Personal Data in the Case of Newsletter Subscriptions
If you already have an existing client database from before, GDPR will not affect the ability to send emails to these clients — a new consent will not be required, however it is necessary to provide an option to unsubscribe. The change only applies to content — you may only send customers offers of the same type of goods for which consent was previously granted.
For new customers, it is important to consider what a single consent covers — i.e., what offers or updates the customer agrees to receive. The consent must clearly indicate what communications will be sent to the client. In the case of different offers or updates, it may be worth considering splitting them into multiple consents.
Every new customer must know, before giving consent, who you are, what data you are collecting about them, who else processes it, why and for how long, and what rights that customer has.
Consent must be clear, recorded, and of course voluntary.
Creating a Purpose Definition for Sending Newsletters
Let's now look at our example of creating a purpose required for sending newsletters.
First, you need to create a purpose definition.
The legal basis in the case of sending a newsletter is Consent.
In the Data Occurrences tab, the Company Addresses agenda and its Email field should be listed.
The validity for both existing and new customers is in this case set to Manual — the client grants consent.
The validity period of the purpose with a legitimate interest legal basis can in this case be 3 years — the client should be informed about the duration of validity.
Further settings — whether it concerns data access (authorized person), the procedure after expiration, or adding a note or description in the Texts tab — are of course up to you, but we recommend filling them in for potential verification before the personal data protection authority.
The second step, in the case of Manual validity, is to create the purpose on the relevant record in the address book.
Purposes can subsequently be looked up in the GDPR -> Purposes register. Here too, as in most registers in Flexi, filtering is available (by company, by purpose definition, etc.).