GDPR use cases

Real-life use cases can make GDPR's legal requirements more concrete. This article explains the GDPR impact of the following use cases:

Account creation
Abandoned cart email
Push notifications
Mobile SDK consent revocation

Account creation

When a new user creates an account with you, they provide details such as their full name, email address, phone number, and date of birth.

Registration has several GDPR implications:

You need consent to send communications, including email and SMS, and to phone the individual.
You need to clearly tell the customer how their data is processed.
You need to clearly tell the customer how to withdraw their consent to be contacted and how to delete, alter, or rectify their information.
You can use a double opt-in email to make sure the customer consents to processing.

Key takeaway: When acquiring a new customer, ask for their specific and informed consent to be contacted, including their communication preferences and the purposes they may be contacted for. Also, be transparent and clear about your privacy policy.

Abandoned cart email

A user might add something to their cart and then close the tab or forget to buy it. With Bloomreach, you can send an email reminding the user to check out before the item goes out of stock.

GDPR implications of this use case:

The user might not have an account yet, so contacting them falls under legitimate interest.
For legitimate interest to be valid, you must have carried out a test that considers the purpose, necessity, and a balancing act. You must have proof and a record of this test.
Include an opt-out link in the email. Otherwise, the email may appear intrusive.

Push notifications

Customers may want reminders about new sales. You can send these as push notifications in Bloomreach.

GDPR implications of this use case:

Before you send a push notification, make sure the browser asks the customer for permission to send push notifications from your website.
After the customer accepts push notifications, tell them where they can adjust their preferences.
Track and record these preferences.
Add details about push notifications somewhere on your website, such as your privacy policy, so the user can easily update their preferences.

Key takeaway: Like emails, push notifications require consent. Collect, record, and maintain valid consent from your customers.

Mobile SDK consent revocation

When a mobile app user revokes tracking consent, use the appropriate SDK method to clear local data and prevent identifiers from being re-sent to the backend.

The SDK method you choose must match the consent scenario, because not every method clears data the same way. For more information, see iOS SDK tracking and Android SDK tracking.

GDPR implications of this use case:

Revoking consent must immediately stop the collection of new personal data.
Tracking data that's already queued on the device but not yet sent must not re-identify the customer after consent is revoked.
If the customer keeps a lower level of consent (for example, non-personalized marketing), the app needs a way to keep tracking anonymously without exposing the previous identifiers.

Key takeaway: When a mobile app customer revokes tracking consent, use the SDK method that matches what they're revoking.