GDPR compliance

Hi, would you be able to provide details of any official security standards you adhere to/are a member of that we can use in communications regarding GDPR as soon as possible please.

Very many thanks

No, we will only be providing the information we have to provide, which to our understanding is the legal agreement between you and ONTRAPORT. We will have an update on our security level in a month or two, and you can compile that if you need to. 

Hi,

You're saying :

As far as we can tell, all the new requirements on EU businesses are easily handled with the tools already available in ONTRAPORT

In this case, could you provide me an easy solution for store a GDPR compliant proof of consent in ONTRAPORT ? And something that can be EASLY extracted in case of audit.

Here what to store for EACH form submitted :

1. Who -> Name, Email
2. When -> Date
3. How -> Name of form
4. What we have told to the customer the moment they consent -> screen of form, pdf of terms (the version at the time they consent)

It's more the last point I struggle with...
And a way to quickly and easly extract these data.

In my opinion, Ontraport is compliant.
But it's a REALLY BIG CHALLENGE too implement a compliant GDPR process... 
It's absolutly not easy has you told.

Or maybe you have a solution for me ?
Because in the case of an audit... I think I have for 1 or 2 month at full time to extract clear data... And at this time, my proof of consent is not compliant (because of the missing of the point 4)

The Contact Record will record the opt-in form in the Contact Log as one of the first entries with a date and time stamp. The System Information tab will also show the date they were added, and the IP address they joined from if available.

We are not lawyers so we can't tell you if this information will satisfy your local enforcement agency's requirements. Check with them and see if that information is sufficient for the first three items in your list.

You will have to find out if standard version control information for your Privacy Policy is sufficient when cross referenced with the date of opt-in. We cannot tell you if that will work, but if it is sufficient for your local agency, then you could implement version control for the necessary notifications on your website. Here is an article about using GitHub for version control. The article is from 2009, so it is not a new concept. There are commercial packages that maintain versions of your pages that might be easier to implement. You will have to find out which solution satisfies the requirements for GDPR.

ONTRAPORT also includes a feature called the Filebox in each Contact Record on the Notes and Tasks tab. You can store files that are unique to that contact in the Filebox. Files in the Filebox can be sent as file attachments on email messages only to that Contact. The Filebox records the date and time the file was added. We don't know if that would satisfy the requirements or not, so check with your attorney or local jurisdiction.