On the 25th May 2018 the new GDPR regulations come into force. You may have lots of questions, below we have covered the basics, more detailed information on this can be found at https://ico.org.uk
You need a privacy policy that basically says what personal data you collect, how consent was given and what you are going to do with it. Most privacy policies are online for easy reference.
The purpose of the new regulation is to think about how you obtain, store and use their data.
For your existing customers personal data, collected before the new regulations, where you have a current relationship with the customer and you have obtained their personal data with consent at the time of a prior transaction you can continue to hold their data until no longer required. We would recommend contacting customers with your privacy policy, so they can chose to opt out and it is recommended the next time they shop with you that you request their consent. You could also look at cleaning up your customers personal data by deleting customers who have not spent within so many years.
Only collect the information you need, for example, if you only do email marketing, do not ask for their home or business address.
Your Customers Rights
- The right to be informed of what you are using their personal data for. This should be covered in your own privacy policy.
- The right to have access to their personal data and related information.
- The right to have inaccurate personal data corrected or updated.
- The right to have their personal data deleted.
- The right to withdraw their consent to processing their personal data.
- The right to request the restriction of processing their personal data.
- The right to request their personal data in a portable format. For example Microsoft Excel or CSV.
- The right to object to processing their personal data, in case data processing has been based on legitimate interest and/or direct marketing.
These rights are explained in more detail at https://ico.org.uk.
Data Protection and Security
Your staff members should be given training on customer data protection, your policies and how to keep this information secure.
A Few Points on Keeping your Data Secure
- Have a secure network and keep the operating systems on any computers up to date.
- Staff members should have separate user names and passwords.
- Review you security settings. For example staff security on Fashione, auto locking on computers.
- When replacing computers your hard drives should be professional erased/destroyed.
Processing Data
Processing and using your customers data, should not go beyond the reason the data was originally given. For example, if someone laid over an item at the till you will have a legitimate interest to contact them about payments.
Once the item has been paid and supplied what you cannot do is use their information for customer top spenders or marketing without their permission.
Useful Information
Small Business GDPR Helpline by ICO: 0303 123 1113
This is for information purposes only and is not legal advice. We recommend looking in to the GDPR regulations further.
Third Party Integrations
We are working with our partners to help customers with GDPR. Please contact your website provider about any changes that will be required to comply with the GDPR.