Could you please let me know where in the world your applications and data are hosted ?

Thanks

Richard Jackson

Hi Gregory,

Great question. The reason we mentioned B2C contacts here is that the GDPR has much less bearing on B2B communications. Most experts have agreed that professional emails (i.e. an email address in the form firstname.lastname@company.com or something similar) does not constitute personal data at the level required for GDPR restrictions. In this case, B2B communications just need to be based on a potential legitimate interest of the recipient, which is a much more relaxed protocol.

Hope this helps! Of course, if you’re really concerned about your B2B communications, it would still be best to seek the counsel of a lawyer who specializes in this field.

This makes your infographic seem only pertinent to B2C – Business to Consumer. What about Business to Business?

Hi Jesse,

Great question! I am not a lawyer, but I will do my best to answer your question.

The GDPR really centers on acquiring user consent for businesses to process personal data for EU citizens. This means that it really refers to the collection of this information and the processes for which the data subject has authorized this information to be used. In the case you mention above, as long as the process by which you collected the contact information of an EU citizen is GDPR-compliant (i.e. that contact gave you their information through a positive action, and that the terms of consent and types of processing this data would be used for are clear), then you should have nothing to worry about. Hope this helps!

Does that email alone have to be GDPR compliant? Or does the process of collecting the email list subscription in the first place have to also be GDPR compliant?

Or nothing has to be compliant?

Hi Catarina — thanks for your question.
I am not familiar with feedburner, but if they don’t allow you to add unsubscribe links, you should find a different service to use. In general, I don’t think you’ll have too much to worry about in terms of GDPR compliance though. Just make sure you clearly communicate what people are subscribing to, how their data will be processed, and how they can amend or delete this data as needed. Your privacy policy doesn’t have to be extremely long, as long as you cover all of your bases and make sure that your readers’ data is secure and they have the necessary transparency required under the GDPR, you should be okay.

Hey Lauren — thanks for the kind words! If you’re just starting out, using a free WordPress.com site isn’t a bad route, but I would always recommend starting with a true WordPress.org installation if you want to have more customization and control and avoid any migration headaches in the future. It’s up to you though — the only way you can really go wrong is if you wait too long! 😉

Thanks for the comment Ian — you’re absolutely right that storing this consent and being able to show proof of consent for a given contact is vitally important under the GDPR. Luckily, most tools (Sendinblue included) already does this for you. For more information on how we store data surrounding consent, feel free to check our post here –> https://blog.sendinblue.com/our-story-sendinblue-gdpr-compliance-plan/