GDPR Compliance Guide for Marketo Users

GDPRTHE MarketerAND THE

Table of Contents

Disclaimer 1

INTRODUCTION 2

Collecting Customer Personal Data to Maintain and Use 8

Collecting Customer Personal Data to Use for a Time-Limited Period

to Provide Access to a Resource 10

Collecting Customer Personal Data to Maintain and Use for Limited Purposes 14

Your Customer has Provided Consent in the Past, but Now Wishes to Withdraw Consent 17

Your Customer Wishes to Opt-Out of Marketo Tracking 20

Documenting Consent Provided Through Alternative Means 24

Disclaimer The European Union (EU) legislation discussed in this document, the General Data Protection Regulation (GDPR), is broad in scope

and compliance will vary greatly between organizations. Your own legal team will need to offer counsel as it relates to your

business. This document is provided for informational purposes. It should not be relied upon as legal advice Throughout this report

you will see customers referenced broadly, referring to B2B and B2C prospects, customers, or website visitors.

Introduction Background

The General Data Protection Regulation (GDPR)

is European Union legislation that will begin to

purpose can be summarized very simply:

protected. (‘Personal data’ means any

information that relates to an identified or

identifiable natural person).

To that end, the GDPR is structured around six key

principles (detailed in Article 5 of the legislation):

1 Transparency on how data will be used

and what it will be used for.

2 Ensuring that the data collected is used

only for the purposes explicitly specified

at the time of collection.

3 Limiting the data collection to what is

necessary to serve the purpose for which

it is collected.

4 Ensuring the data is accurate.

5 Storing the data for only as long as necessary

within its intended purpose.

6 Prevention against unauthorized use or

accidental loss of the data through the

deployment of appropriate security measures.

In addition, there is a new accountability

requirement to be able to demonstrate how

compliance with the principles is being managed

and tracked. This will mean maintaining records

of how and why personal data was collected as

well as the documentation of the processes put

in place to protect it.

The GDPR applies to any organization inside

or outside the EU who is marketing goods or

services to, and/or tracking the behaviors of,

data subjects within the EU and EEA. If you

Penalties for non-compliance are significant,

with large fines for those in breach of the

regulation: the maximum fine for a single breach

is €20 million or 4% of annual worldwide turnover,

whichever is greater.

Implications for Marketing As marketers, if we create customer experiences

that feel personal and human, that are founded

on trust and delivered with care, we will win their

hearts and minds.

Though the GDPR doesn’t use these terms our

goals are the same, namely to respect the rights

of our customers and go on to earn their trust.

To build and maintain that trust we, as marketers,

need to be attuned to the how, when, and why

our customers want to be engaged and respect

their preferences.

How we address these higher expectations

around the collection, use, and security of the

personal data that we routinely use in the course

of our work is key and Marketo can help you meet

those expectations.

There are two key aspects of the GDPR where

Marketing needs to review past, current, and

future practices. The first is consent by the

individual to process their personal data and the

second is accountability, namely being able to

demonstrate how they comply with the principles

of the GDPR.

“At Marketo, we believe there is a significant opportunity for marketing

to further ‘raise the bar’ on customer engagement. Ensuring the

protection of customer privacy is the foundation of this endeavor.”

Consent

“Affirmative consent put individuals in control, builds customer trust

and engagement, and upholds the principles of GDPR.”

The definition of consent under the GDPR is:

“any freely given, specific, informed and

unambiguous indication of the data subject’s

wishes by which he or she, by a statement or

by a clear affirmative action, signifies agreement

to the processing of personal data relating to

him or her”.

This dual need for an ‘affirmative action’ that

captures consent which also must be ‘specific’

in how the personal data will be used before

any processing of the data represents a significant

change for most marketers in how they record

and respect customer preferences.

Of course, customer preferences change over

time and rarely exist in perpetuity and GDPR has

something to say about this too—namely that

organizations, specifically marketing, must make

it easy for data subjects to make any changes in

preference or withdraw consent altogether.

All marketers need to audit, identify, and review

the current points at which they are collecting

personal data for processing.

• the identity and contact details of the

Controller and their representative to the

EU and DPO (if applicable),

• the purposes of the processing for which

the personal data are intended,

• the legal basis for processing,

• recipients or categories of recipients with

whom the data is shared,

• information on any international transfers,

• the period for which the personal data will

be stored or the criteria used to determine

the period,

• an explanation of an individual’s right to access

to, to rectification of, to erasure of, to objection

to the processing of and to restriction of the

processing of their Personal Data,

• if processing is based on consent, the right

to withdraw consent at any time,

• the right to lodge a complaint with a

supervisory authority,

• whether the provision of personal data is a

statutory or contractual requirement, or a

requirement necessary to enter into a contract,

as well as whether the data subject

is obliged to provide the personal data and of

the possible consequences of failure to provide

such data, and,

• the existence of automated decision-making,

including profiling, and meaningful information

about the logic involved, as well as the

significance and the envisaged consequences

of such processing for the data subject.

• Consent to Processing

• Consent Last Updated

• Consent Notes (purpose of processing

and history of consent provided should

be documented here)

This section of the document outlines the specific functionality and attributes within Marketo’s services

that help customers meet the consent requirements of the GDPR.

As a rule, your Marketo instance should contain the following necessary elements for consent

compliance from Article 13 that will be explained in more detail in this document:

Further we have identified the following six scenarios below based on our understanding of the GDPR:

1 Collecting customer Personal Data to maintain and use

2 Collecting customer Personal Data to use for a time limited period in order to provide access to a resource

3 Collecting customer Personal Data to maintain and use for limited purposes

4 An individual has provided consent in the past, but wishes to withdraw consent

5 An individual wishes to opt-out of Marketo tracking

6 Documenting consent provided through alternative means

Before we get into specific scenarios, Marketo advises the creation of at least 3 lead fields to facilitate consent compliance.

Consent to Processing: this value will contain ‘yes’ or ‘no’ based on consent given

Consent Notes: this value will contain any notes and should capture:

• The purpose of processing for which consent was obtained,

• The way in which consent was obtained (e.g. ticked box online, in person at event),

• Previous consent purposes

Compliance Scenario 1 COLLECTING CUSTOMER PERSONAL DATA TO MAINTAIN AND USE

Situation Below is an example Marketo Registration landing page for a webinar:

Collecting personal data to maintain and use is the broadest of the use cases.

This commonly takes place in the form of inserting a link to an applicable

privacy policy on or next to a form that the customer can set up and visitors can

access prior to sharing their details on the form.

In this specific example, a link to your privacy policy needs to be inserted in a rich text element on the

landing page that hosts the form.

Note: There are options in Marketo to add instructions/information about fields in a hover state. This gives you the option to provide further explanation should you feel it is necessary.

4 Add the privacy policy to the rich text element

5 Approve draft version of the landing page

This scenario enables you to capture your customer’s information having made your privacy policy

available to them, thereby informing their decision to share their personal data based upon how their

data will be used.

Compliance Scenario 2 COLLECTING CUSTOMER PERSONAL DATA TO USE FOR A

Note: The form should outline that the customer’s information will be entered into the database, but will be removed immediately after delivery of the desired content/event/etc.

Situation Below is a standard Registration Marketo landing page for a webinar:

Collecting personal data to use for a specific purpose (i.e. registering for an

event or access to a brochure) may become more commonplace given the

direction within GDPR to be more “specific and granular”.

This can be done by inserting a field on all your forms so your customers can

select their preference prior to sharing their details on the form. This form should

also still have your privacy policy accessible from it so that your customer can still

be aware of how their data will be used—even in a limited capacity.

Note: There are options in Marketo to add instructions to fields in a hover state. This makes it clear to the visitor what the options mean.

In this approach, it is completely automated. Often, this will require a wait step before the delete lead

flow so that the customer submitting the form is in the database long enough to receive the asset that

is being sent to them based on the form submission.

2 You then approve the landing page

Once the form is built and on the landing page, there is some additional work that needs to be done to

remove the lead. There are two ways we can remove someone, both options are explained below.

Neither is better or worse, it simply depends on your preference.

In this approach the process is less automated. Often times, things are unable to be completely

automated—for instance in the case of a webinar, you may well need to send reminders, confirmations,

etc. where a fully automated approach would have a negative impact on these communications because

the customer would be removed before they reived their confirmations and reminders.

This approach allows you to add the customer to a remove list, enabling you to remove them from the

database at a later date so that the customer’s lead record is preserved long enough for them to get the

relevant content. In either approach, the desired outcome is the same, however, in both cases—the lead

MUST enter the database.

One very important thing to note on this front is that you need to be aware that the customer will also no

longer receive operational emails. Operational emails are important for things like order confirmations. For

example, if an Amazon customer purchases something from Amazon and specifies that they want Amazon

to remove them and all activity, then they will not receive order updates, shipping confirmations, etc.—so it

is somewhat undesirable for both parties.

Note: This functionality relies on the same fields created in Scenario 1 and the Consent Last Updated trigger campaign.

Compliance Scenario 3 COLLECTING CUSTOMER PERSONAL DATA TO MAINTAIN AND USE FOR

Collecting personal data to maintain and use in a limited capacity takes place in

the form of a subscription center with a link to a privacy policy on a form that you

set up, and your customer can access prior to sharing their details on the form.

Subscription centers are extremely complex, so we will not go into all technical details about the

make up required for each smart campaign, form field, etc. Instead, we have outlined the three

necessary components:

1 Landing Page

2 Form

3 Subscription Center Program

The landing page will contain a section for each area/brand/product line about which a customer

could receive content. Below you will find Marketo’s subscription center. This is how we manage

customers’ subscription preferences. The screen shot below shows what the customers see and the

location where they can choose what content they would like to receive and the content from which

they would like to opt-out.

This is also where customers would go to completely opt-out of all communications from you

(see Compliance Scenario 4).

Note: This functionality relies on the same fields and Consent Last Updated trigger campaign created in Scenario 1.

With a Marketo subscription center like the one shown on the previous page, there is often a default

program with dozens of smart campaigns in the background maintaining all of these options for you

that can then be leveraged as qualification criteria for different categorizations of marketing programs

and campaigns. Below is a screen shot of Marketo’s subscriptions center management program.

Compliance Scenario 4 YOUR CUSTOMER HAS PROVIDED CONSENT IN THE PAST, BUT NOW

Honoring a request to stop sending correspondence to your customer typically

begins within a subscription center or on a form that you can set up using a

standard Marketo template. Here we’ll follow the subscription center method,

following on from Compliance Scenario 3.

Below you will find an example of a subscription center, Marketo’s. This is how we manage our

customers subscriptions based on their interests in content. This is also where our customers can

come to completely opt-out of all content that could be sent to a customer by Marketo:

With a Marketo subscription center, like the one shown above, there is often a default program in the

background maintaining all the options that the customer can leverage as qualification criteria for

different categorizations of marketing programs and campaigns. In this case, since we are solving for

your customer’s desire to completely remove themselves from the database, we are adding an additional

campaign to remove your customer from the company’s database based on this selection. There are

two ways we can remove your customer; neither is better or worse, it simply depends on your use case.

In this approach, it is completely automated and will remove your customer’s personal data and

activity immediately.

In this approach, it is not fully automated. This approach allows you to add your customer to a list so you

can then remove them from your database at a later date. The benefit to this approach is that you can

inspect your customers flagged for deletion before they are deleted.

In either approach, the desired outcome is the same; however, in this specific case, since the customer is

asking to be removed on the spot, it makes more sense to go the completely automated route.

Compliance Scenario 5 YOUR CUSTOMER WISHES TO OPT-OUT OF MARKETO TRACKING

Note: The ePrivacy Regulation governing cookies and other tracking technologies is still in draft form and should be monitored closely for further guidance.

Marketo primarily tracks two things on your website using Munchkin javascript. When your customer

lands on a webpage with Munchkin tracking code or a Marketo landing page then the following

is tracked:

This happens automatically unless you explicitly choose to acknowledge Do Not Track requests that

the user has set within their browser settings or you can offer them the ability to opt out of tracking

from their website.

Customers select the Do Not Track (DNT) feature in their browser (and the marketer honors the web

visitor’s request for Do Not Track).

Even if a customer doesn’t choose Do Not Track for all websites, you can offer them the ability to opt

out from a specific website.

To do this you add a link on the website to enable customers to opt out from Marketo tracking (normally

placed under Privacy Settings)

The customer clicks on the link on the privacy page that redirects them to a landing page containing the

opt out parameter (can be added to a Marketo landing page or a page with Munchkin tracking on):

Note: This currently only works on Munchkin versions 152 and above.

You can also integrate this into a broader solution you may have for your website to manage all cookies

present on your site. This has the advantage of creating a single positive experience for customers that

enables them to choose to opt-out of cookie tracking in a single place. Your solution would in turn call

our JavaScript Lead Tracking API and sets the cookieAnon property to false—which prevents the tracking

cookie of new anonymous leads. For existing leads you can use the same solution and choose to not

call munchkin,init() for this specific user which will also prevent web activity from being tracked. This

approach is more complex but offers more flexibility and the ability to create a branded, personalized

user experience.

This is achieved via a Marketo API endpoint that you can call to get this functionality or as part of a custom

set-up you can call our Munchkin API to stop tracking. If you would like assistance implementing a custom

solution, ask your Account Executive about Marketo’s professional services offerings.

We place a mkto_opt_out cookie on the browser which tells Munchkin to no longer track the user

for that website. (See example of the cookie below).

Compliance Scenario 6 DOCUMENTING CONSENT PROVIDED THROUGH ALTERNATIVE MEANS

There are several ways customers can provide or revoke consent without using the subscription center.

This can be accomplished:

• By providing verbal consent to their account executive over the phone

• By sending an email containing an affirmative opt in statement to marketing or another point of

contact within the organization

• Or by providing verbal consent or a physical copy of contact details (such as a business card) in person,

i.e., during a live marketing event

The key in these situations is documenting how consent was communicated as well as when and for

what purpose. Each of these methods can be used to revoke consent as well, but it is important to

remember that GDPR requires all consent to be obtained on an opt-in basis and no functionality should

be by default, regardless of whether an opt-out function exists.

We recommend having smart campaigns set up for each of the scenarios listed above as part of a

consent operational program. The operational program should have two campaigns set up for each

scenario, one campaign to set the actual consent value on the lead record and one campaign set up to

time stamp when the GDPR field on the lead record was updated:

The first thing to point out is the campaign called Consent Last Updated. This is a trigger campaign that

will automatically update the Consent Last Updated field with the date and time of the last time the

Consent field was changed.

Verbal Consent = Yes and Verbal Consent = No are the names of smart campaigns that allow customer

personnel using their CRM to set the data subject’s consent to “Yes” or the data subject will be removed

from the database.

This can be accomplished by choosing:

2 Choosing the Verbal Consent = No

If the option chosen is Verbal Consent = Yes, that person will be updated to reflect that consent is

“Yes” and the date and time will be set to the date and time of the campaign initiation. If the option

chosen is Verbal Consent = No, that person will then be removed from the database.

Email Consent = Yes and Email Consent = No are the names of smart campaigns that allow customer

personnel using their CRM to set the data subject’s consent to “Yes” or the data subject will be removed

from the database.

This can be accomplished by choosing:

If the campaign chosen is Email Consent = Yes, that person/lead record will be updated to reflect

that consent is “yes” and the date and time will be set to the date and time of the campaign initiation.

If the option chosen is Email Consent = No, that person will then be removed from the database.

When importing a list of people (from collected business cards or some other method of obtaining

contact info), the customer must include the consent field that will be updated with the import.

This can be accomplished by:

Each person on this list will be updated to reflect that consent is “yes”. This option requires one

additional step. The Consent Last Updated trigger campaign will not “trigger” during list uploads for new

leads. This means the user must run a batch campaign against their list.

This can be done by:

Accountability

The most significant addition to current legislation under the GDPR is the accountability principle.

The GDPR requires you to show how you comply with the principles—for example, by documenting the

decisions you make about a processing activity.

Within Marketo there are several administrative features that enable you to take a measured approach to

who has access to personal data and resources, as well as a clear audit trail of changes and who made

those changes. This ability to set fine grained access forms an important part of demonstrating

compliance with the data protection principles.

Below is a summary of the key features available to you within Marketo that will assist with meeting the

accountability principle requirements as part of your GDPR compliance plan.

Marketo provides several built-in roles, each with different permissions:

Admin: All parts of the application, including the Admin section

Standard User: All parts of the application, except the Admin section

Marketing User: All parts of the application, some limited access to the Admin section (can view roles

and users)

Web Designer: Only access to the Design Studio

Analytics User: Only access to the Analytics section

Beyond these standard roles, it is possible to create custom roles to reflect your own policies and role types.

In general, administrative access should be limited and there should be a clear policy and defined process

around the granting of roles and permissions. Regular review of who has which access rights within Marketo

for consistency with policy is an important piece of a well-functioning role-based access control.

As Administrator, you can create roles. You do this in the Admin section by going to the User & Roles section where you select “Create New Role” and assign permissions.

Once the role has been created, from within the Admin section go to the Users section and

Workspaces are separate areas in Marketo that can be used to limit access to marketing assets like

programs, landing pages, emails and audience segments within your customer database.

• Assets can be shared and copied between workspaces where permission has been granted

by the Admin.

• Which user has access to which workspaces (they can have access to one or more) is set

by the Admin.

Partitions, or Person Partitions to give them their full title, act like separate databases. Each partition has

its own customer records that do not de-dupe or mix with other partitions. You would typically use a

partition where there is a business need to separate marketing assets and customer records. For

example, in Financial Services it is necessary to prevent information obtained whilst acting for one client

passing to another client of the same firm. Separating customer records and restricting access may be

necessary as part of the general procedures to prevent that happening.

The Audit Trail gives you the ability to obtain a complete history (six months’ worth) of changes made

within your Marketo instance by your Marketo users. If your business requires the retention of a longer

history of activity, then the audit trail can be exported for archival.

Audit Trail captures, in real-time, a comprehensive list of actions and events occurring within a

Marketo subscription:

• The history of an asset or setting, and who last updated it,

• To ability view a specific user’s activity history,

• The ability to check who has attempted to and successfully logged into your Marketo instance.

By default, Marketo implements suitable measures to prevent personal data from being read, copied,

altered or deleted by unauthorized parties during transmission, applying high grade TLS encryption to

all data-in-transit through the use of HTTPS connections to all Marketo instances. In addition, customers

have the option to add encryption to data at-rest by storing their data on AES-256 encrypted hardware.

Encryption at-rest provides a further safeguard in the case of a data breach, as any data stolen would be

illegible and unusable.

Smart Lists allow you to find specific groups of people using simple filters. They are used throughout

Marketo and membership adjusts dynamically based on defined rules: when a data subject meets the

criteria defined by the rules, the data subject is included in that Smart List.

Marketo has a number of built-in System Smart Lists that help with data management.

All People All people in your Marketo database

These people have unsubscribed from marketing-

related correspondence and can only be sent

operational emails; this is usually controlled by the

people themselves.

These people have temporarily suspended marketing-

related correspondence and can only be sent

operational emails for a period of time; this is usually

controlled by you, the marketer.

Blacklist These people will not receive any email at all.

Bounced Email Address People with an undeliverable email address or that reject

your email.

Possible Duplicates People that might be duplicated in the Marketo

database.

Under the GDPR, individuals have the right to obtain confirmation that their data is being processed by

an organization and, where this is the case, to access their personal data and other supplementary

information as listed in GDPR Article 15.

As the Data Controller, you must typically respond to these requests within a month.

This will export all of the fields and values in those fields for the person. This includes things like

company, email, job title, address, etc.

Now you need to get their activity. The Activity Log is the complete history of a person’s journey in

Marketo and contains all tracking information for them over time.

Having completed these two tasks, you have exported all activity and all lead attributes for this person to

two CSV files. You, as the Controller, can use these files to provide a copy of the personal data

undergoing processing within Marketo to the data subject.

Conclusion As an enthusiastic advocate of the power and customer-centricity of the engagement economy, Marketo understands the importance of putting privacy and data protection in the hands of the data subject. As with other data protection laws, GDPR compliance requires commitment from both Marketo and our customers. This document is intended to help you use Marketo in an appropriate way to support your organization’s GDPR compliance.

We will continue to closely track applicable GDPR guidance issued by regulatory authorities and related legislation. Updates will be posted to our Trust Center at trust.marketo.com.

Glossary Customer

The entity that receives a subscription to the Services.

Any data, information or material originated by Customer that Customer submits, collects

or provides while using the Services, including any Personal Data or PHI.

The natural or legal person, public authority, agency or other body which, alone or jointly with others,

determines the purposes and means of the processing of personal data

Means a natural or legal person, public authority, agency or other body which processes personal data

on behalf of the controller.

Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable

natural person is one who can be identified, directly or indirectly, in particular by reference to an

identifier such as a name, an identification number, location data, an online identifier or to one or

more factors specific to the physical, physiological, genetic, mental, economic, cultural or social

identity of that natural person;

A legal framework that sets guidelines for the collection and processing of personal information

of individuals within the European Union (EU) that goes into force on May 25, 2018. The text of the

regulation can be found here.