The Big Guideline


Try to track only the user information and behavior you're actually going to use, and make sure you solicit their informed consent and give your customers a way to opt out.

Remember that third-party tools you use – in particular Facebook and Google Ads – may collect a lot of customer data that you may not be aware of when you install their tools. Your due diligence includes making sure that your privacy policy lays out your policy and liability for this information. You're still responsible for taking care of customer data even if you're not clear that it's being collected.


It's always best to review your privacy policy point by point, make sure it's understandable to both you and the public, passes legal muster with your advisers, and make sure that it actually reflects your practices. 

We recommend an annual review of your privacy policy and customer data management practices with your legal team.


Glossary of Tracking Technologies and Customer Data Collection used on Gameflow Sites


A glossary of third-party technologies and how they are used on our sites. This guide helps clients understand the privacy implications of all the third party tools we recommend, with links to external sources and a clear summary of how we set things up by default.

While this list may feel overwhelming, remember that a lot of data protection best practices overlap - each of these guides will repeat each other quite a bit.


  • Google Analytics: After May 24 2018, GA on our sites are set up to be completely anonymous. This includes IP Anonymization.
  • Google Analytics e-commerce tracking is set up in sites that use PatronManager (we now anonymize order numbers to protect private information and avoid issues with pseudonymous identifiers).
  • Google Ads / Adsense has an overview of required content that should be included in your privacy policy to be compliant with their platform.
  • WordPress has some anonymous cookies used when a user logs in, which is uncommon for most of our clients (this  affects for instance sites with members that can log in to your site). This data can now be monitored and administered under Settings >> Privacy.
    You can review the new GDPR features for WordPress in the notes for the 4.9.6 release.
    WordPress allows you to Export Personal Data and Erase Personal Data tools.
  • Facebook Ads are often set up for cultural organizations.  You should add information to your privacy policy and consider your responsibilities under GDPR (Facebook guidance) that reflect how Facebook collects data about your customers (see details for your privacy policy) Facebook has some policies about this depending on if you're using Facebook Lead Generation Ads or other Facebook Ad Types.  Facebook requires certain policies in your privacy policy when you use Facebook Lead Ads. 
  • Facebook Pixels and Facebook Conversions API share non-anonymous transaction and anonymous page visit information with the Facebook Ad Platform.
  • AdRoll / NextRoll tracking pixels are optionally set up if you use the AdRoll Marketing Pixel.  AdRoll's guide for privacy policy requirements can be found here.


Form Tools

Most sites will have one of the following form tools installed.  Each form will need to be manually altered to include opt-in consent for any data that you track, because forms typically collect non-anonymous user data:


Ticketing, Fundraising and CRM Systems

All ticketing and fundraising systems collect customer data with every transaction.  You may be required to include a procedure to allow customers to request deletion of their customer data.



Payment Gateways

Payment Gateways collect particularly sensitive customer data, but also typically have maintain secure tools and environments for you to protect and manage this data.


Optional Features

  • Google Tag Manager may be set up on your site, which allows you to install many different varieties of tracking codes which should be audited.  Find your GTM account info under Settings >> General (if you don't see a setting here, chances are GTM is not installed)
  • Google Analytics Remarketing tracking is typically disabled for our client sites unless you've specifically requested this feature to support your marketing efforts.  (See how this affects your GDPR Compliance) 


Third Party Cookies


These cookies often appear on our sites and may track customer data:


Other Common Marketing and Email Tools

These are tools that we don't typically support beyond set up, but many of our clients use them so it's important that you review each tools' privacy features:
 



Frequently Asked Questions


Do I need a cookie consent popup?

For organizations serving European residents covered under GDPR, and in some cases California residents, potentially, and otherwise changing privacy policy laws may make this required in the next 3-5 years.

We recommend an approach that informs users and gets their consent at the moment in their experience when they want something that a cookie provides.  A better design is say, a request to enable only youtube embedding when a user tries to view an embedded youtube video. Then it's clear to the user what you are asking and why it is beneficial to them.

If you need to collect actual customer data on the website (and not in, say, a CRM), we can help you implement a tool like the GDPR Cookie Compliance plugin or a Youtube Embed Consent plugin. 


How long should we retain data?


This is up to you as a company, with some exceptions.  Under some privacy laws (like GDPR which affects European residents), you may be required to delete customer data when requested.  PatronManager has mechanisms such as Patron Portals that allow patrons to edit their info on file with you.  It's up to your legal advisors whether you need to be subject to this requirement under GDPR or CCPA law, or other future laws.  We recommend, because this is a changing landscape, that you make plans to have procedures for how to delete customer data in PatronManager when requested in the next year or two. 


Resources

The complete GDPR Compliance checklist can be found here.   This is a great resource to develop a fully compliant privacy policy.


We recommend you perform a cookie audit on your site using the free Cookiebot.com service.