How can you comply with the GDPR with Laposta?
If you send newsletters, privacy legislation requires you to comply with seven points. Several of these are already handled by default in Laposta. Other points, such as how you collect and record consent, are things you arrange yourself when setting up your lists and campaigns.
1. Data processing agreement
When you send newsletters with Laposta, you already meet one of the main requirements of the GDPR: there is a data processing agreement in place between you and Laposta. You accept this together with the terms and conditions when applying for your account, so you do not need to sign it separately. You can find the agreement under Subscription → Documents.
2. Subscribing
Subscribing must be a clear action. If you use one of Laposta’s standard forms, its purpose is clear. If someone subscribes during another process, for example when requesting a document, they must explicitly confirm this and the checkbox must not be pre-ticked. See also using double opt-in.
3. Subscribers from other sources
Who you may or may not email is set out in the Dutch Telecommunications Act (Telecommunicatiewet). This act did not change when the GDPR came into force. You need unambiguous consent from the data subject, or an existing customer relationship. You can find more information under the legal bases for processing.
4. Demonstrating consent
You must be able to demonstrate not only that someone has given consent, but also how, where, when, to whom, for what purpose and in what context this happened. If you collect sign-ups using a Laposta subscribe form, these details are recorded automatically. If your subscribers come from another source, such as a CRM, you must arrange this yourself. If consent is missing, you can still request it using a re-permission campaign.
5. Unsubscribing
It must always be clear how people can unsubscribe. This is handled automatically, because an unsubscribe link is required at the bottom of every newsletter.
6. Privacy statement
If you want to be extra clear about how you handle personal data, you can place a privacy statement on your website. In it, you state which data you collect, what you do with it, where it is stored, what rights a person has and how someone can submit a complaint. This policy must comply with the GDPR. You can find a template under text for your privacy statement.
7. Obligation to report data breaches
You are responsible for the personal data you manage. If something goes wrong and this data falls into the hands of others, you are required to report this to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), and in the event of a high risk, to the data subjects as well.
Laposta as processor
You store the personal data for your newsletters with Laposta. This makes Laposta the processor of that personal data. Should a data breach occur at Laposta, Laposta is required to report it to you. This is laid down in the data processing agreement, along with the other agreements on what Laposta may and may not do with that data.
Data about your readers is also recorded when measuring opens and clicks. You can read about the choices you have in this regard under tracking and reporting.