GDPR has a reputation as the boogeyman of marketing. But once you take it apart piece by piece, you will find it asks for something quite reasonable. Knowing whose data you have, why you have it, on what basis and for how long. In this lesson we will walk through the terms we will work with throughout the course and show what they mean for your everyday work with a contact database.

Personal data and the people around it

Personal data is any information about a specific person who can be directly or indirectly identified. A name, an email address, a phone number, but also an IP address or an identifier in a system. The person the data relates to is called the data subject in the regulation. In your database, that is simply your contact.

Processing is then almost anything you do with the data. Collecting, storing, retrieving, using it in a campaign, making it available to another tool, correcting it and erasing it. Even sending an ordinary newsletter is processing of personal data.

Two roles matter here. The controller decides why and how the data is processed. Toward your contacts, you are the controller. The processor processes data according to the controller's instructions, and that is the role of Quanda, which stores your data and sends your emails for you. The relationship between you and us is governed by a data processing agreement, which you enter into together with the terms of service.

Legal basis, purpose and validity period

Processing is lawful only when you have at least one of the six legal bases the regulation lists. In Quanda you will find them in this form: legitimate interest of the controller, compliance with a legal obligation, performance of a contract or steps taken prior to entering into one, consent to the processing of personal data, public interest and vital interest. In email marketing you will practically encounter two of them, consent and legitimate interest.

A legal basis comes with a purpose, the reason why you process the data. Quanda offers a ready-made list of purposes, for example sending commercial and promotional messages, sending news updates, providing expert content or organizing educational events. And thirdly, there is a validity period, the date until which you process the data for the given purpose.

This trio is the core of the whole record-keeping. One contact can have several of them at once. Someone gave you consent to receive news updates until the end of next year and is also your customer, to whom you send offers of similar goods based on legitimate interest.

Why Quanda checks this in every campaign

Because each purpose can have a different validity and a different subscription status, one contact can be subscribed to one type of communication and unsubscribed from another at the same time. That is why in the settings of every campaign you select the processing purpose the campaign relates to. On the Recipients page, only the contacts that have this purpose set, approved and still valid are then offered. Only then do you filter by tags as you are used to.

The practical consequence: until you set any purposes on your contacts, they all have the default purpose "Not set" with no legal basis and no validity. Before you start sending, it is worth getting your records in order. We will show you how to do it in bulk in lesson four.

Where this course ends

This course is a practical guide, not legal advice. We will show you what Quanda offers and how the companies that send with it use it. The specific setup for your business, however, depends on what you sell, how you acquire contacts and what data you keep about them.

For the wording of consents, validity periods and more sensitive situations, it pays to have your texts reviewed by a lawyer. The supervisory body is your data protection authority, whose website is where you will find current opinions and guidance.

Of the six legal bases, two are all you need in email marketing. You use consent with people who gave you their contact details themselves. Legitimate interest with your own customers. The difference between them is not academic, because it determines what you may send to whom and what you must be able to prove.

Consent must be active and provable

Consent is an expression of will. A person says, on their own and voluntarily, that they want to receive emails from you. In practice this means a checkbox in a form that they tick, not you. A pre-ticked box, consent hidden in the terms and conditions or a condition like "we won't send you the material without your consent" does not hold up as consent.

The text next to the checkbox is usually short, for example "I want to receive tips and occasional offers, and I therefore give my consent to the processing of personal data for this purpose." The full wording of the consent belongs on your website, and the short text links to it. That way a person can review what they are signing up for before they even submit the form.

What the full wording should contain

Consent has its required elements. It should make clear:

• who the consent is given to, meaning your identification,
• what personal data it covers,
• for what purpose you will process the data,
• for how long,
• how the consent can be withdrawn,
• information about the rights the person has in connection with the processing.

The last two points are forgotten most often. Withdrawing consent should be as easy as giving it, so an unsubscribe link in every email is the minimum, not a bonus. Have the specific wording reviewed by a lawyer so it matches what you actually do.

Legitimate interest with your own customers

You can send your own customers offers of goods or services similar to what they have already bought from you without collecting a separate consent. This stands on legitimate interest and on the fact that you obtained the address in connection with a sale. Keep three things in mind:

• The offer must concern similar goods or services. A mailing about something completely different no longer belongs under legitimate interest.
• The recipient must be able to opt out easily, and in every message.
• Legitimate interest has a limit. When someone objects to the processing, you must handle the objection. We will come back to this in lesson five.

Where consent is stored

In Quanda, consent does not end up as a note on a contact. When editing a checkbox field in an active form, you set the legal basis, the processing purpose and its expiration directly on the field. When someone submits the form, all of this is saved to the contact together with the date and time it was created, the source and the name of the form. The content of the submitted form, including the wording of the ticked consents, can then be found in the overview of submitted forms.

This is exactly what you will need if anyone ever asks you where you got their contact details. You cannot prove consent from memory. You can prove it with a stored record that has a date and the wording.

When validity expires

For each purpose you record the date until which you process the data. Two years is a common choice, but the right period depends on what you process and why. Once the date passes, the contact gets the status "Cannot send (consent expired)" for that purpose and will no longer appear among the recipients of a campaign for that purpose.

So set yourself a reminder and send people an email asking them to renew their consent well in advance. It is much cheaper than building your database again from scratch.

Consent is only as strong as the proof that it was given by the real owner of the address. Without verification, anyone can type someone else's email into a form, and you will end up writing to a person who has never heard of you. Double opt-in closes this gap with one extra step.

What happens during double opt-in

"Opt-in" means the wish to be added to your database. "Double" means that this wish is confirmed twice. The process is simple:

• A person fills in and submits your form.
• Quanda sends a verification email with a special link to the address they entered.
• Until they click the link, the contact has the status "Cannot send (awaiting consent)".
• After the click, the verification is complete and a record of it is saved to the contact detail. You will also see it in the export.

Use double opt-in whenever you acquire a new contact based on the legal basis of consent. Wherever a form stands at the beginning, it is the surest way to keep your evidence in order.

Why do the extra work

There are three reasons, and all of them pay off:

• You verify the owner of the address. You can then prove the consent belongs to a specific person, not just a row in a spreadsheet.
• You get rid of typos. Whoever does not receive the verification email usually notices the mistake and signs up again.
• You protect your sender reputation. Nonexistent and deliberately made-up addresses, which emails could never be delivered to anyway, stay out of your database.

Setting it up in Quanda

You turn verification on directly in the active form, on the Double opt in tab. Activate the feature with the toggle, then just fill in the subject and text of the verification email. The verification link is generated automatically the moment you switch to the tab.

You can insert the link in two ways. The first is to insert it at the cursor position, where it appears as a web address. The second is to write some text, select it and click the button for inserting the verification link, just like with a regular text link. If the original sample link is still in the text, delete it. One important rule applies: the verification email may contain only a single link, the verification one. Otherwise the verification will not work correctly.

A simple text delivers better

You can adjust the content of the verification email exactly as you need. We recommend keeping it as simple as possible, a clear and brief text without images. There are two reasons. Simple messages are more likely to land in the main inbox folder. And a recipient who does not have to read anything long confirms the signup within seconds.

Do not forget to say in the email what the person is actually signing up for and who the message came from. People only confirm what they recognize.

Who did not confirm

In the form detail, in the Submitted forms section, you can see how many people did not complete the verification. When you sort the subscribers in descending order, dashes appear at the top of the list. These are the people whose double verification did not go through, and they did not make it into the contact database.

That list is useful feedback. A high share of unconfirmed signups usually means one of two things. Either the verification email did not arrive where it should have. Or people did not recognize what you wanted from them. In the first case, check your DNS records for sending. In the second, simplify the subject and the call to confirm.

Most companies came to Quanda with a database that had already existed for some time. The legal basis, purpose and validity data is missing from it, because nobody recorded it before. The good news is that you do not have to add it one contact at a time. A bulk import handles it all at once.

Sort your contacts first

Before you open Excel, divide your database according to the basis on which you communicate with each group. Typically you end up with three piles:

• Existing customers. Legal basis legitimate interest of the controller, purpose for example sending commercial and promotional messages, validity period at your discretion, commonly two years.
• Prospects whose consent you can prove. Legal basis consent to the processing of personal data, purpose according to what they signed up for, again with a validity period.
• Prospects whose consent you cannot prove. Do not import these. You have no legal basis for contacting them, and no column in a spreadsheet will fix that.

This is just an example. For your business the split may look different depending on what you sell, what products you offer and how you acquired the contacts.

Export and file preparation

The procedure is always the same. Export your contacts from Quanda to CSV, open a blank workbook in Excel and load the data via Data and Import data from text. Choose Unicode UTF-8 as the file type and a comma as the delimiter. You will know you picked the right encoding when the accented characters look correct in the preview.

In the loaded table you will see all the columns, even the ones you do not fill in within Quanda. Feel free to delete the unnecessary ones so you can find your way around. Personal data processing concerns these columns:

• Contact owner was verified via Double opt in
• Purpose of personal data processing
• Email sending status
• Valid until
• six "Legal basis" columns, one for each of the bases

What values belong in the columns

• Double opt in and the individual legal bases are written as true or false, depending on whether the value should be set on the contact.
• The processing purpose is imported as a number according to its position in the list of purposes, which you will find in Quanda's settings. Sending commercial and promotional messages, for example, is number 2.
• The email sending status is also imported as a number. One means send emails, two means cannot send (unsubscribed), three means cannot send (consent expired) and four means cannot send (awaiting consent).
• Valid until is written as a date, optionally with a time, in the form 1.1.2027 or 1.1.2027 13:30.

Need to remove a purpose that was assigned by mistake? Put a minus sign before its number, for example the value -2.

When a contact has multiple purposes

One contact can have several purposes, and the table has a simple system for it. You write all the values into one cell separated by commas, and the order must match across the columns. If you write 2,5 into the purposes column, the Valid until column must contain two dates in the same order, and each legal basis column two true or false values, again in the same order.

It pays to do a trial import on a few rows first and check the result in the contact detail. A mistake in the ordering is hard to find in a table with thousands of rows.

Saving, importing and checking

Save the finished table as a comma-delimited CSV in UTF-8 encoding and upload it via Contacts and Bulk contact import, just like any other import. Choose the import priority so that existing contacts are updated. Otherwise the changes would not take effect.

After the import finishes, verify the result. Open a few contacts at random and check in the section with the legal processing details that the legal basis, purpose and validity are correct. Only then try creating a campaign and see how many recipients are offered for the given purpose.

Sooner or later you will receive an email along the lines of "I want to know what you keep about me" or "delete me from your database". It is not an attack, it is the exercise of a right the regulation gives to everyone. Once you know where to find the data in Quanda, handling it is a matter of minutes.

What rights recipients have

Toward you as the controller, every person in your database has the following rights:

• The right to know what personal data you process about them.
• The right to access that data and to have it updated or corrected, or to restrict its processing.
• The right to erasure of personal data.
• The right to data portability and to a copy of the processed data.
• The right to object to processing based on legitimate interest.
• The right to lodge a complaint with the data protection authority and the right to an effective judicial remedy.

You as a Quanda user have the same rights toward us. The only difference is in the roles. Toward your contacts you are the controller and you handle the request. We are in the role of the processor.

Unsubscribing is the most common request

An unsubscribe link must be in every commercial message, as GDPR and the applicable e-privacy rules require. When a recipient clicks it, the unsubscribe page gives them two options. Unsubscribe from just one type of communication, meaning a specific processing purpose. Or unsubscribe from everything you send them at once.

Quanda then sets the status "Cannot send (unsubscribed)" on the contact. Unsubscribed contacts do not appear among campaign recipients at all, no matter what tags they have. You can view them at any time via the filter above the contact list.

A practical tip: when someone replies to a bulk email saying they wish to be unsubscribed, you do not have to look the contact up manually. Just click the unsubscribe link in the quoted email below their reply.

Erasure and why not to delete unsubscribed contacts

Erasure and unsubscribing are not the same thing. Leave unsubscribed contacts in Quanda alone. If you deleted them, you would lose the mailing history and the very record of the unsubscribe. It could then easily happen that you import the same contact again with the next import and start sending them emails they explicitly did not want.

But when someone directly requests the erasure of their data, that is a different situation and it needs to be assessed. Sometimes another obligation may require you to retain part of the data. If you are not sure, consult the specific request with a lawyer, especially for contacts tied to orders and accounting records.

Access, correction and a copy of the data

You handle a request for information or for a copy of the data with an export. The contact export contains complete information including everything related to personal data processing, meaning the legal bases, purposes, validity and double opt-in verification. You can provide the data in CSV or XLSX format, whichever the person prefers.

Correcting and updating data is done directly in the contact detail. For restriction of processing, in practice it is usually best to set the sending status so the contact does not end up in campaigns, and to note down the reason.

Objection, complaint and what to prepare in advance

If processing is based on legitimate interest, a person can object to it. Handle the objection quickly and preferably in the recipient's favor. An unhappy recipient who escalates their objection will cost you far more than one unsubscribed contact. They can lodge a complaint with the data protection authority, which is the supervisory body.

Prepare three things in advance. An address where requests arrive and which someone actually reads. A short internal procedure covering who handles a request and within what deadline. And a published privacy policy describing what you process, why and for how long. It is worth turning to a lawyer for its wording, so it matches how things really work in your company.