – there doesn\u2019t. Opt-in tick boxes are only needed if you plan to send the customer additional information, for example, marketing information about other toasters, or unrelated products. So long as communication between the customer and customer service agent relates to the initial enquiry, no tick box is needed.
<\/p>\r\n\r\n\r\n\r\n
What is<\/em> needed is a Privacy Policy, which you should leave in plain sight – even if that\u2019s just a link to your Privacy Policy page. Something along the lines of: \u2018By sending this form you allow us to contact you for the purpose of replying to your enquiry. If you\u2019d like to know more about how your data is stored please read our privacy policy.\u2019 <\/em>You will be expected to keep some data on record – otherwise, how will you track your conversations with customers?
<\/p>\r\n\r\n\r\n\r\nPro-tip: If you want to maintain compliance without storing customers\u2019 data on a secure server, offer customer service through email. After the customer has agreed that you have sufficiently answered their enquiry you can delete the thread (the emails sent to and from the business) from your servers knowing that the customer has a copy in their personal inbox. This way, you don\u2019t have to worry about keeping any messages or personal data on record. Should there be another issue, the customer can always reopen the enquiry by replying to the email or starting a new enquiry and copying the previous thread in.
<\/p><\/blockquote>\r\n\r\n\r\n\r\n
So we\u2019ve discussed how you go about communicating with customers whose details you don\u2019t want to keep, but what if you want to keep that customer\u2019s data: their name, emails, perhaps even their product preferences? This is where you need an opt-in tick box, and to update your privacy policy accordingly.
<\/p>\r\n\r\n\r\n\r\n
Should you want to send marketing materials to that customer, even if it\u2019s related to the toaster they first enquired about, you MUST include an unchecked opt-in tick box with a statement along the lines of: \u2018By ticking this box you agree to allow us to send you offers and updates about our products. If you\u2019d like to know more about how your data will be used and stored please read our Privacy Policy.\u2019<\/em>
<\/p>\r\n\r\n\r\n\r\nFor every additional reason you\u2019d want to store your customer\u2019s data, you must include a clear, reasoned opt-in tick box:
<\/p>\r\n\r\n\r\n\r\n
- Promotions and offers<\/li>
- Products and information<\/li>
- Newsletters<\/li>
- Third-party communications<\/li><\/ul>\r\n\r\n\r\n\r\n
GDPR is supposed to increase transparency around how data is used and stored. Follow the rules but don\u2019t overcomplicate things. If you want to keep someone\u2019s data on record you need to specify why and how it will be maintained in your Privacy Policy as well as having a clear opt-in. You need to do this for every additional reason. What you don\u2019t need to do is get permission for contacting a customer in response to an inbound enquiry, so long as that conversation doesn\u2019t deviate from the enquiry.
<\/p>\r\n\r\n\r\n\r\n
<\/span>Data Collection<\/span><\/h2>\r\n\r\n\r\n\r\nData collection might seem really simple, but it can be difficult to understand what information is and isn\u2019t necessary. As marketers, it can be easy to go overboard with collecting customer data as that information can fuel vital business decisions by building a clear picture of what your customer base looks like. But you must resist. Don\u2019t give in to the temptation of thinking you need all the data. You don\u2019t, and consumers are smart, they know you don\u2019t need to know everything about them. When it comes to data collection you need to think about one question: Why do you need that data?
<\/p>\r\n\r\n\r\n\r\n
If you can\u2019t justify why that data is relevant, then you don\u2019t have any right to ask for it.
<\/p>\r\n\r\n\r\n\r\n
For example:
<\/p>\r\n\r\n\r\n\r\n
A customer wants to find out whether you\u2019ll have any stock of the Toaster 2000 XL when it launches in your stores across the UK.<\/em>
<\/p>\r\n\r\n\r\n\r\nIs the location of the customer relevant? Yes.
<\/p>\r\n\r\n\r\n\r\n
Should you take their postcode? No.
<\/p>\r\n\r\n\r\n\r\n
In this instance, you could ask the customer to choose from a drop-down list of your stores to clarify which location they\u2019re referring to. You don\u2019t need to take their personal location data or postcode, as their home address is not relative to the enquiry.
<\/p>\r\n\r\n\r\n\r\n
However, there will be times where you need to take personal information from customers. For example, you might need very precise data for research or quality assurance. In the case of questionnaires and surveys sometimes – yes, sometimes – it\u2019s okay to ask for personal information. Things like age, location, occupation, and salary, are only appropriate if you\u2019re going to building up a clear picture of what your audience looks like, but it has to be appropriate.
<\/p>\r\n\r\n\r\n\r\n
Pro Tip: As a general rule, when it comes to surveys you can only collect data that you will use in the results. It will also save you a hassle in terms of storing the data if you\u2019re smart about what you collect.<\/p><\/blockquote>\r\n\r\n\r\n\r\n
Whatever data you do collect, and whatever happens to the data once it\u2019s given to you, must be included and justified in the Privacy Policy. This is your holy grail, and a legal requirement. Although you might want to have a legal team write this, it\u2019s not necessary. What is necessary is that you take the time to state exactly what you\u2019re collecting, why you\u2019re collecting it, how it\u2019s going to be stored, and how you\u2019ll use it internally and for future communications.<\/p>\r\n\r\n\r\n\r\n
<\/span>Data Storage<\/span><\/h2>\r\n\r\n\r\n\r\nThis is probably the most technical aspect of GDPR. Once you\u2019ve collected someone\u2019s data you need to keep it secure. There\u2019s no excuse for a lack of security – no matter what size your business is, you have a legal duty to keep personal data somewhere safe.
<\/p>\r\n\r\n\r\n\r\n
At a minimum every business needs:
<\/p>\r\n\r\n\r\n\r\n
- A private server\/network<\/li>
- A password protected email<\/li>
- A secure database or customer relationship management (CRM) software<\/li><\/ul>\r\n\r\n\r\n\r\n
Your database needs to be robust enough to allow you to track when a customer\u2019s data was collected. This is really important because you should only hold on to someone\u2019s personal details for as long as you need them.
<\/p>\r\n\r\n\r\n\r\n
For example:
<\/p>\r\n\r\n\r\n\r\n
A candidate sends their CV, name, and contact information to a recruiter in response to a job they have seen advertised online on a recruiter\u2019s website. The recruiter sends an email back and offers a call to discuss the role. The candidate and recruiter talk on the phone but it\u2019s established that the role isn\u2019t right for them. The recruiter then offers to keep the candidate\u2019s details and CV on record should another opportunity come up.<\/em>
<\/p>\r\n\r\n\r\n\r\nHow long should the recruiter keep the candidate\u2019s details on record?
<\/p>\r\n\r\n\r\n\r\n
Typically 18 months is a fair amount of time to keep someone\u2019s details on record, after which time a courtesy email with an unsubscribe or \u2018right to be forgotten\u2019 link should be provided. Even if you\u2019ve had some contact during this time you should always check after 18 months as a courtesy.
<\/p>\r\n\r\n\r\n\r\n
Pro Tip: If you haven\u2019t come across the term \u2018Right to be Forgotten\u2019 – sometimes known as Right to Erasure or \u2018Freedom of Information\u2019 – read on; at any point, a customer can request all the data\/information you have on them under the Freedom of Information Act, and they may also exercise their Right to be Forgotten at which point you must delete all the information you have on that customer
<\/p>\r\n\r\n\r\n\r\n
<\/span>Conclusion<\/span><\/h2>\r\n\r\n\r\n\r\nOnce you understand the core concepts that make up GDPR, you should be comfortable in understanding how you can collect, store, and use your customer\u2019s data. The first step will be to fully understand what data you need and what processes and tools should be in place to ensure that data is stored securely. Budgets, volume of data, and company size will all factor into how you shape your Privacy Policy in relation to GDPR. You should be open to making changes to your business\u2019 hardware and software, as well as your processes, in order to ensure compliance at every level.
<\/p>\r\n","protected":false},"excerpt":{"rendered":"
Although new GDPR laws were brought into effect in May […]<\/p>\n","protected":false},"author":1,"featured_media":11464,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[129,130,131],"class_list":["post-11461","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-data-protection","tag-gdpr","tag-privacy-policy"],"yoast_head":"\n
\ufeffGDPR in Three Easy Steps - OggaDoon<\/title>\n<meta name=\"description\" content=\"GDPR doesn't have to be complicated but you do have to get it right. We've broken GDPR down into 3 easy steps to help you understand your responsibilities.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\ufeffGDPR in Three Easy Steps - OggaDoon\" \/>\n<meta property=\"og:description\" content=\"GDPR doesn't have to be complicated but you do have to get it right. We've broken GDPR down into 3 easy steps to help you understand your responsibilities.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/\" \/>\n<meta property=\"og:site_name\" content=\"OggaDoon\" \/>\n<meta property=\"article:published_time\" content=\"2019-02-21T09:39:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-10T12:04:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-content\/uploads\/2019\/02\/gdpr-3439225_1280.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"OggaDoon Content\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"OggaDoon Content\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/\",\"url\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/\",\"name\":\"\ufeffGDPR in Three Easy Steps - OggaDoon\",\"isPartOf\":{\"@id\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/#website\"},\"datePublished\":\"2019-02-21T09:39:08+00:00\",\"dateModified\":\"2022-08-10T12:04:55+00:00\",\"author\":{\"@id\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/#\/schema\/person\/89c53b7dd3676579fff5f0552484858d\"},\"description\":\"GDPR doesn't have to be complicated but you do have to get it right. We've broken GDPR down into 3 easy steps to help you understand your responsibilities.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/#website\",\"url\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/\",\"name\":\"OggaDoon\",\"description\":\"Digital Marketing and PR\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/#\/schema\/person\/89c53b7dd3676579fff5f0552484858d\",\"name\":\"OggaDoon Content\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3394fb560738f71712557086d1677c3e893820f13f2a662614b8deddc2c41e4b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3394fb560738f71712557086d1677c3e893820f13f2a662614b8deddc2c41e4b?s=96&d=mm&r=g\",\"caption\":\"OggaDoon Content\"},\"sameAs\":[\"https:\/\/website.clientdemoweb.com\/oggadoon\"],\"url\":\"https:\/\/website.clientdemoweb.com\/oggadoon\/author\/frewsojxk\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\ufeffGDPR in Three Easy Steps - OggaDoon","description":"GDPR doesn't have to be complicated but you do have to get it right. We've broken GDPR down into 3 easy steps to help you understand your responsibilities.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/","og_locale":"en_US","og_type":"article","og_title":"\ufeffGDPR in Three Easy Steps - OggaDoon","og_description":"GDPR doesn't have to be complicated but you do have to get it right. We've broken GDPR down into 3 easy steps to help you understand your responsibilities.","og_url":"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/","og_site_name":"OggaDoon","article_published_time":"2019-02-21T09:39:08+00:00","article_modified_time":"2022-08-10T12:04:55+00:00","og_image":[{"width":1280,"height":768,"url":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-content\/uploads\/2019\/02\/gdpr-3439225_1280.jpg","type":"image\/jpeg"}],"author":"OggaDoon Content","twitter_card":"summary_large_image","twitter_misc":{"Written by":"OggaDoon Content"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/","url":"https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/","name":"\ufeffGDPR in Three Easy Steps - OggaDoon","isPartOf":{"@id":"https:\/\/website.clientdemoweb.com\/oggadoon\/#website"},"datePublished":"2019-02-21T09:39:08+00:00","dateModified":"2022-08-10T12:04:55+00:00","author":{"@id":"https:\/\/website.clientdemoweb.com\/oggadoon\/#\/schema\/person\/89c53b7dd3676579fff5f0552484858d"},"description":"GDPR doesn't have to be complicated but you do have to get it right. We've broken GDPR down into 3 easy steps to help you understand your responsibilities.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/website.clientdemoweb.com\/oggadoon\/gdpr-in-3-easy-steps\/"]}]},{"@type":"WebSite","@id":"https:\/\/website.clientdemoweb.com\/oggadoon\/#website","url":"https:\/\/website.clientdemoweb.com\/oggadoon\/","name":"OggaDoon","description":"Digital Marketing and PR","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/website.clientdemoweb.com\/oggadoon\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/website.clientdemoweb.com\/oggadoon\/#\/schema\/person\/89c53b7dd3676579fff5f0552484858d","name":"OggaDoon Content","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/website.clientdemoweb.com\/oggadoon\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3394fb560738f71712557086d1677c3e893820f13f2a662614b8deddc2c41e4b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3394fb560738f71712557086d1677c3e893820f13f2a662614b8deddc2c41e4b?s=96&d=mm&r=g","caption":"OggaDoon Content"},"sameAs":["https:\/\/website.clientdemoweb.com\/oggadoon"],"url":"https:\/\/website.clientdemoweb.com\/oggadoon\/author\/frewsojxk\/"}]}},"_links":{"self":[{"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/posts\/11461","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/comments?post=11461"}],"version-history":[{"count":0,"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/posts\/11461\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/media\/11464"}],"wp:attachment":[{"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/media?parent=11461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/categories?post=11461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/website.clientdemoweb.com\/oggadoon\/wp-json\/wp\/v2\/tags?post=11461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}