CRM system and GDPR. How Sugester meets security and GDPR requirements

The General Data Protection Regulation was introduced in 2018 by the European Union. Since then, it has given EU citizens greater control over their personal data and obligated data processors to take increased responsibility for that data.

Since the directive was introduced, Sugester has enabled businesses to support the changes resulting from the legislation.

In this article, we show you how our CRM system meets GDPR requirements.

You'll find:

1. What data security and processing look like
2. How to collect and store data processing consents
3. How to "return" data to a client
4. How to store GDPR agreements in the system

What does data security and processing look like in Sugester?

Data security in systems such as a CRM is a top priority.

In Sugester, in addition to basic safeguards such as data encryption, account backup, event monitoring, and an SSL certificate for your own domain, you have features at your disposal that allow you to introduce additional security measures. These include:

• Permissions - which enable the creation of individual roles and granting an employee access only to the data they need to perform their duties
• Two-step login verification - requires logging into the Sugester system with a password and a unique code sent by email or SMS
• IP restriction - which allows login to the system only from a specific IP address, e.g., the office IP
• Application lock during inactivity - if the system detects no user activity within a specified time period
• Event monitoring - system activity logs allow tracking user actions, including the time and type of activities performed

More information about security and a detailed description of the listed features can be found in a separate article: 6 ways to secure data in your CRM system

How to collect and store data processing consents?

You can collect and store data processing consents in Sugester using our forms.

Simply add a "Consent to data processing" checkbox to, for example, a contact form or newsletter sign-up form.

How to do it?

1. Go to the Forms tab and create a form (by selecting a template from the list or adding fields to the form manually)
2. Once you've added all the necessary fields, click the +Radio Field button
3. In the gray Field Properties panel, clear the Options field and enter the name of your checkbox, e.g., "Consent to data processing"
4. If you want form data to create a client in CRM, expand More options in the form and in the Mapping type field select Client. Save the form
5. Now go to the CRM tab and create an additional field where consents from the form will be stored. To do this, go to the client list, expand the arrow next to the gear icon, and select Add custom field. Fill in the field name, e.g., "Consent," and save the changes.
6. Then return to the form, open it for editing, and click on the consent field so that the gray Field Properties panel reappears. Under Submission field, find on the list the custom field you just added in clients. Map the other form fields in the same way (if you have trouble, the article Advanced form configuration contains instructions on how to do it).
7. Finally, save the form

You'll find information about granted consents on the client card. And to make it easier to see which clients have given their consent and which haven't, in the display options check that the consent field is shown on the client list.

How to unsubscribe/subscribe to a mailing list?

If a client who once gave you consent, for example to receive a newsletter, decides they want to opt out, then - in accordance with GDPR principles - you must make it as easy for them to unsubscribe as it was to subscribe.

If you use mailing in Sugester, your task is made easier. Every mailing campaign sent through our system automatically includes an unsubscribe link. It allows clients to easily opt out, for example from a newsletter, simply by clicking the link in the message.

Our unsubscribe link has one more advantage. In addition to easily opting out of a campaign, the client also has the option to sign up for another campaign that interests them more thematically.

How? When creating recipient lists, use the list groups feature. If you're sending a campaign to a recipient list that belongs to a group, then when the recipient clicks the unsubscribe link they'll also see other lists within that group they can sign up for.

If the client themselves chooses what interests them and what content they want to receive, there's a much greater chance they'll respond positively to your next mailing.

How to "return" data to a client?

Because you're using a CRM system and have all client data in one application, you won't have any trouble "returning" data to your client if they request it.

Using the export features in Sugester, you can extract data from the system and share it with the client in xls and eml files.

The data you can export from Sugester includes:

• Client data
• Client emails
• Activities
• Deals
• Tasks

How to store GDPR agreements?

If you sign GDPR agreements with clients in electronic or even paper form, you can always upload a scan of such an agreement to the CRM.

The client profile has a separate Attachments section where you can add the documents you need.

1. Create a custom field

Start by adding a custom field where you'll store information about the signed agreement. This will not only help you organize information, but will make it easier to find clients who, for example, haven't signed the agreement yet.

1. Go to the client list and expand the arrow next to the gear icon, then select Add custom field
2. Fill in the field name, e.g., "Agreement"
3. In the Type field, select Checkbox
4. Save the changes

On the client card, in the Additional fields section, a new checkbox will appear.

2. Check the consent when adding documents

Every time you attach a file with the signed agreement to a client, also check the "Agreement" checkbox.

If you see "Yes" on the client list in the "Agreement" column, it means the checkbox is checked and the agreement is signed. "No" means the client has not yet signed the agreement.

3. Find clients without a signed agreement

If you manage agreements as described above, you can at any time easily find all clients who haven't signed an agreement with you and take further action.

You can search in 2 ways:

• By clicking twice on the "Agreement" header on the client list. This will sort the records on the list starting with those that have "no" in the "agreement" column.

• You can go to advanced search in clients and enter a simple search condition

"Agreement" < 1

In the search results you'll find all clients who haven't signed the agreement yet.

This method is better because you can save such a search as a filter, and then based on that filter create a recipient list to which you'll send a mailing reminding them to sign the agreement.

GDPR compliance of a CRM system is essential for maintaining personal data security and fulfilling European regulations.

Implementing appropriate GDPR-compliant security measures and procedures allows companies to effectively process client data while preventing potential legal violations.