What is the GDPR?
The General Data Protection Regulation (GDPR), which comes into force on May 25th, 2018, aims to protect the fundamental right to privacy and the protection of personal data of European Union (EU) citizens.
This regulation affects any entity (including websites) that processes EU citizens' personal data. Whether or not you or your business is located in the EU, if you have EU site visitors, or if your marketing campaigns target EU citizens, this affects you.
What does the GDPR mean for you?
Transparency and communication with your site visitors are key elements of the GDPR. As part of the new regulation, you must let your site visitors know how you collect, store, and use their data, in a clear and transparent way. In addition, you must comply with your site visitors' requests to receive a copy of their data that is processed on your site.
How to help your Heroic site meet GDPR requirements
Take a look at our recommendations below so you know how to start preparing your Heroic site for the GDPR.
- Next, establish a legal basis for processing your site visitors' data
In accordance with the GDPR, you are permitted to process your site visitors' data (e.g. collect, use, store), so long as the process meets the requirements of the GDPR. There are many ways in which you can lawfully process your site visitors' data - requesting their consent is just one of these ways.
Click here for more detailed information on the regulation.
If you want to receive 'explicit consent' from your site visitors before processing their data you may do so using Heroic forms or by adding an external feature via the HTML element. Please note that if you choose to receive explicit consent, you must ensure that it meets the standards required by the GDPR.
- Get consent for your marketing campaigns
Sending marketing campaigns requires consent from your site visitors. If you're using any kind of 3rd party email service provider, this applies to you.
Consent to receiving marketing campaigns can be interpreted and applied in different ways on your site. For example, you can add a disclaimer next to your 'Subscribe' button informing your site visitors that clicking the button will subscribe them to your marketing campaigns. This is called 'implied consent'.
Our interpretation of the GDPR suggests adding a checkbox onto your form for each type of communication you're intending to send your subscriber. Eg: newsletter communications, commercial communications, product-specific communication.
You can do this by manually adding checkboxes to your forms using the Heroic form builder, or with our new GDPR Form Compliance Tool.
- Heroic's new GDPR-form compliance tool
We are currently implementing an automated tool that will allow you to make your forms GDPR-compliant in 1 click. When that tool becomes available for YOUR email service provider (ie: Mailchimp, aWeber, etc.) depends on when they update their API with specific GDPR functionality. Most services haven't updated their API, and as they do, we'll add them to our GDPR-form compliance tool.
This document should not be taken as legal advice.
To ensure regulation compliance we recommend reviewing the details of the regulation, as well as seeking your own legal advice.
Make sure your third-party apps are GDPR compliant too
As part of the GDPR, you are responsible for any third-party apps or services implemented on your site. These services can include data analytics tools (e.g. Google Analytics, the Facebook pixel, etc.). While reviewing your Heroic site for GDPR compliance, make sure that these apps and services are also GDPR compliant. If you're not sure, contact them directly with your questions or concerns.