DPDP for Ceramics, Tiles and Building Materials

A customer left her number at the showroom. Can we send her offers later?

Not on the strength of that number alone. She gave it for a quotation, and the legitimate use that covers voluntarily provided data is limited to the specified purpose she provided it for.

The Act works this through with its own example: a customer who gives a pharmacy her number so it can send a receipt has authorised the receipt, and nothing beyond it. Marketing is a fresh purpose and needs consent of its own.

ACT · Sections 4, 6 and 7(a), Illustration (I).

Can we buy a list of builders and architects to reach new projects?

No basis comes attached to a bought list. Consent has to be given by the person to you for your stated purpose, and the voluntary provision route means given to you by her, not sold to you by a third party.

If the seller claims consent was obtained, ask to see how. Where consent is relied on, it is the fiduciary who has to prove it was validly given, and that burden does not transfer with the file.

ACT · Sections 4, 6(1) and 6(10).

We are a dealer, not the manufacturer. Whose responsibility is the customer data?

It depends who decides. If you take the enquiry, decide what to do with it and hold the file for your own purposes, you are the fiduciary for it. If you are only capturing it on the manufacturer's instructions for the manufacturer's use, you are acting as its processor and there has to be a contract in place.

Most dealers are fiduciaries for their own enquiry book and processors for nothing at all. Being small does not make you somebody else's processor.

ACT · Sections 2, 8(1) and 8(2).

How long can we keep old customer and delivery records?

For as long as a live purpose or another law supports it, and no longer. Warranty periods, tax record keeping and an unresolved dispute are all real reasons. Habit is not.

The three year dormancy clock people quote does not apply to you. It sits in the Rules and it reaches only three classes of very large platform, being big e-commerce, big online gaming and big social media.

ACT · Sections 8(7) and 8(8); RULES · Rule 8(1) and Third Schedule.

The customer gave us her number, so we can add her to the promotional list.

She gave it for the purpose she gave it for. Voluntary provision covers that specified purpose and stops there. Promotion is a new purpose and needs a basis of its own, and the Act's own worked example makes exactly this point with a pharmacy receipt.

Dealer lists are trade data, not personal data.

The dealer firm is not an individual, but the person whose mobile you actually ring is. Her number and email are personal data, and that file needs a basis and a retention answer like any other.

We can buy a builder or architect contact list to reach new projects.

A bought list arrives with no basis attached to it, and nothing in the Act creates one. Voluntary provision means given to you by the person, not sold to you by somebody else.

Once the sale is done the file is our record, so we keep it forever.

Retention that no law requires and no live purpose supports has to end. Keep what tax, warranty and contract law require, and be able to say which one you are relying on.