Difference between revisions of "ATC/Current/AdminGuide/GDPR"

Latest revision as of 21:28, November 9, 2021

This topic is part of the manual Genesys Predictive Engagement Administrator's Guide for version Current of Genesys Predictive Engagement.

This article only applies to customers using web chat. If you are a Genesys Cloud CX customer, we encourage you to use the new web messaging feature to replace web chat. For web messaging, tracking starts as soon as you deploy Genesys Messenger to your web site. Deployment implies acknowledgment that you are aware of the implications of capturing data.

GDPR compliance

As part of the Genesys Cloud CX platform, Genesys Predictive Engagement complies with GDPR regulations. For more information about Genesys Cloud CX and GDPR, see Genesys Cloud CX and GDPR compliance.

Genesys Cloud CX provides a GDPR API. The GDPR API is the preferred self-service solution for Genesys Cloud CX customers to respond to GDPR requests. The GDPR API enables responses to data subject requests to access, rectify, or delete their personal data in Genesys Cloud CX.

Genesys Predictive Engagement considerations

For the purposes of GDPR compliance, Genesys is a data processor on behalf of customers who use the Genesys Predictive Engagement product. You, our customers, are the data controllers of the personal data that you collect from your end customers, the data subjects. This article describes how to adhere to GDPR consent requirements, should you identify consent as the most appropriate lawful basis for processing personal data. Note that there is no ‘right’ or ‘wrong’ lawful basis for processing personal data; the GDPR requires that data controllers consider the most appropriate lawful basis. For more information about what to consider when determining the most appropriate lawful basis, see Lawful basis interactive guidance tool.

Genesys Predictive Engagement collects data about visitors' activities on business websites. It uses machine learning and AI to analyze customer-generated events (page views, searches, form-fills, and chats) to determine the probability of a specific customer achieving a specific outcome. An outcome is an event the business wants to maximize or minimize. Example outcomes are making a purchase, signing up for a webinar, or filling out a complex form online. For more information about how Genesys Predictive Engagement uses cookies to track visitor activity on websites, see Cookies.

Businesses use end-customer data that Genesys Predictive Engagement collects for three primary purposes:

Customer support - proactive or AI-driven engagement through chat and callback offers;
Sales engagement - proactive or AI engagement through chat, callbacks, and content offers;
Marketing - proactive or AI; for example, sign-up for an event or webinar through a content offer.

If you are still unsure whether you should obtain the data subject's consent to process their personal data, consult your legal advisor.

Important

Genesys does not pass end-customer personal data processed through Genesys Predictive Engagement to any advertising or re-targeting companies. End-customer personal data processed through Genesys Predictive Engagement may be shared with business-integrated tools such as Salesforce and Marketo. Sharing only happens when one of our business customers configures that behavior for their organization.

Conditions for consent

If you identified consent as the most appropriate lawful basis for processing end customer personal data, then the following conditions should be met when obtaining consent:

You must be able to demonstrate that the data subject has consented to processing of his or her personal data. That means you should maintain a record or audit trail of consent being given.

If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

When assessing whether consent is freely given, utmost account shall be taken of whether, among other things, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

If you identified consent as the most appropriate lawful basis for processing end customer personal data, consider what consent was given before calling the following functions:

ac('init',...) starts Genesys Predictive Engagement tracking on your website
ac('record',...) allows Genesys Predictive Engagement tracking of custom visitor actions on your website
ac('identify',...), is used to identify visitors

For more information about these functions and others where you might need to consider consent, see Tracking with Predictive Engagement.

Important

If you require consent to be GDPR-compliant, obtain that consent before passing any personally identifiable data to Genesys Predictive Engagement.

Stop tracking

For more information about how to stop tracking when a visitor revokes consent, see Stop tracking if a customer revokes consent.

@@ Line 1: / Line 1: @@
-{{ArticleUnstructured
+{{Article
-|DisplayName=GDPR
+|Standalone=No
-|Platform=PureEngage, PureConnect, PureCloud
+|DisplayName=General Data Protection Regulation (GDPR)
+|TocName=General Data Protection Regulation
+|Context=Learn how to use {{MINTYDOCSPRODUCT}} in a GDPR-compliant way.
 |Dimension=Compliance
-|Context=Altocloud is compliant with GDPR.
+|ComingSoon=No
-}}
+|Platform=PureConnect, GenesysCloud, GenesysEngage-cloud
-==Altocloud and GDPR==
+|Section={{Section
-For the purposes of GDPR compliance, Altocloud is a Data Processor on behalf of our customers. Our customers are the Data Controllers of the personally identifiable data they collect from their end customers, the Data Subjects. This article describes how to adhere to GDPR consent requirements, should consent be necessary. To determine whether you need to obtain your end-customers' consent to collect their personally identifiable data, consult your legal advisor.
+|alignment=Vertical
+|structuredtext={{NoteFormat|This article only applies to customers using {{Link-SomewhereInThisVersion|manual=AdminGuide|topic=About_web_chats|display text=web chat}}. If you are a Genesys Cloud CX customer, we encourage you to use the new {{Link-AnywhereElse|product=ATC|version=Current|manual=AdminGuide|topic=About_web_messaging|display text=web messaging}} feature to replace web chat.
-{{NoteFormat|Be sure you understand the steps you need to take before you collect, process, or store your end-customers' personally identifiable data.|1}}
+For web messaging, tracking starts as soon as you deploy Genesys Messenger to your web site. Deployment implies acknowledgment that you are aware of the implications of capturing data.|}}
+|Status=No
+}}{{Section
+|sectionHeading=GDPR compliance
+|alignment=Vertical
+|structuredtext=As part of the Genesys Cloud CX platform, Genesys Predictive Engagement complies with GDPR regulations. For more information about Genesys Cloud CX and GDPR, see [https://help.mypurecloud.com/articles/?p=161527 Genesys Cloud CX and GDPR compliance].
-Altocloud collects data about visitors' activities on business websites. We use machine learning and AI to analyze customer-generated events (page views, searches, form-fills, and chat) to determine the probability of a specific customer achieving a specific outcome. An outcome is an event the business wants to maximize or minimize. Example outcomes are making a purchase, signing up for a webinar, or filling a complex form online. For information about how Altocloud uses cookies to track visitor activity on websites, see ''How Altocloud uses cookies to identify visitors'' in the {{#mintydocs_link:manual=Developers|topic=Tracking_code}} article.
+Genesys Cloud CX provides a [https://developer.genesys.cloud/api/rest/v2/generaldataprotectionregulation/index.html GDPR API]. The GDPR API is the preferred self-service solution for Genesys Cloud CX customers to respond to GDPR requests. The GDPR API enables responses to data subject requests to access, rectify, or delete their personal data in Genesys Cloud CX.
+|Status=No
+}}{{Section
+|sectionHeading=Genesys Predictive Engagement considerations
+|alignment=Vertical
+|structuredtext=For the purposes of GDPR compliance, Genesys is a data processor on behalf of customers who use the Genesys Predictive Engagement product. You, our customers, are the data controllers of the personal data that you collect from your end customers, the data subjects. This article describes how to adhere to GDPR consent requirements, should you identify consent as the most appropriate lawful basis for processing personal data. Note that there is no ‘right’ or ‘wrong’ lawful basis for processing personal data; the GDPR requires that data controllers consider the most appropriate lawful basis. For more information about what to consider when determining the most appropriate lawful basis, see [https://ico.org.uk/for-organisations/gdpr-resources/lawful-basis-interactive-guidance-tool/ Lawful basis interactive guidance tool].
-{{NoteFormat|Altocloud does not pass end-customer data to any advertising or re-targeting companies. Altocloud passes end-customer data to business-integrated tools such as Salesforce, Marketo, and so on '''only''' when one of our business customers configures that behavior for their organization.|1}}
+Genesys Predictive Engagement collects data about visitors' activities on business websites. It uses machine learning and AI to analyze customer-generated events (page views, searches, form-fills, and chats) to determine the probability of a specific customer achieving a specific outcome. An outcome is an event the business wants to maximize or minimize. Example outcomes are making a purchase, signing up for a webinar, or filling out a complex form online. For more information about how Genesys Predictive Engagement uses cookies to track visitor activity on websites, see {{Link-SomewhereInThisVersion|manual=SDK|topic=Cookie_usage|display text=Cookies}}.
-Businesses use end-customer data that Altocloud collects for three primary purposes:
+Businesses use end-customer data that Genesys Predictive Engagement collects for three primary purposes:
-* Customer support - proactive or AI-driven engagement via chat and callback offers
-* Sales engagement -  proactive or AI engagement via chat, callbacks, and content offers
-* Marketing - proactive or AI; for example, sign-up for an event or webinar via content offer
-You may have additional legitimate bases for collecting, storing, and processing end-customer data. Customer support or sales engagement use cases are typically legitimate. Marketing use cases do not typically qualify as applicable, legitimate interests for collecting personally identifiable data. Consult the appropriate legal sources to determine the applicable bases for collecting personally identifiable data as per your business model.
+*Customer support - proactive or AI-driven engagement through chat and callback offers;
+*Sales engagement - proactive or AI engagement through chat, callbacks, and content offers;
+*Marketing - proactive or AI; for example, sign-up for an event or webinar through a content offer.
-==Implement consent for tracking visitors on your website==
+If you are still unsure whether you should obtain the data subject's consent to process their personal data, consult your legal advisor.{{NoteFormat|Genesys does not pass end-customer personal data processed through Genesys Predictive Engagement to any advertising or re-targeting companies. End-customer personal data processed through Genesys Predictive Engagement may be shared with business-integrated tools such as Salesforce and Marketo. Sharing only happens when one of our business customers configures that behavior for their organization.|}}
-Work with your legal counsel to determine whether you need explicit consent to track visitors on your website. If you need explicit consent, see ''Obtain consent'' in the  {{#mintydocs_link:manual=Developers|topic=Tracking_code|}} article.
+|Status=No
+}}{{Section
+|sectionHeading=Conditions for consent
+|alignment=Vertical
+|structuredtext=If you identified consent as the most appropriate lawful basis for processing end customer personal data, then the following conditions should be met when obtaining consent:
-{{NoteFormat|Be sure to state on your user interface why you require consent.|1}}
+*You must be able to demonstrate that the data subject has consented to processing of his or her personal data. That means you should maintain a record or audit trail of consent being given.
-The <tt>ac('init',...)</tt> function starts Altocloud's tracking on your website. Call this function only after you receive explicit consent.
+*If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.
-==Implement consent for form-fill data on your website==
+*The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
-Work with your legal counsel to determine whether you need explicit consent to collect form data. To obtain consent for collecting personally identifiable data via a form submit action, include a checkbox with a label such as the following on your website:
-*I agree or disagree to allow ''the business''  to use this data for ''purpose''.
-Also:
+*When assessing whether consent is freely given, utmost account shall be taken of whether, among other things, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
-*Enable the form's Submit button only after the visitor has selected the checkbox.
-*When the visitor clicks the Submit button, call the <tt>ac('record',...)</tt> function to pass the visitor's data to Altocloud.
-*Whenever you call <tt>ac('identify',...)</tt>, consider whether you need to obtain consent.
-For more information about these functions, see {{#mintydocs_link:manual=Developers|topic=Tracking_code}}.
-{{NoteFormat|If you require consent to be GDPR-compliant, obtain that consent before passing any personally identifiable data to Altocloud.|1}}
+If you identified consent as the most appropriate lawful basis for processing end customer personal data, consider what consent was given before calling the following functions:
-==Implement a chat consent==
+*<code>ac('init',...)</code> starts Genesys Predictive Engagement tracking on your website
-Using the Genesys Altocloud Chat functionality provides a way to interact with visitors on the site but also stores the message history, including any PII data provided during the interaction.
+*<code>ac('record',...)</code> allows Genesys Predictive Engagement tracking of custom visitor actions on your website
-If you collect PII via a pre-chat survey or during chat conversations, existing Action Maps then based on your business and legal assessment of the purpose for which the data will be used, you may need to enable the "Consent for Chat " option.
+*<code>ac('identify',...),</code> is used to identify visitors
-To add a "Consent" checkbox to existing or new chat action Maps:
+For more information about these functions and others where you might need to consider consent, see {{Link-SomewhereInThisVersion|manual=AdminGuide|topic=Tracking_snippet|display text=Tracking with Predictive Engagement}}.{{NoteFormat|If you require consent to be GDPR-compliant, obtain that consent before passing any personally identifiable data to Genesys Predictive Engagement.|}}
-# Go to Journey Shaping-> Action Maps menu
+|Status=No
-# Select the Action Map you would like to edit
+}}{{Section
-# Scroll down to the Design menu
+|sectionHeading=Stop tracking
-# Select the Chat Window option
+|alignment=Vertical
-# Tick the "Add consent message for EU GDPR compliance" option
+|structuredtext=For more information about how to stop tracking when a visitor revokes consent, see {{Link-SomewhereInThisVersion|manual=SDK|topic=Web_tracking_API|anchor=StopTracking|display text=Stop tracking if a customer revokes consent.}}
-# Enter the text for the Consent in in the input field "Consent Message Text"
+|FAQHeading=How to stop tracking if a visitor revokes consent
+|Status=No
-Suggested text for this consent is:
+}}
-*I agree to allow ''Business name'' to store and process the contents of this chat for the purposes of ''purpose''.
+}}
-{{NoteFormat|Where Chat consent is enabled, visitors will not be able to start the interaction unless the consent checkbox is checked. If checked, the consent will be captured in the message history when submitted. }}
-==Make a "Right to be forgotten" request==
-As a Data Controller, you can make a "right to be forgotten" request on behalf of a visitor. To do this, send an email to [mailto:DataPrivacy@Genesys.com DataPrivacy@Genesys.com]. Be sure to provide the following identifying parameters for the visitor. These parameters are the primary keys by which Altocloud recognizes unique visitors:
-*Email address
-*Phone number
-*Cookie ID
-*Business-specific ID that has been passed to Altocloud with other customer data
-{{NoteFormat|
-It is your responsibility as the Data Controller to:
-*Confirm the visitor's identity before submitting a "right to be forgotten" request on their behalf to Altocloud.
-*Provide the identifying parameters of the visitor who is requesting to be forgotten.
-'''Notes:'''
-*All identities related to these parameters will be subject to deletion.
-*After Altocloud deletes visitor data, it cannot be recovered.|1}}
-Altocloud honors "Right to be forgotten" requests within 28 days. Altocloud sends a confirmation to the Data Control when data has been deleted.
-==Make a "Right of access" request==
-As a Data Controller, you can make a "right of access" request. To do this, the designated representative from your organization should send email to [mailto:DataPrivacy@Genesys.com DataPrivacy@Genesys.com]. The email should contain the identifying parameters for the visitor. These parameters are the primary keys by which Altocloud recognizes unique visitors:
-*Email address
-*Phone number
-*Cookie ID
-*Business-specific ID that has been passed to Altocloud with other customer data
-{{NoteFormat|
-It is your responsibility as the Data Controller to:
-* Confirm the visitor's identity before submitting a "right of access" request on their behalf to Altocloud.
-* Provide the identifying parameters of the visitor whose data is to be provided.
-Note:
-*Altocloud will provide all data related to the identities having these parameters.
-|1}}
-Altocloud honors "Right of access" requests within 28 days. Altocloud sends your designated representative the data in JSON format.
-==Stop tracking==
-For information on how to stop tracking if a visitor revokes consent, see ''Stop tracking if a visitor revokes consent'' in the {{#mintydocs_link:manual=Developers|topic=Tracking_code}} article.
-[[Category:V:ATC:Draft]]

Genesys Predictive Engagement Administrator's Guide

Get started

Global settings

Segments

Outcomes

Action maps

Actions

Journey shaping

Journey data

Analytics

Compliance

Audit logs

FAQs