GDPR and Partners

What are my data privacy obligations when participating in the Extu program?

There are four key obligations that partners have when they use Extu’s services to send marketing materials to their subscribers:

1. Establish the lawful basis for processing personal information on Subscriber lists.
   This means that you:
   • have obtained express consent from the individual recipient on your subscriber list to receive marketing material from you by way of a clear, freely given, fully informed, affirmative action
   • are relying on legitimate interests as the lawful basis for using the email address on your subscriber list to send marketing materials having carried out a documented legitimate interests assessment (i.e. there is a reasonable expectation by the recipient that they may receive marketing material due to an existing business relationship and the privacy impact has been assessed as low). Please see How do I ensure my subscriber list is GDPR compliant? for further information.
2. Privacy Notices must give full information about the processing of personal data.
   As the controller of your subscriber list, your privacy notice should be compliant with the fairness and transparency requirements under the GDPR, and disclose:
   • The lawful basis that is relied upon for collection and processing of personal information, including the processing of email addresses for direct marketing purposes. In most cases, the lawful basis relied upon will be either consent or legitimate interests. You may also rely on other grounds such as performance of contract or legal obligation where you process personal information in the course of business (e.g. contact information to provide products or services to a particular customer).
   • What personal information you share with Extu (this should include notification that customer email addresses and copies of invoices/receipts will be shared in order to administer and validate campaigns).
   • Who you share personal information with and a list of third-party processors, which includes Extu.
3. Appropriate technical and organizational measures should be in place Your systems should be secure – this includes having adequate IT and cybersecurity protections, as well as having good internal controls, policies and guidelines regarding the collection, use, sharing and handling of personal information.
4. Be Extu’s partner in privacy. We need to work together to ensure we adhere to appropriate privacy standards and do our best to protect the personal information we collect and process in the course of sending marketing materials. We need to help each other address any privacy questions, complaints or requests, respond to a potential data breach and conduct privacy investigations or assessments. We are here to support you and you must immediately notify us:
   • in the event of a potential or actual data breach
   • if you receive a data subject access request
   • if you receive any complaints or claims from a subscriber or regulator regarding privacy or personal information
   • if you have any questions or concerns about privacy in general.

How do I ensure my subscriber list is GDPR compliant?

Partners should audit their subscriber list and test for GDPR compliance when they first join the program and on a regular basis thereafter. Even if you are not subject to the GDPR, Extu’s terms and conditions require that you have a lawful basis for processing the subscriber lists and for Extu to provide the marketing services.

Auditing your customer list means assessing the email addresses and other information you have collected and checking whether you have a lawful basis for such processing. If you do not have a lawful basis for collection, then the email address should not be included in your subscriber list.

While there are six lawful grounds for processing under GDPR, the bases most likely to apply for the collection and use of an email address for direct marketing purposes are:

• consent; or
• legitimate interest.

It is your responsibility to analyse your data processing activities and choose the right basis. If you are unsure which of the lawful grounds listed in the GDPR apply to you, please consult with your legal advisers to ensure processing activities are properly justified. It is important to remember that the GDPR enshrines the principle of ‘accountability’ which means that you must be able to demonstrate compliance, so diligent record keeping is vital to support these justifications.

The Information Commissioner’s Office also has further information on lawful basis, along with a lawful basis interactive guidance tool to help you determine which basis applies.

Consent

Consent means that the relevant individual has freely given their clear, explicit consent to the processing of their personal data for a specific purpose.

When you review your subscriber list you should consider whether express consent was given and whether it is still valid. Valid consent under the GDPR:

• must be freely given; this means giving people genuine ongoing choice and control over how you use their data
• should be obvious and require a positive action to opt in. Consent requests must be prominent, unbundled from other terms and conditions, concise and easy to understand, user-friendly and on a positive ‘opt-in’ basis as opposed to a pre-ticked box or ‘opt-out’.
• must specifically detail the controller’s name, the purposes of the processing and the types of processing activity.

Make sure you keep records to evidence consent – who consented, when, how, and what they were told.

Examples of express consent include:

• Opt-in via a web or online form, provided the opt-in box is not pre-selected by default
• An offline form is completed that clearly indicates that the individual may be added to your email marketing subscriber list and they have expressly indicated their willingness to receive such emails
• Giving you their business card; provided that 1) you have explicitly indicated that by giving you their business card they are agreeing to being added to your email marketing subscriber list; or 2) they added their business card to a container or pile that clearly indicated that by adding such business card they are agreeing to being added to your email marketing subscriber list. In either event, you must transparently communicate the basis of your processing via communication of your privacy notice.
• Providing you with other express written permission to be added to your email marketing subscriber list prior to you contacting them via email.

Further information on consent can be found on the Information Commissioner’s Office website: ICO: Consent and Guidance on Consent

Legitimate Interest

There may be instances where reliance can be placed upon your legitimate interests with subscribers and a ‘soft opt-in’ can be established.

Legitimate interest may be relied upon if the marketing to be carried out is in the legitimate interests of your own business or of a third party, which could include software vendors, where there are reasonable grounds that the individual would expect the processing and there is likely to be a minimal impact on privacy. The EU Commission has confirmed that processing of personal data for direct marketing purposes can be regarded as being carried out for a legitimate interest provided that all of the necessary criteria has been met.

To rely on legitimate interest as grounds for lawful processing, you will need to conduct and keep a record of your legitimate interest assessment. The Information Commissioner’s Office website has a sample legitimate interest assessment template you can use as a guide.

Once you have established and recorded your justification for legitimate interest as grounds for lawful processing, you can review your subscriber list to determine whether any of the email addresses meet the soft opt-in criteria.

Soft opt-in applies to existing customers only (not prospective customers). To be eligible for inclusion under soft opt-in, the email address must have been obtained in the course of a sale of a product or service to that person.

There are no legal time limits enforced regarding soft opt-in, but as a guide, purchases made within six to 24 months of the date of the review could be considered a reasonable timeframe. Remember there must be a reasonable expectation that the subscriber would consent to receive the marketing emails.

Further information on legitimate interest can be found on the Information Commissioner’s Office website: ICO: Legitimate Interests and Guidance on Legitimate Interests.