GDPR Compliance | Clozd

Data Privacy with Clozd

GDPR Compliance

The General Data Protection Regulation (GDPR) is a privacy and security law drafted and passed by the European Union (EU). It imposes obligations on organizations anywhere that target or collect data related to people in the EU. The regulation was put into effect on May 25, 2018, and levies fines against those who violate its privacy and security standards. You can learn more about the regulatory framework here.

Clozd’s GDPR Compliance

Clozd is proactive about GDPR compliance both as a controller and a processor (when processing personal data on behalf of clients).

Highlights of Compliance Efforts

• ​

  Lawful Basis: Clozd does not store or process personal data without the consent of the data subject and/or the written consent of clients in accordance with legitimate interest allowances. For more details, review the privacy policy.

• ​

  Information Security: Clozd is ISO 27001 compliant and maintains technical and organizational security measures to safeguard personal data against accidental or unlawful access, modification, and destruction. For more details, visit the trust center.

• ​

  Rectification & Erasure: Clozd honors the fundamental rights of data subjects, including data rectification and erasure (the right to be forgotten). Clozd promptly honors data subject and/or client requests to modify or erase personal data. Requests can be made at any time using this request form.

GDPR Terms to Know

• ​

  Personal Data: Any information that relates to an individual who can be directly or indirectly identified. This includes names, email addresses, location information, ethnicity, gender, biometric data, religious beliefs, web cookies, and political opinions.

• ​

  Data Processing: Any action performed on personal data, whether automated or manual, such as collecting, recording, storing, organizing, erasing, etc.

• ​

  Data Subject: The person whose data is processed.

• ​

  Data Controller: The entity who decides why and how personal data will be processed.

• ​

  Data Processor: A third-party that processes personal data on behalf of a data controller.

Frequently Asked Questions

Win-loss analysis and the GDPR

Does the GDPR govern how organizations conduct win-loss analysis?

Yes. Organizations that want to conduct win-loss analysis, particularly those with prospects and customers in the EU, must abide by the GDPR. The GDPR imposes restrictions on how data controllers may legally contact and interact with their data subjects (i.e., prospects/customers) as they carry out win-loss analysis.

Is “consent” required before contacting a data subject for win-loss feedback?

The GDPR generally prohibits data controllers from contacting data subjects, or processing their personal data in any way, without prior consent. This is especially true for direct marketing use cases (i.e., marketing your products or services to them).

However, the GDPR has allowances for certain processing activities like win-loss analysis. These exceptions are permitted under “legitimate interest allowances” that overcome the requirement for prior consent. As a result, organizations can legally contact data subjects to solicit win-loss feedback without their prior consent to do so.

What are “legitimate interest allowances” and how do they apply to win-loss analysis?

“Legitimate interest allowances” refer to circumstances wherein a controller may legally process personal data of a data subject without their explicit prior consent.

To qualify, the processing activity must pass a three-part test:

• ​Purpose Test: Does the processing serve a legitimate, non-trivial business interest?
• ​Necessity Test: Is the processing necessary to serve the purpose? Have less intrusive alternatives been considered and deemed insufficient?
• ​Balance Test: Does the processing pose any risk or harm to the data subject? Does the purpose justify the risk posed?

The UK Information Commissioner provides guidelines for conducting a legitimate interest assessment here.

For win-loss analysis, legitimate interest allowances are widely considered adequate because:

• ​The data subject previously consented to data processing by the controller during their sales evaluation.
• ​Soliciting feedback at the end of the sales process is a reasonable, non-harmful use case involving only business-related data.
• ​The processing serves a non-trivial business purpose for the controller.

There is widespread consensus that win-loss analysis passes the three-part test, and organizations may contact prospects/customers for win-loss feedback without their prior consent.

What is a processor and can we use a processor (like Clozd) to conduct win-loss analysis?

When organizations (controllers) process data about their prospects or customers (data subjects), they often need the help of third-party products or services (processors).

Example: A bank wants to send account notices to its customers via email. The bank uses a third-party software solution to design and send the emails. Under the GDPR, the bank is the controller and the software vendor is the processor. The GDPR allows controllers to utilize processors without the permission of their data subjects, provided that personal data is safeguarded and only used to fulfill lawful processing activities.

For win-loss analysis, most organizations enlist the help of a processor like Clozd. This is allowable under the GDPR as long as safeguards and contractual agreements are in place between the controller and Clozd.

Can we legally send our win-loss invitation messages using the Clozd platform?

Yes. Many organizations utilize vendors like Clozd to conduct win-loss analysis. When doing so, Clozd acts as a processor as permitted under the GDPR. As a processor, Clozd may be utilized for any or all of the following activities:

• ​Filtering customer/prospect data to determine which data subjects should be contacted for win-loss feedback
• ​Contacting data subjects to request win-loss feedback
• ​Collecting win-loss feedback through surveys or interviews
• ​Interpreting and analyzing the data collected

There is a misconception that sending win-loss invitation emails through an existing email marketing system might be preferable under the GDPR. However, the GDPR is agnostic regarding which processor is used. The key is that a lawful basis and proper controls are established. Using Clozd for win-loss invitation emails is legally equivalent to using your email marketing system, but offers more purpose-built functionality.

As a processor, does Clozd do anything proactive to support its clients with GDPR compliance?

Yes, Clozd proactively supports clients with GDPR-compliance efforts in various ways:

• ​Clozd helps clients implement a Data Processing Agreement (with Standard Contractual Clauses) as part of the contract process, ensuring the legal relationship between controller and processor is properly established.
• ​The Clozd Platform supports essential data processing controls such as data rectification, erasure, and opt-out management.
• ​Clozd is audited annually for ISO 27001 and SOC 2 Type II compliance, ensuring that personal data is safeguarded in accordance with industry best practices. Clients can legally and confidently rely on Clozd to process personal data on their behalf.

---

This page provides background information to help you better understand Clozd’s approach to GDPR compliance and the basic principles of lawful data processing for win-loss analysis. This information is not legal advice. Consult an attorney for advice on your specific circumstances or interpretation of this information.