A few definitions to start with, so that we understand each other:
Personal data
Any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Processing of personal data
Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Legal basis for processing personal data
The GDPR defines 6 conditions, or legal bases, for processing personal data. Processing is lawful only if at least one of these conditions is met.
Purpose of personal data processing
The purpose of processing is the reason why you want to process personal data, in other words why, or with what goal, you want to keep records of personal data and work with them.
Guide to importing the legal aspects of personal data processing (GDPR) into Quanda
In Quanda, you can now add the following to each of your contacts:
- one or more legal bases for processing personal data
- one or more purposes of personal data processing
- and one or more dates until which you process the personal data for the given legal basis and purpose of processing
Note Until you assign this new information to a contact, all your contacts have the same purpose no. 1 set: "Not set (default)". No legal basis or validity is set for this purpose. The sending status is set according to how it was previously saved for the contact.
Note
From now on, in every campaign you must select the purpose of personal data processing that the campaign relates to, in other words set up the campaign according to the purpose of personal data processing. The Recipients page will then show only the contacts that have this purpose set, with sending approved and valid. This gives you certainty that you always send only to contacts for which you have consent (or another legitimate reason) to send the given campaign.
List of legal bases (as available in Quanda)
- Legitimate interest of the controller
- Compliance with a legal obligation
- Performance of a contract or steps prior to entering into a contract
- Consent to the processing of personal data
- Public interest
- Vital interest
List of purposes of personal data processing (as available in Quanda)
- Not set (default)
- Sending commercial and promotional messages
- Direct marketing
- Improving products and services
- Sending information about news
- Responding to expressed interest
- Providing expert content
- Running a customer competition
- Running educational events
- Conducting marketing research
- Conducting market research
- Performance of a purchase contract or steps prior to entering into it
- Performance of a contract for work or steps prior to entering into it
- Performance of employment contracts and obligations
- Protection of property and health
- Pursuing legal action
- Compliance with accounting law
- Archiving in the public interest
- For statistical purposes
Now we will use an example to show how to bulk import the legal aspects of personal data processing and bulk update your existing database in Quanda.
If you record a purpose in Quanda by mistake or want to remove it, simply add a minus sign to the purpose in the import document. For example, -2 removes the purpose of processing: Sending commercial and promotional messages.
We will use the following situation as an example
Your existing database probably contains two kinds of contacts: customers and potential customers. You want to send commercial and promotional emails to both groups. So what needs to be done?
Please note: this is only an example. For your company and your contacts, the situation may be completely different depending on the nature of your business, your specific products and so on.
What to set for your existing customers
- Legal basis: Legitimate interest
- Purpose of personal data processing: no. 2. Sending commercial and promotional messages
- Validity period: for example 2 years
For potential customers whose consent you CAN prove
- Legal basis: Consent to the processing of personal data (which you should have)
- Purpose of personal data processing: no. 2. Sending commercial and promotional messages
- Validity period: for example 2 years
For potential customers whose consent you CANNOT prove
- Do not import them. You are not entitled to process these contacts or to send them emails.
How will we proceed?
1. We will do a bulk export of contacts to a CSV file.
2. We will open a blank workbook in Excel, go to the Data tab and click Get data from text.
3. We will select the CSV file exported from Quanda, and after clicking the Import button, a dialog for setting up the import of this CSV data will appear. We will choose "Delimited" and set the file origin to "Unicode (UTF-8)" (you can easily check that the setting is correct, because the data preview looks right and accented characters display correctly). Then we will click Next.
4. As the delimiter, we will choose Comma. In the Data preview, we can then see that the data has been split into columns. We will click Next.
5. Now we will just click Finish.
6. For the start of the data (where the table in Excel should begin), we will choose cell A1 and confirm. The data will then be loaded into the Excel table. You will see all the columns, including those you have not filled in within Quanda.
7. You can delete the columns you do not use in Quanda to make the table easier to read.
8. In the Excel table with the imported data, the columns related to GDPR are those named:
- Contact owner was verified via Double opt in
- Purpose of personal data processing
- Email sending status
- Valid until
- Legal basis: Legitimate interest of the controller
- Legal basis: Compliance with a legal obligation
- Legal basis: Performance of a contract or steps prior to entering into a contract
- Legal basis: Consent to the processing of personal data
- Legal basis: Public interest
- Legal basis: Vital interest
For the import into Quanda, we will set the following values in the columns
Contact owner was verified via Double opt in:
- true
- false
Set "true" or "false" depending on whether the import should record that this contact was (true) or was not (false) verified via Double opt in.
Purpose of personal data processing
We import it using the numbers 1 to 19. The order of the items in the list of purposes of personal data processing corresponds to their number, see above. If you need to import several purposes for one contact at once, enter them in a single table cell, separated by commas (for example 1,4).
Email sending status
We import it using the number given for each status.
- Send emails
- Cannot send (unsubscribed)
- Cannot send (consent expired)
- Cannot send (awaiting consent)
Valid until
We import the date (and optionally the time) in the format 1.1.2019 13:30 or 01.01.2019 13:30, according to the required validity period.
Note If you import several purposes for one contact at the same time, write one date for each purpose into the "Valid until" column, in the order that matches the order of the purposes. Write all the dates into a single cell, separated by commas.
Legal basis
For example: "Legal basis: Legitimate interest of the controller"
- true
- false
Set "true" or "false" depending on whether this legal basis should (true) or should not (false) be set for the given contact during the import.
Note If you import several purposes for one contact at the same time, write one true or false value for each purpose into the column of the specific legal basis, in the order that matches the order of the purposes. Write all the true and false values into a single cell, separated by commas.
The same rules apply to the other "Legal basis: ..." columns.
9. So if we want to set the purpose of processing and the legal basis for our two contacts (a customer and a potential customer) as described in the example, the relevant columns of the table will look like this:
| Purpose of personal data processing | Email sending status | Valid until | Legal basis: Legitimate interest of the controller | Legal basis: Consent to the processing of personal data | |
|---|---|---|---|---|---|
| customer@example.com | 2 | 1 | 9.10.2028 | true | false |
| prospect@example.com | 2 | 1 | 9.10.2028 | false | true |
In the other Legal basis columns, leave the value false for both contacts.
10. Once all customers have the required values set, we will save the file as a comma delimited CSV in UTF-8 encoding.
11. You can then import the CSV document saved this way into Quanda as usual, using Bulk contact import.
Do you have any further questions about GDPR and Quanda? If so, contact us or write to us at support@onquanda.com.
Here's to GDPR without the headaches.
Veronika Jandová and Jan Spáčil
