Salesfusion & GDPR

Here’s how we'll help you comply with the GDPR

In early December 2017, the EU agreed upon new regulations for the General Data Protection Regulation (GDPR). The new regulations will create a uniform and consistent set of rules across all 28 countries in the EU that is aimed at protecting EU citizens’ personal data and increasing transparency by organizations on how that data is used. If you’re a company who deals with processing data with customers in the EU, then the GDPR applies to you.

At Salesfusion, we’re hard at work ensuring that we can provide the basic tools needed for our customers to achieve compliance with the GDPR as the May 25th deadline approaches. We are dedicated in helping our customers understand what GDPR means for their business and how Salesfusion can help in preparing your own compliant processes.

We’ve created this page as a reference on all things GDPR related leading up to May 25th. Below, you’ll be able to see which GDPR-related products our team is working on as well as our planned release dates.

DISCLAIMER: The content on this page is provided for informational purposes only and to help organizations understand the GDPR in connection with Salesfusion’s services.

The information contained herein may not be construed as legal advice or to determine how GDPR might apply to you and your organization. Organizations should consult with their own legal counsel with respect to interpreting their unique obligations under the GDPR and how best to ensure compliance.
Product Roadmap Here’s what we’re building and when you can expect it

Below, you can find a table of the features we’re building to help you become GDPR compliant and when we’re planning to release them.

We plan to have a BETA release on May 8th, 2018 so we can keep getting feedback before May 25th. If you are interested in signing up for the BETA, please email beta@salesfusion.com.

Regulation
What it Means
What Salesfusion is Building
Consent & Double Opt-In for Emails The regulations require explicit consent for the use of data with proper notice. Personal data will have to be collected and used for a specific purpose and consent must be given for each purpose. Marketers cannot contact email users who do not wish to be contacted. In order for consent to be granted, the following needs to be accounted for:

  • Users must know what they’re opting into, that’s called “notice”
  • The “notice” needs to outline how and what we’re using customer’s data for. Evidence must be logged of what the user consented into.
  • A clear opt-in action needs to be presented and made by a user. Filling out a form or visiting a page cannot imply the user is providing consent to receive any communications from a company.
 Double Opt-In for Form Submissions

You’ll be able to specify whether you want an opt-in email with an opt-in link to automatically be sent after a form submission. This setting can be configured at the form level and/or you can set a default setting at the global level that results in every future created form having the opt-in setting set. Clicking on the opt-in link in the email will route the user to a pre-set confirmation page.

We also will store a copy of the email that your users consent into as well as the time and date that consent was given.

Now Available for BETA Customers

Opt-In for Other Forms of Contact Creation

We’ll also be adding in opt-in verification in all the places on the platform where contacts can be manually uploaded which include imports and uploads of individual contacts. You’ll have to verify that contacts you’re adding have opted-in before you can add them. This will ensure best practices and act as a check for you before adding your contacts.

Now Available for BETA Customers

Control of Data Customers will have more of a say on how they want their data to be handled. For example, they can ask to have their data modified or to request access to their personal data. If your company receives this request, you need to be able to accommodate for editing their data or providing them information in a machine-readable format (XLS or CSV) Requesting Access to Data

Salesfusion allows you build custom reports where you can pull in most personal data that your customer could ask for (name, email, etc.). You can export these files into an appropriate machine-readable format.

Currently Available

Modification of Data

Contact level data is held within the contact card, where you can view their personal data. You can edit this data currently at any point for an individual contact.

Currently Available

Right to be Forgotten (Delete Data) Just as customers can request access or modification to their data, they can also ask to have all their personal data erased from your database. This means removing any personally identifiable in the database like form submissions, notes, IP Address, etc.

We’re implementing a process to take inbound delete requests from our clients that Salesfusion will execute on behalf of our customers.

In Progress – Available May 25th, 2018

Cookie Consent Cookies are important as they are used to track customer information such as their user journey and all the interactions with your website to help provide a personalized experience and better analytics for companies. However, proper consent needs to be given by the user to allow being tracked by cookies.

We’re implementing the ability for customers to indicate whether they want to prompt cookie consent for each new visitor to a landing page built with Salesfusion. A standardized banner will appear at the top of each page where cookie consent is indicated that will prompt a visitor to either accept or reject cookies.

We preserve your visitors’ choice so they’re not constantly bombarded with the banner everytime they visit one of your pages.

Now Available for BETA Customers

Withdrawing Consent This means that your customers should be able to know what they signed up for and can withdraw their consent (opt-out) at any time. Essentially, withdrawing consent needs to be just as easy as providing it. Email Opt-Out

Currently, on the Salesfusion platform, you can view the opt-out status of a contact. If one of your customers request to opt-out, you can easily change the opt-out status of the customer to “yes” in their contact details.

Your customers can also opt-out via any email communications you send them through an unsubscribe link in the emails you send out.

Currently Available

Change Cookie Preferences

On every landing page built in Salesfusion where cookie consent is specified, we’ll be adding a way for users to edit their cookie settings. They’ll be able to change their setting at any point to either accept or reject cookies.

Now Available for BETA Customers

Frequently Asked Questions

What is GDPR?

The General Data Protection Regulation (GDPR) strengthens individuals' privacy rights and creates consistent data protection rules across Europe.

What is the deadline for compliance?

May 25, 2018

My company is based in the United States, do we need to comply?

GDPR applies to companies who process personal data about individuals in the EU.

Does this apply to B2B and B2C communications?

Yes. There is no distinction between B2B and B2C and applies to any organization doing business with individuals in the EU.

What is the EU definition of personal data?

Any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified directly or indirectly. This includes:
Name
Phone Number
Email Address
Social Network ID
Cookies
IP Address
Metadata such as location, device, timestamp

What do we do after the GDPR comes into effect?

Once the GPDR is in effect you are going to have to make sure you are only marketing to those who have opted-in to your communications! Otherwise, you risk the €20 million or 4% of your companies global annual turnover as a fine. And remember, having good, valuable content that people will want to download is essential to getting more people to opt-in to your marketing.

Can I still market to my customers?

The current legal consensus is that an existing business relationship (a current client) generally constitutes a lawful basis for communication particularly in fulfillment of a specific request (notices, product delivery, etc). That relationship also provides at least implied consent for offering additional and related products and services to the existing customer.

For the avoidance of doubt, of course, explicit opt-in to anything that can be deemed a marketing or sales communication is going to be a best practice, but the discretion is up to the Data Controller.

For marketing contacts that you have no existing business relationship collecting informed consent will be key to ensuring compliance with GDPR.

Is Salesfusion GDPR complaint?

Salesfusion believes privacy and data protection is key factor for marketing success and has taken steps to ensure compliance with the GDPR framework. Below are some data points on Salesfusion’s security standards:

  • Customer data is housed in a secure SOC 1 & 2 SSAE 16 audited facility at Amazon Web Services, utilizing a multi-tenant environment that is partitioned logically and isolated to prevent unauthorized access.

  • Salesfusion has rigorous processes and security controls in place, including physical access controls, data access controls, data transmission controls, and data entry controls.

  • Salesfusion monitors for intrusion detection to ensure that our best-in-class security is constantly maintained and maintains a detailed set of logs for platform user and API activities.

  • For our EU customers, by default all data is hosted in Europe on Amazon Web Services (“AWS”) facility in Ireland.

  • Salesfusion participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework. We are committed to subjecting all personal data received from European Union (EU) member countries, in reliance on the Privacy Shield Framework, to the Framework’s applicable Principles. Salesfusion Privacy Shield Certification.

  • Salesfusion offers customers a robust data processing addendum containing data transfer frameworks ensuring that our customers can lawfully transfer personal data outside of the European Economic Area by relying on our Privacy Shield certification or the Standard Contractual Clauses.