3 Steps to GDPR Compliance for Online Businesses with Squarespace Websites
Photo credit: Álvaro Serrano
Disclaimer: I am not a legal expert and this post does not constitute legal advice.
The General Data Protection Regulation (GDPR) is a law that came into effect in 2018 and which regulates how businesses anywhere in the world are collecting, using and processing data from EU citizens. In the following I share the steps I took to make my business and website GDPR compliant.
GDPR Highlights
Lawful Basis
You need a lawful basis for collecting and using personal data. There are six lawful bases and in my case I am using explicit consent at data collection point as well as contract for purchases.
Privacy Policy
Your Privacy Policy needs to explain in clear and simple language how you are collecting and using the personal data of EU citizens, and who they can contact if they wish to review, change or delete their data.
Data Processing Agreement
If you use 3rd party data processors (Stripe, PayPal etc.) you need a contract with them that addresses the nature and purpose of the processing and everyone's responsibilities and liabilities. This contract is generally referred to as the Data Processing Agreement (DPA).
Non-Compliance
Non-compliance can result in high fees, even for small companies and even if your company is based outside the EU. As long as you process data of EU citizens you are liable. My question: How is this enforced? According to this article "EU regulators can fine U.S. companies for violating GDPR, and they can do it with the help of U.S. authorities." While I don't think that small one-person businesses are high on the authorities' radar this doesn't mean that we should be complacent about any of this.
Anyone Can Report You
I have not been able to find a written English back-up for this statement. I heard about this in a German law forum that specialises in GDPR. According to them anyone can report you for perceived non-compliance, even if they are not a victim of your alleged non-compliance. So if anyone knows more about this and can point me to a realiable source I'd be grateful. I'm mentioning it here because it's just one more thing to be aware of.
Photo credit: Joakim Honkasalo
My 3 Steps to Compliance
It is easy to feel overwhelmed at the thought of making our businesses and websites compliant and while I am not a legal professional I thought it might be useful to other online business owners to see what I have done to be compliant. I broke it down into three steps:
Create a Lawful Basis.
1.1 Explicit Consent
1.2 ContractHave an up-to-date Privacy Policy.
Data Processing Agreements (DPA) with 3rd party providers.
STEP 1: Create a Lawful Bias
You need a lawful basis for data collection. There are six options in total and I am using Explicit Consent for my mailing list subscribers and Contract for services and products.
1. Explicit Consent
1.1 Lead magnets: don’t automatically add people to your mailing list
Under GDPR you cannot offer an opt-in or lead magnet and automatically add subscribers to your mailing list. The GDPR is very clear: “Consent means offering individuals genuine choice and control. Don’t use pre-ticked boxes or any other method of consent by default.” So if you offer a freebie in exchange for a subscriber email address, you need to be very clear about this!
1.2 Remove Automatic Mailing List Subscription at Checkout
If you sell products in Squarespace you can automatically add customers to a mailing list at check-out. Do not do that. Make sure you uncheck that option in your commerce settings. You can also add custom text to the checkbox label, here it is recommended to add a description about your mailing list and a link to your privacy policy. To do this go to your Squarespace settings and then > Selling > Checkout > Email Signup Settings and make sure that “Select checkbox by default” is UNCHECKED.
1.3 Use Double Opt-In
Double Opt-In
A double opt-in is an email that your subscriber receives after entering their email address, asking them to click a link to confirm their subscription. Double opt-ins are not popular because they add an extra step and the emails can also end up in people’s spam folders. In my case I am ok with the double opt-in because it means that only those subscribers will join my mailing list who really want to be on it, it helps with building a qualitative list rather than just focusing on the numbers.
I created a custom page that people are directed to after submitting their emails asking them to check their inboxes or spam folders for the Confirmation Email. You can configure this on the Post-Submit tab in your newsletter block:
I use Squarespace Campaigns where you can also style the double opt-in Confirmation Email to make it brand consistent, which I love!
2. Contract
When selling services or products I use the lawful basis of a Contract and as such I want customers to agree to my Terms & Conditions (also known as Terms of Service) at checkout which is basically the contract. The Privacy Policy, by the way, forms a part of the Terms & Conditions agreement.
Important: In Squarespace, while you can list links to your policies at checkout, there is no explicit verbiage saying that you agree to the terms when you hit the purchase button. There is no option for a consent checkbox, either. This issue has been raised with Squarespace and I hope that it will be addressed.
STEP 2: Have an Up-to-Date Privacy Policy
I am not a lawyer and even though the GDPR – rightfully so – demands that our policies are written in a clear and plain language this was more than I wanted to bite off myself. These days there are a lot of services out there that can help you with your privacy and other legal policies. For simplicity I will just mention Termageddon here, which is the automated policy generator that I use and love!
Termageddon helps you protect your business from fines and lawsuits in 30 minutes. All policies are updated automatically for complete legal peace of mind. Complimentary onboarding is available, and their service is great and also very reasonably priced.
STEP 3: Data Processing Agreements (DPA) with 3rd Party Providers
"Whenever a controller uses a processor (a third party who processes personal data on behalf of the controller) it needs to have a written contract in place." –ICO GDPR Guidelines
I currently have the following agreements in place, see table below. Many providers have updated their Terms of Use to include an automatic DPA with their customers. If you have Google Analytics you can accept the Data Processing Amendment in your Analytics Account settings, click here for more info.
The GDPR also requires companies to document their data processes but thankfully this is not mandatory for companies with less than 250 employees. Nonetheless, I took this opportunity to look at my own set-up and made a list of all the 3rd party services my business uses who process my customer's data, it feels good to have an overview:
| 3rd Party | Services Used | Data Collected | DPA |
|---|---|---|---|
| 17hats | Purchasing web design services | Full Name, Email Address, Billing Address, Phone Number, Credit Card | ✔︎ |
| Acuity Scheduling | Making Appointments | Full Name, Email Address, Billing Address, Phone Number, Credit Card | ✔︎ |
| Disqus | Blog Post Commenting | Email Address (optional), Name (optional) | ✔︎ |
| Google Analytics | Website Traffic Analysis | Online identifiers, including cookie identifiers, internet protocol addresses and device identifiers; client identifiers. More info here. | ✔︎ |
| MemberSpace | Online Course Paywall | Full Name, Email Address, ZIP Code, Credit Card | ✔︎ |
| PayPal | Online Purchases | Full Name, Email Address, Billing Address, Phone Number, Credit Card | ✔︎ |
| Squarespace | Email Marketing, Commerce, Memberships | Full Name, Email Address, Billing Address, Phone Number, Credit Card | ✔︎ |
| Stripe | Online Purchases | Full Name, Email Address, Billing Address, Phone Number, Credit Card | ✔︎ |
Photo credit: Aaron Burden
Conclusion
While the GDPR can feel intimidating and overwhelming for us small business owners I think it's important to remember the basis for all of this: the protection of our personal data.
As a business owner who processes personal data I want my customers and subscribers to feel assured that I am being responsible when it comes to my use of their data and I am confident that I have put the right measures into place to ensure compliance.
