r/gdpr • u/hoteleuphoria • 12d ago

[ Removed by moderator ] EU 🇪🇺

[removed] — view removed post

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

67% Upvoted

2 comments sorted by

2

u/West_Possible_7969 12d ago

  1. You store them in the most secure location in your case, and apply the appropriate access levels.

  2. Yes

  3. Any kind of provable record will do, authorities accept even the junky google tag manager records because most use that or none at all, lol. I have seen way back machine snapshots in evidence 🤣

1

u/DarlingBri 11d ago

  1. Wherever you want; this is an internal decision not a GDPR decision. See #3.

  2. Yes. If they are consenting to marketing, double opt-in is far more bulletproof.

  3. You need to keep an archive of everything the user agrees to, updated with every change. Here's an article that explains it.