Version Control

Version	Date	Description	Author
v.1	10.03.22	Creation	Clémence Rovelon

Context

SInce May 2018, the GDPR reglementation is effective.

Personal Data means any information that can be used to identify directly or indirectly a person.
This Policy applies to:
Personal Information that is collected, maintained, used or otherwise processed by any Global Business Unit, Function/Business Support Activity or Affiliate of Solvay. This Policy is global, applying to all Solvay locations. It is the imperative basis for using Personal Data and can only be replaced by stricter national regulations

Personal Information in any format, including computerized records and electronic information as well as paper-based files

Personal Information that Solvay collects and uses for its own business purposes.
=> as the data processor, Solvay, is a European company we need to follow the law and inform people we have personal information about them.

2 different consents have been identified :

Data Storage Opt-in

Fundamental agreement, allows Solvay to store personal user info in Salesforce

Marketing Opt-in

Allows Solvay to send mass communication, use Pardot to score and nurture via email marketing

Each consent must be:

Free: we must give a real choice
Specific: we must give a distinct real choice for each consent required, impossible to bundle
Informed: we must provide relevant info in clear language and must provide information before consent is given so that the user is making an informed decision
Unambiguous: User must take a clear affirmative action when providing consent

Impact

To store personal data about non Solvay people, data storage opt-in is needed.

If not, contacts will be anonymized

To facilitate business, we consider as implicit consent:

Personal information coming from Business cards or Trade show
Personal information of “active contacts” (more details on next slide)

=> exception: if a contact is linked to a complaint, we can’t anonymized him due to compliance. In this case, he will be inactivated
Forbidden to store contacts in Pardot or send marketing emails if they didn’t provide the Marketing opt-in.

=> If convicted, the penalty is equal to 4% of the Solvay turnover !

Terminology

Customer- contact in Salesforce who is associated with an SAP Account
Prospect - contact in Salesforce who is associated with a Non SAP Account, or a lead
Active - has record in Salesforce within specified data retention period.

Contact data storage retention period - 15 years
Prospect data storage retention period - 3 years

CRM Fields
Consent Information

Field Label	Description
Personal Data Opt-in	If true = the contact has agreed to the storage of his.her personal data.
Source Personal Data	To identify where the agreement comes from
Last Personal data Opt-in Update	To store the date of the last answer
Marketing Communication Opt-in	if true = the contact has agreed to receive marketing digital communications.
Source Marketing Opt-in	To identify where the agreement comes from
Last Marketing Opt-in Updates	To store the date of the last answer
Remove from mass marketing	Allow business to target leads/contacts that should not appear in mass marketing campaigns
Email Opt-out	The contact will not receive any email from Pardot True if Marketing Communication is empty True if Remove from Mass Marketing is true

GDPR Security & Sharing fields

Field Label	Description
Ask to be forgotten	To know if the contact requested to be forgotten
Request personal data	To know if the contact requested his.her personal data
Date of the personal data request	To store the date when the contact has asked
Date of personal data sent	To store the date when we have sent the data to the contact
Used in complaint	To know if the contact is used in at least one complaint
To be anonymized	To know if the contact meets the criteria to be anonymized (see Anonymized section)
Last activity date	To know the date of the last interaction with this contact

Anonymization

Contact will be anonymized if:

He requests it by sending an email to privacy@solvay.com
He clicked on “No” or didn’t reply to the email gathering his data storage consent

Who will receive this email?

Existing contacts having Personal Data Opt-in = False and Last Personal Data Opt-in Update empty. => Concretely, it means contacts who have been created with “Source personal data” not equal to “Business Card” or “Trade Show”
Contacts who have a last activity date > 3 years for prospects (with Last Personal Data Opt-in Update> 3 years) and > 15 years for Customers (with Last Personal Data Opt-in Update > 15 years)

Important: Due to audit constraint, a contact used in complaint will never be anonymized ! They will be inactivated

Worflows

When “Source Personal Data” = “business card” or “trade show”, the “Personal Data Opt-in” is automatically set to True => we strongly recommend you to update this field for your important contacts ! As is, they will not receive the email and will be considered as opt-in.
Last Activity Date is automatically updated when a new activity is logged to the contact (task, event, cases, opportunities, quotes…)
When a customer has a “last activity date” > 15 years, an email to refresh the Personal Data Opt-in will be automatically sent to him
When a prospect has a “last activity date” > 3 years, an email to refresh the Personal Data Opt-in will be automatically sent to him
When a contact is included in a complaint, he is automatically flagged as “Used in complaint”, he will never be anonymized
When “Personal Data Opt-in” changes from True to False, the contact is automatically flagged as “To be anonymized” except if he is flagged as “Used in complaint”. Each sunday, all the “To be anonymized” contacts are anonymized => only Admins can do this action
When Marketing Opt-in = False AND Last Marketing Opt-in Update is not empty, the contact is flagged as “Email Opt-out” = TRUE => He will never receive any email from Pardot. Only admins or workflows can perform this action
When Remove from Mass Marketing = TRUE, Marketing Opt-in = False and Email Opt-out = True

Pardot Integration

Syensqo IS - Customer Support > GDPR process > Capture d’écran 2022-03-10 124429.jpg