Where applicable, the intention of the controller to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or, in the case of transfers referred to in Articles 46 or 47 or the second subparagraph of Article 49(1), reference to adequate or appropriate safeguards and the means to obtain a copy of these or the fact that such safeguards have been provided.
In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following information necessary to ensure fair and transparent processing of the personal data:
The period for which the personal data will be stored, or where this is not possible, the criteria used to determine that period.
The existence of the right to request from the data controller access to personal data relating to the interested party and its rectification or deletion, or the limitation of its processing, or to oppose the processing, as well as the right to data portability.
The existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.
The right to lodge a complaint with a supervisory authority.
If the communication of personal data is a legal or contractual requirement or a requirement necessary to enter into a contract, and if the interested party is obliged to provide the personal data and is informed of the possible consequences of not providing such data.
The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Furthermore, where the controller plans to further process personal data for a purpose other than that for which the personal data were collected, the controller shall, prior to such further processing , provide the data subject with information about that other purpose and any additional information relevant to that purpose pursuant to paragraph 2.
The safest and most transparent way to provide information is through the layered system, that is, providing basic information in the first instance, right at the time of requesting it, and expanding on that information through a link to your privacy policy.
2.- The power of consent in your subscription list
The second key element in a legal subscriber list is consent.
In any marketing strategy that aims to avoid the Chernobyl effect, consent will be the key element that will prevent your list from being contaminated.
It's not something to be afraid of.
On the contrary, consent is nothing more than the permission marketing philippines code number mobile that so many gurus have defended and defend as a fundamental factor in the success of any loyalty and conversion campaign.
You can ask Seth Godin himself , who argues that permission marketing is expected, personal and relevant and that this generates substantial advantages in any campaign :
Personal : Messages are directly related to the individual customer.
Relevant : Marketing is related to something the prospect is interested in.
But not just any consent is valid; for example, consent obtained tacitly or by omission is not valid, and this means reviewing all your forms and ensuring that they include a valid way of obtaining consent.
The GDPR in its point 32 specifically states that: “consent must be given by means of a clear affirmative act reflecting a manifestation of the free, specific, informed and unequivocal will of the interested party to accept the processing of personal data that concerns him or her.”
Therefore, for this consent to be valid, it must meet several requirements:
It must be free : it cannot be conditioned or coerced. For example: "if you do not accept, you cannot browse" or "you will only receive discounts if you accept."
It must be specific : general consent or a yes to everything is not valid; consent must be associated with a specific purpose that must be specified.
You must be informed : in addition to the above, for consent to be valid, it must be associated with precise, clear and truthful information on which consent is given. Example: “include you in my list to send you my newsletters with the latest published posts”, “send you offers of our own products and services”, etc.
It must be unambiguous : it is obtained through a clear affirmative action. The GDPR does not allow for forms of tacit or omission consent based on inaction. It rules out silence, inaction or pre-checked boxes as forms of consent.
It must be verifiable : you must make sure that you can pro