On May 21, 2018, at 2:46 PM, Justin J justin@PROTECTED [Dada Mail Developers] <dadadev@PROTECTED> wrote:

From: justin@PROTECTED

From: maryann@PROTECTED
Thanks for all your work on this, Justin.

Sure. I appreciate everyone's feedback.

For those who are not requesting fresh consent and instead relying on legitimate interests as the legal basis for contact, upgrading will not affect our ability to mail to addresses already in the list under the version, right?

That would be a question you'll have to ask yourself, honestly. If you're not sure, I would do a consultation with a lawyer. Personally, I think having someone do a closed-loop opt-in goes a long way in establishing consent. But, IANAL.

I’m envisioning that everything with the current subscribers will remain the same,

It will remain the same - meaning any history of subscribing will be in that one log file (.dada_files/.logs/dada.txt). There is a migration script to move some of that data into the new system.

but new subscribers will have all of the new info paired with their subscription in the database.

That part is true.

Also, what will happen with our existing subscription forms from the time we update dada until we revise the custom forms on our websites with what I assume will be new custom HTML forms? Will they still process subscriptions in the same way they always have, or do we need to remove them before we upgrade?

Subscription forms will continue to function, until the time you add points you would like your users to consent to. Then, your old forms, since they don't have those points to consent to, will not allow a subscription and will need to be updated.

Those points of consent are also completely optional. If you do not add any, the subscription form will be exactly the same.

I’m assuming that this is just a warning to list owners that users will not be agreeing to the new policy (and that the policy they previously agreed to is the one that will still be on record), not that they will be removed or not included in mailings if the policy changes. Please correct me if I’m wrong.

Correct. No one will be removed from any of the mailing lists administrated by Dada Mail, if you upgrade to v11, for any reason.

Under GDPR, if we are using consent as the legal basis of processing data (not all of us are) we are required to obtain consent for mailing, but a change in privacy policy doesn’t require new consent - just a notification with the opportunity to opt out/unsubscribe. The consent is for what we are mailing them and the privacy policy is for how we are handling the data. There is a relationship between the two, but privacy policies don’t require consent, just notification. I am assuming that you know this and that is how it is going to work, but I want to be absolutely sure I am understanding the new version correctly before upgrading.

The only thing I'll add is, if you DO update your privacy policy, you'll have to notify your subscribers manually. there's nothing in Dada Mail that will do that notification automatically.

What Dada Mail WILL do is continue to keep a record of the old privacy policy you had, and allow you to reference which version was used at the time of subscription. The latest privacy policy will be the one that's always shown publicly.

One thing that I hope you will consider is adding an internal profile field that is only visible to the list owner and not the subscriber. Since you are dropping of all profile data when subscribers are invited to give new consent, there might be information that the list owner wants to port with that profile that doesn’t contain personal data held on the legal basis of consent.  

Not sure how I want to handle that yet, good point. At the moment, I want to keep it simple. But, Profile Fields *should* have the ability to be hidden from subscribers - just prepend the field name with, "_" ?