Privacy and the GDPR
My commitment to the GDPR
Tracking and email marketing involve personal data. So respecting the GDPR is part of every configuration I build, not a separate step.
In short
This page explains how I handle the data of the stores I work with and how I set up consent, tracking and email in line with the GDPR. I work with minimal access, accounts in the client's name and data processing agreements whenever I process personal data. I handle the technical side; final legal sign-off should come from a lawyer.
Why it matters
An online shop collects visitor and customer data with every visit, order and sign-up. The GDPR sets out how that data may be collected, used and stored, and in Portugal the supervisory authority is the CNPD.
Beyond the legal duty, handling data properly protects customer trust and the quality of your measurement.
How I handle store data
Principles I apply on every project.
Minimal access
I only ask for the access each task needs, ideally read-only, and in my own name so it can be revoked.
Client-owned accounts
GA4, Google Tag Manager, email platforms and consent tools always sit in the store's accounts, never mine.
Data processing agreement
When I process personal data on the store's behalf, we sign an agreement covering purposes, security and retention.
Data minimisation
I avoid exporting customer lists or personal data outside the tools unless it is strictly necessary.
What I set up on stores
On the technical side, these are the points I cover in a consent and privacy project.
- A consent platform with clear options to accept, reject and customise
- Google Consent Mode v2 aligned with each visitor's choices
- Tags and pixels held back until consent is given for their category
- Separate consent for email and SMS on sign-up forms
- A record of the date and source of every marketing consent
- A review of every tool that receives personal data from the store
The limits of my role
I am a marketing and tracking consultant, not a lawyer. I configure the technical side in line with good practice and platform requirements, but your privacy policy, cookie policy and the legal basis for each type of processing should be checked by a legal professional.
Questions about consent on your store
Book a call and we'll review the state of consent and tracking on your store together.