The easiest way to comply( did we mention you should consult a lawyer?) is to set up a Privacy Policy on your website, and then require your subscribers and customers to agree to it when you are collecting their information.
For your customer’ s agreement to stand up legally, it is advised that you use a‘ click wrap.’ You’ ve seen these and you’ ve even clicked them yourself.
A click wrap method is where your customer clicks‘ I Agree’ to your Privacy Policy before hitting submit. You can add this directly to your autoresponder form when they join your mailing list, as well as adding it to the checkout process when they purchase a product.
Is it possible this could lower your conversion rate? Maybe. We haven’ t seen this tested one way or the other. But if you enjoy sleeping at night, we recommend taking this extra step. Data Transmission and Storage You’ ve got the customer’ s data and their agreement to your privacy policy – you’ re good to go, right?
Well, maybe not.
28
How and where are you storing that data? It’ s vital that you can reassure your customers that you are able to keep their data secure. Think of the breaches companies like Target have experienced, and you’ ll realize you cannot take this lightly, even if you’ re only collecting email addresses.
Take a look at how Google lists their data protection mechanisms: Information security We work hard to protect Google and our users from unauthorized access to or unauthorized alteration, disclosure or destruction of information we hold. In particular:
• We encrypt many of our services using SSL.
• We offer you two step verification when you access your Google Account, and a Safe Browsing feature in Google Chrome.
• We review our information collection, storage and processing practices, including physical security measures, to guard against unauthorized access to systems.
• We restrict access to personal information to Google employees, contractors and agents who need to know that information in order to process it for us, and who are subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.
Source: https:// www. google. co. uk / intl / en-US / policies / privacy /# infosecurity