How does consent work?

Consent in eMarketeer is built from four parts: purpose, legal base, source, and the option to withdraw.

You use eMarketeer to store contact information imported from other systems, collect more contact data through web forms, and send emails and SMS for various purposes. The information you store belongs to your contacts (the data subject), and you use it to communicate with them. GDPR gives each contact more control over the information you hold and shapes how you may communicate with them.

Purpose

The most important part of consent is defining each purpose and the right by which you carry it out. eMarketeer ships with these purposes by default:

• Store data — keep information about data subjects in a secure place, in this case eMarketeer.
• Emarketing — send emails and SMS to these contacts.
• Profiling — use contact information that shows interests or behavior for segmentation or personalization.

Each purpose needs a legal base

For each purpose, you add a legal base. The available options are:

• Consent
• Legitimate interest
• Contract
• Required by law
• Protect vital interests
• Public interests

The most relevant legal bases for most marketers are consent and legitimate interest.

Legal bases: consent and legitimate interest

GDPR states that to have consent, the data subject must opt in by an unambiguous and clear affirmative action. Once they do, you have consent to send marketing or to store the data you need. You do not need an affirmative action for every purpose, however.

Legitimate interest lets you communicate with the data subject without explicit consent, if the data subject expects you to do so.

Examples:

• If a person is a customer, the customer expects you to store the data they gave you. Storing it is in both parties' interest. This is legitimate interest.
• If a customer registered for an event, the customer expects you to send information about that event. Legitimate interest.
• You have customers and need to reach them with relevant service information. Legitimate interest.

Legitimate interest is a grey area, so apply it carefully. If the action is in the interest of the data subject, you can claim legitimate interest. GDPR requires a clear relationship, genuine mutual interest, a balance of interests, expected and appropriate processing, and no infringement on the rights and freedoms of the individual.

How to set a legal base for each purpose

You need a legal base for each purpose. A typical setup looks like this:

• Store data = Legitimate interest. You store the contact data because it is in both your and the subject's interest. Storing data does not mean you can market to them.
• E-marketing = Consent. For marketing you need explicit consent unless you can prove legitimate interest.
• Profiling = Consent. Same as e-marketing.

Tip: if you collect contact data digitally through web forms, always include a consent checkbox that clearly states how you will use the information. This gives you explicit consent, which is a stronger legal base than legitimate interest.

Source

When you set a consent, you also need to add the source — for example, "web form" or "added by user." Add any additional information that can serve as proof of the consent.

Withdraw consent

Regardless of the legal base you set, the subject can always withdraw their consent. You need to provide an easy way for them to do so.