GDPR Compliance

Question 1

Does the GDPR govern how organizations conduct win-loss analysis?

Accepted Answer

Yes. Organizations that want to conduct win-loss analysis, particularly those with prospects and customers in the EU, must abide by the GDPR. The GDPR imposes restrictions on how data controllers may legally contact and interact with their data subjects (i.e., prospects/customers) as they carry out win-loss analysis.

Question 2

Is “consent” required before contacting a data subject for win-loss feedback?

Accepted Answer

The GDPR generally prohibits data controllers from contacting data subjects, or processing their personal data in any way, without prior consent. This is especially true for direct marketing use cases (i.e., marketing your products or services to them). However, the GDPR has allowances for certain processing activities like win-loss analysis. These exceptions are permitted under “legitimate interest allowances” that overcome the requirement for prior consent. As a result, organizations can legally contact data subjects to solicit win-loss feedback without their prior consent to do so.

Question 3

What are “legitimate interest allowances” and how do they apply to win-loss analysis?

Accepted Answer

The term “legitimate interest allowances” refers to circumstances wherein a controller may legally process personal data of a data subject without their explicit prior consent to do so. To qualify, the processing activity in question must pass a three-part test: Purpose Test, Necessity Test, and Balance Test. In regards to win-loss analysis, legitimate interest allowances are widely considered adequate basis for processing due to the fact that (a) the data subject previously consented to data processing by the controller during their sales evaluation, (b) soliciting the prospect’s feedback at the end of the sales process is a reasonable, non-harmful use case that only involves business-related data, and (c) the processing serves a non-trivial business purpose for the controller. Thus, there is widespread consensus that win-loss analysis passes the three-part test, and that organizations may contact prospects/customers for win-loss feedback without their prior consent.

Question 4

What is a processor and can we use a processor (like Clozd) to conduct win-loss analysis?

Accepted Answer

When organizations (“controllers”) process data about their prospects or customers (“data subjects”), they often need the help of third-party products or services to do so. The third-party entities that provide these products or services are referred to as “processors”. The GDPR allows controllers to utilize processors without the permission of their data subjects, provided that personal data is safeguarded by the processor and only used to fulfill the controller’s lawful processing activities. In regards to win-loss analysis, most organizations enlist the help of a processor like Clozd to carry out win-loss analysis. This is allowable under the GDPR so long as certain safeguards and contractual agreements are in place between the controller and Clozd.

Question 5

Can we legally send our win-loss invitation messages using the Clozd platform?

Accepted Answer

Yes. Many organizations utilize vendors like Clozd to conduct win-loss analysis. When doing so, Clozd acts in the capacity of a “processor” as permitted under the GDPR. As a processor, Clozd may be utilized for relevant processing activities such as filtering customer/prospect data, contacting data subjects, collecting feedback, and analyzing the data. The GDPR is agnostic regarding which processor is used, as long as lawful basis and proper controls are established. Using Clozd for win-loss invitation emails is legally equivalent to using your email marketing system.

Question 6

As a processor, does Clozd do anything proactive to support its clients with GDPR compliance?

Accepted Answer

Yes, Clozd proactively supports clients with their GDPR-compliance efforts in various ways. Clozd helps clients implement a Data Processing Agreement (with Standard Contractual Clauses), ensures the legal relationship between controller and processor is properly established, and the Clozd Platform supports essential data processing controls such as data rectification, erasure, and opt out management. Clozd is also audited annually for ISO 27001 and SOC 2 Type II compliance, ensuring that personal data is safeguarded in accordance with industry best practices.