Your GDPR Responsibilities

GDPR will replace the 1995 data protection law in the UK on 25th May 2018. It will apply to any business that holds personal data in any way.

Every business is different and you need to assess your own data collection and storage practices, seek your own legal advice and ensure that your business is compliant with the GDPR by the deadline, 25th May 2018.

How ClientsFirst will be GDPR compliant by 25th May

We are currently working through our own GDPR project plan to ensure we will be compliant by 25th May. We are following the ‘Getting ready for the GDPR’ checklist hosted on the ICO website which you can see here.

Our project activities include (but are not limited to):

  • Reviewing the data we hold as a business
  • Documenting the lawful bases for processing this data
  • Auditing and updating our terms and conditions and privacy policies
  • Changing processes in line with the new GDPR requirements
  • Training staff where appropriate on GDPR best practices

As mentioned in our previous communication, your GDPR journey with ClientsFirst, as an agency, our relationship with our clients is as a data processor. This means that ClientsFirst and our sub-processors are responsible for processing personal data on behalf of a data controller (your business).

Our sub-processors

We work with a number of sub-processors, such as Dotmailer, which affects our MailFirst clients specifically, that will also ensure compliance from a software perspective. More information on our sub-processors can be found at the bottom of this article here. Please note, it is the responsibility of yourselves to review data processes for the personal data held within this software. You can click through to our MailFirst website here for functionality updates, hints, tips & more…

Are you on track to be GDPR compliant by May?

As marketers, GDPR will have a big impact on how we approach our work, and yours. Many clients have come to us for advice to clarify whether their new processes would suffice in line with the new regulations. It’s important to reiterate that you must consult an attorney for advice on your interpretation of the GDPR data protection requirements and the accuracy of your understanding. We are happy to support you with putting processes in place, however, you are unable to rely on us to recommend a solution.

You may wish to refer to the ICO for guidance on your GDPR project. There is a checklist for Data Controllers which is designed to help you, as a data controller, assess your high level compliance with data protection legislation. This should highlight where you are up to with your journey and what you have got left to look into to make sure you are on track.

You will need to invest time and effort in order to be ready for GDPR – please take the time in April to prioritise this and get in touch with us if you require help in putting processes in place prior to the deadline. ClientsFirst will not be able to work with clients who cannot assure us that the data they store is GDPR compliant.

How we can help

Available on Adviser-Store is a template pack to guide you through your GDPR project. This is provided by Jigsaw Tree and includes a project plan, impact assessment, supplier tracking, application logs and more.

To further assist in putting processes in place, you may wish to look at MailFirst Advanced Training which will take you through the additional features and functionality MailFirst has to offer, such as: double opt-in, segmentation & preference centres, to name but a few.

As well as your email marketing communications, ClientsFirst will also be able to assist with alterations to your other data entry points such as website contact forms, newsletter sign ups and landing page forms for any campaigns that you are currently running. Please get in touch with us to discuss your requirements and we will be happy to help.

Useful resources

 

Full text of the GDPR

ICO.org.uk

Hubspot GDPR page

Dotmailer GDPR resources

Infographic: The GDPR and you

Your GDPR journey with ClientsFirst

What Is GDPR And How Will It Affect Professional Services Firms?

GDPR: Are You Focussing Too Much On Consent?

FAQs

Is ClientsFirst GDPR compliant?

We have an ongoing GDPR programme and are planning to be fully compliant by 25th May 2018.

Is ClientsFirst a ‘data processor’ or a ‘data controller’?

As an agency, our relationship with our clients is as a data processor.

A processor (ClientsFirst) is responsible for processing personal data on behalf of a controller (your business). As your data processor, we are committed to support you in compliance with GDPR. It is important to note that responsibility and liability for adhering to the GDPR guidelines is a shared responsibility between your business and ClientsFirst.

Do your terms and conditions include the new GDPR mandatory provisions?

We are currently in the process of revising our terms and conditions. These will be made available once revisions have been made.

Who has access to our data?

ClientsFirst will only process your personal data lawfully and fairly, and in line with the principles set out in the GDPR legislation.

ClientsFirst does work with third party providers / sub-processors to enable us to provide some of the services we offer to you. Where we use a third party we request that they are compliant with GDPR.

If we believe that it is required by law to disclose your personal data to a third party, whether in compliance with any applicable law or regulation or by court order or in connection with legal proceedings, we may do so without recourse to you.

How long does ClientsFirst keep data for?

ClientsFirst will hold your data for no longer than it is necessary. There may be some circumstances where your data is held for longer periods of time such as for archiving purposes and in order to comply with any legal requirements.

Do you work with sub-processors?

ClientsFirst works with a number of third party providers / sub-processors to enable us to perform various functions to assist us in providing you with the services we offer. Where we use a third party we request that they are compliant with GDPR.

If you require further information on the third parties / sub-processors we use for processing your data please contact us on enquiries@clients-first.co.uk.

Will you provide a contract or do you expect us to do so?

We will be providing new Terms and Conditions in relation to our contractual arrangements with you to ensure we comply with GDPR.

We do not expect to sign individual contracts provided to us.

Do you have a data retention and destruction policy?

We are currently reviewing our existing data retention and destruction policy, all revisions will be in place by 25th May 2018.

What measures do you have in place to ensure the protection of personal data?

We have in place relevant data handling, security and protection policies and procedures which ensure your data is secure and protected.

Do you have a policy in place to ensure the accuracy and rectification, where required, of data?

It is your responsibility to inform us of any changes to your personal data, or personal data that you pass to us to process on your behalf, so that we can ensure your personal data is kept up to date. When notified of changes, we will take reasonable steps to ensure your data is updated and any inaccuracies rectified as soon as they are discovered.

What will ClientsFirst do if it receives a Subject Access Request?

We are currently reviewing our current Subject Access Request policy, all revisions will be in place by 25th May 2018.

If you are a MailFirst client you are the ‘data controller’ of any data stored in your MailFirst account. Therefore, if we receive a Subject Access Request from one of your clients, we will pass their request for data on to you immediately so that you can manage their request.

Do you have a documented breach policy?

Yes, we have an internal breach policy which helps us to maintain our excellent reputation and to minimise the risk of breaches in the data we handle.

If you are a MailFirst client, you are the ‘data controller’ for any data stored in your MailFirst account. Therefore, if we are made aware of any personal data breach to any of your clients’ personal data we will notify you of the breach as soon as possible and no later than 24 hours after discovering the breach.

If we discover a data breach relating to one of our direct clients that is likely to result in the risk to people’s rights and freedoms, we will report the breach to the Information Commissioner’s Office within 72 hours.

How can I use MailFirst and Hubspot to help me on my GDPR journey?

If you’re a MailFirst client and are looking into how the system can assist you in your GDPR journey, have a read of our functionality updates, hints, tips and more here.  A feature called ‘Consent Insight’ is available to all accounts, making it possible to store consent against your contacts. There have also been recent changes made to how contacts are exported and deleted within the platform, making it easier to comply with Subject Access Request. You can also visit the ‘help’ section in your account for a full overview on any features.

Hubspot has advanced GDPR functionality, which can be enabled within the system by turning on one single option. If you would like to discuss how Hubspot can help with GDPR then just get in touch and we will organise a call with one of our experts.