What Is “GDPR” And Does It Apply To Me?

Disclaimer: This article is for informational purposes only, and you should not consider it legal advice. We recommend that you seek legal and other professional counsel to determine exactly how the GDPR might apply to you.

Note: This document is only in relation to what is being taught in the Subscription School program. If you have other areas of your business that may be affected by GDPR, please use the resources below to determine the best course of action.

What Is GDPR?

GDPR stands for General Data Privacy Regulation. It is a new set of guidelines that dictates how data is to be processed, controlled, stored and handled for all EU countries. It goes into effect May 25th 2018. To read the official regulations, click here.

What Is The Goal Of GDPR?

The goal of GDPR is to allow all EU citizens to have more control, access and transparency to their information. It limits what can and can’t be shared and makes it so you may require explicit consent to continue to marketing to EU members.

How It Might Affect Your Business

This may affect your business in the following ways:

You may need to obtain explicit consent from current leads & customers.
You may need to re-word your shopping cart and opt-in forms.
You may need to alter to whom you’re selling your products.
You may need to add sections to your Privacy Policy (see below)
You may need to create a Privacy Notice.

What countries are part of the EU?

Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, United Kingdom

Does It Apply To Me?

That’s a tough question to answer! And you’re likely to receive different responses based on who you ask. So what I’ll do is provide the information and you can make the decision as to whether this applies to you or not yourself.

If you live in the EU, are intentionally marketing to people that live in any of the EU countries, accept any EU currency or operate in any language local to an EU country, yes this applies to you and you must follow GDPR rules or face potential penalties and fines.

But if you’re not intentionally marketing to customers in the EU and don’t live there are you bound by these same regulations?

According to Recital 23 of the GDPR, perhaps not. Recital 23 says that users in the EU must clearly be targeted. In practice this means if your website is not language localized in the EU, you don’t allow users to purchase in euros/GBP, don’t ship to those countries and specifically don’t mention EU countries in your product or marketing, then you likely don’t need to comply.

In addition to that Recital 47 specifically states that “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”. And according to the GDPR you may not need explicit consent (see below) if it falls under legitimate interest. This article of the GDPR on e-mail marketing also mentions not requiring explicit consent.

So, as you can see, this can be interpreted a few different ways! So below I’ll share with you my opinion on the best, safest way forward. However, I want to mention again that if you’re concerned, it is be best to seek professional council before continuing.

What Are The Big Changes?

Note: These changes only apply to EU visitors, leads and customers however it is important you treat everyones data with respect regardless of origin.

The Right To ConsentThis gives EU visitors the right to deny or grant consent when it comes to being marketed to. Example: An EU visitor lands on your site and wants your free item. Your options are:

A) Change the wording on your page to clearly state you will be e-mailing them afterwards.
B) Do not change your wording and add an explicit consent check box.
C) Do not sell to EU visitors. Note: You cannot exclude purchases if they don’t agree to consent so you’ll have to stop selling to ALL EU visitors.

The Right To Be Forgotten

This gives EU visitors the right to be forgotten. All information must be erased from your systems including historic and transaction data. Warranties and refunds are voided in this case as it is impossible to verify purchases after “the right to be forgotten” has been invoked. Note: You must provide EU visitors with a way to contact you to enact this right. Typically this is put on a “Privacy Policy” or “Privacy Notice” type page.

The Right Of Access / Records Of Activities

This gives EU visitors the right to any and all information stored on them. You must export all information and send it to the visitor. Note: Sending information to EU visitors who request “The Right To Be Forgotten” or “The Right To Consent” does not have to be immediate. However, it must be done within a reasonable timeframe.

Read the full document here

Please remember this is a very brief summary. It is in your best interest to read as the articles below and stay informed on how this affects your business.

What Should I Do?

For ClickFunnels Users

Add “Right To Be Forgotten” and “Right Of Access” to Privacy Policy page. (example coming soon)
Block Non-US Sales with CF Pro Tools

For WordPress Users

Add “Right To Be Forgotten” and “Right Of Access” to Privacy Policy page. (example)
Setup DAP To Comply With GDPR regulations (See Videos Below)

E-mail Marketing

Review GDPR documentation from your autoresponder.
Review Aweber: 6 GDPR Myths Debunked & follow advice.

Ensure you have accurate records for all leads and buyers. Where they came from, what they opted in / bought and when.

Summary

Getting setup for GDPR can be a bit overwhelming. There is a decent amount of work to do and it has to be setup as soon as possible. The deadline to make these changes is May 25th, 2018. However if you aren’t able to get everything done before then, don’t panic. Even the regulatory bodies aren’t prepared yet! So while it’s important to have an action plan going forward and a reasonable deadline as to when you can expect these changes to be made - you can breath a bit of a sign of relief.

Due to the nature of the businesses we run (direct marketing companies targeting only U.S. visitors) these regulations may or may not apply to us. However, as with most rules and regulations it’s best to play by the book. So even though this may not directly affect you, it’s still very important to take your visitors and customers privacy and security seriously.

I also highly encourage you to read the documentation in the “Resources & References” section below and see how these regulations may apply to your specific situation. If you have any questions about GDPR, this document or anything else please post in the Facebook group here.

Resources & References

Thrive Architect

https://thrivethemes.com/gdpr-features/

Digital Access Pass / Smart Pay Cart

What You Need To Know About GDPR

Milestone 1 – Laying The Foundation

Milestone 2 – Creating Your Offer

Milestone 3 - Setting Up Your Offer

Setting Up Your Offer With ClickFunnels

Setting Up Your Offer With ThriveCart

Milestone 4 – Advertising Your Offer

Milestone 5 – Increasing Your Sales

Resources