The General Data Protection Regulation (GDPR) is a regulation in European law on data protection and privacy for all European Union individuals. It also addresses the export of personal data outside the EU. The GDPR aims primarily to give control to citizens and residents over their data and to simplify the regulatory environment for international business by unifying the regulation within the EU.
This regulation becomes enforceable on 01st June 2021. The GDPR makes many privacy-related regulations more clearly defined and requires many companies to pay close attention to this.
Should My Marketplace Be GDPR-Compliant?
If you have visitors and members in the European Union, yes. And even if you don't, it's probably a good idea to follow this regulation, at least right now.
What Should I Do To Be GDPR-Compliant?
There are a few things to consider, and we've shared them below to the best of our current knowledge.
Remember That Users Control Their Data
As marketplace admin, you'll need to be able to offer your users the rights that the GDPR requires, which include the possibility to see the data about them and correct it if needed and also request to "be forgotten," which means that the personal data should be deleted or anonymized to the extent possible.
It means that you can request a full database export from us at any time to see what is stored and to share parts of that data with your users if needed.
The easiest way to get user data deleted is for the user to log in to their account and delete their profile via account settings. It's important to note that while identifying data is deleted, some content may remain. For example, messages related to transactions might include important details vital to the other parties of the transactions, so they still have access to those messages they received, but they only see a "deleted user" as the sender data is anonymized in that sense.
Ask, During Signup, For Consent From Members To Receive Emails From Administrators
When users sign up for your marketplace, they have to give unambiguous consent that they agree to receive occasional messages from you.
If they want to hear from you, they have to check that “I agree with the terms and use Terms & Conditions and Privacy Policy”.
Update Your Terms Of Use And Privacy Policy
It's a good idea to update your Terms of Use and Privacy policy to ensure that they are GDPR compliant.
It's also a good idea to mention QMarket as one of the services used in your project, as members' data is stored at QMarket.