The business that markets to people is the controller for its lists. A service like Robinsontjek that checks the lists on your behalf is a processor and may only use the data on your instructions. That takes a data processing agreement. In a chain of call centre and Danish client, the client is the controller and the call centre is the client's processor.
The business that markets to people is the controller for its lists. A service like Robinsontjek that checks the lists on your behalf is a processor and may only use the data on your instructions. That takes a data processing agreement, and you need to be able to show you have it in order.
Two sets of rules that meet
The Robinson list and the GDPR are about two different things:
- The Robinson list is about whom you may contact with marketing. The rules are in the Marketing Practices Act and the CPR Act.
- The GDPR is about how you handle personal data, including your lists.
They meet because checking a list against the Robinson list is processing of personal data. When you send a list of names and addresses to a supplier, that processing must be in order too.
The CPR Act links the two itself: a marker saying a person doesn't want marketing gives protection both under the Marketing Practices Act and under Article 21 of the GDPR, the right to object to direct marketing (CPR Act s. 29(2)).
Who is what?
Datatilsynet, the Danish data protection authority, describes the roles like this: the controller decides the purposes and means of the processing, while the processor only processes the data on the controller's instructions (Datatilsynet).
In practice:
| Party | Role | Why |
|---|---|---|
| You, who send the campaign | Controller | You decide who is contacted and why |
| Robinsontjek | Processor | We check the list because you ask us to, and use it for nothing else |
| Our hosting supplier | Subprocessor | Runs the servers we use |
When there are several links
If you are a call centre, a print house or an agency working for a client, the chain typically looks like this:
- The client is the controller.
- You are the client's processor.
- Robinsontjek is your subprocessor.
That requires your contract with the client to allow subprocessors, and our data processing agreement to fit into the chain. It does.
What you need in place as a controller
- A data processing agreement with every supplier that processes your lists. Datatilsynet stresses that the agreement is not enough on its own: you must also supervise that the processor complies.
- No other use of the data. The supplier may not use your lists for its own purposes, for example to build its own lists or sell data on.
- Deletion. Data must be deleted when it is no longer needed for the purpose.
- Security. Encryption, access control and logging.
- Location. Transfers outside the EU are subject to special rules. It is easiest if the data stays in the EU.
- Breaches. As controller you must report personal data breaches to the supervisory authority within 72 hours (Datatilsynet). That is why your processor must tell you quickly.
Send only what is needed
A Robinson list check needs a name and an address. It doesn't need national ID numbers, phone numbers, purchase history or notes from the CRM. Send only the columns that are needed. That is data minimisation, and it makes your own documentation simpler.
How Robinsontjek does it
- We are a processor, with a data processing agreement that is accepted in the app after you have an account.
- We use your lists only to check them.
- Your lists are checked and stored on servers in the EU. Our subprocessors, and where they process data, are listed in the data processing agreement.
- Files and names are deleted automatically after 30 days, or after the number of days you choose between 0 and 90.
- We don't ask for national ID numbers.
- If a breach affects your data, you are told within 24 hours of us discovering it.
Read more on the security page.
Questions and answers
May we use the Robinson list for anything other than sorting our lists?
The list may not be passed on to others or published (CPR Act s. 40(5)). Use it only for what it is for: finding out whom you may not contact with marketing.
Should we tell consumers that we check the Robinson list?
The check is part of your processing of personal data for marketing. It belongs in your privacy notice, where you describe purposes and processors.
Does it matter that we are outside Denmark?
Your Danish client will ask where the data is processed and who sees it. Ours stays on servers in the EU, with a data processing agreement written to fit into a chain of client, call centre and us. See The Danish Robinson list explained for call centres.
Write to us and we'll send the data processing agreement before you decide.
