Skip to content
Leat Help Center

GDPR and your contacts: what you're responsible for, and how Leat helps

Under the GDPR, you're the controller of your contacts' data: you decide what you collect, why you collect it, and what you send your contacts. Leat is your processor: we store and process that data for you, and only for you. So making sure your loyalty program and your marketing follow the GDPR is your responsibility.

What Leat does is make the right way the easy way. Marketing only reaches contacts who said yes, every marketing email has a way out, and contacts who report spam are unsubscribed. This article lists what's in place and what's still up to you. It isn't legal advice: if you're unsure what applies to your business, ask a privacy lawyer.

Who's responsible for what

You, as the controller:

  • Having a legal basis for the data you collect, such as your contacts' consent.
  • Telling contacts what you do with their data, in your own privacy statement.
  • Only sending marketing to contacts who agreed to it, and stopping when they object.
  • Answering contacts who ask to see, correct or delete their data.

Leat, as the processor:

  • Only processing your contacts' data on your behalf, never for our own purposes.
  • Telling you about a data breach within 48 hours of discovering it.
  • Passing on any request from one of your contacts that reaches us, within a week.
  • Deleting or returning your data when your contract ends.

This is set out in our data processing agreement.

Marketing only goes to contacts who said yes

Every campaign, automated email and recurring email belongs to a subscription type, and only reaches the contacts subscribed to it. A new account's Marketing subscription type uses the Opt-In strategy: contacts start out unsubscribed and are only mailed once they subscribe, for example with the marketing opt-in on a form.

If you want proof that every subscriber really asked for it, use the Double opt-in strategy. Subscribing then sends the contact an email with a link to confirm, and they aren't mailed until they do. See Subscription types: choosing a strategy, and what the details page shows.

Every marketing email has a way out

If you override these safeguards, that's on you

The safeguards above are defaults, not locks. Leat lets you change them, because sometimes you have a good reason, like consent you recorded somewhere else. When you do, the responsibility for it is yours. For example:

  • Subscribing contacts in bulk. A Marketing import subscribes everyone in your file, including contacts who unsubscribed themselves. See Subscribing many contacts to marketing at once, and when you shouldn't.
  • Using the Opt-Out strategy. It subscribes every new contact automatically, without asking them.
  • Switching off the unsubscribe after a spam report. Contacts who reported your email as spam then keep receiving it.

Leat can't check whether a contact actually agreed. Only do these things for contacts you know said yes, and keep a record of it.

When a contact asks about their data

  • To see their data. Open the contact, click Data in the sidebar, open the actions menu (the three dots) and choose Export personal data. Confirm with Export. This creates a file with all personal data stored about the contact, and you land on the export's page, where you click Download once it's ready. Only share the file with the contact themselves.
  • To correct their data. Edit their profile on the same Data page. See Adding a contact by hand.
  • To stop marketing. Unsubscribe them on their profile: click Marketing in the sidebar and use the Subscriptions tab.
  • To be deleted. Delete the contact. This removes them and everything linked to them for good. See How to delete a contact.

The rules themselves

Back to the help center