How to ensure your appointment booking system experience is GDPR compliant

Imogen Wethered
by Imogen Wethered

The EU General Data Protection Regulation (GDPR) defines the way that organisations and businesses should collect, control and process personal data. Its goal is to ensure that there is a balanced relationship between the rights of the individual and those who process their personal data, ensuring that the needs of the digital economy in Europe are enhanced through the seamless transfer of personal information in a protective environment.

When it comes to appointment scheduling software that enables customers to book an in-person or virtual appointment via a retailer’s website, the collection of customer and employee data to communicate with customers about their service within your business is key to using the software’s core capabilities.

This pack is designed to ensure retailers understand how they should use Qudini’s appointment booking system to manage customer data in compliance with GDPR requirements. The pack also explains the specific features we have created to support you in ensuring GDPR compliance.

Download the GDPR compliance with Qudini pack.

Below is some useful information on how to remain GDPR compliant when using a booking system, with some high-level
information on the requirements of GDPR. It should not be regarded as legal advice – we recommend you seek your own professional legal counsel for any advice on how to collect, process and manage personal data in compliance with GDPR.

What data does an appointment booking system collect?

Customers can book an in-person or online appointment through a number of methods, including the web, app, by QR code, by SMS, through a self-service kiosk, via a member of staff or through a call centre.

The specific data a booking system collects depends entirely on you. Within Qudini’s settings platform, you can configure which data capture fields you wish to enable/disable across your online and store associate interfaces.

The personal data that you might request from a customer might include their:

When do you need customer consent?

The lawful basis for collecting customer data under GDPR is that the processing of customer personal data is necessary to provide services under your contract with the customer, meaning there is no need to obtain consent.

Because you are capturing customer data for the purposes of providing information about a transaction that the customer has requested, consent under GDPR is not required to send the customer messages about their queue status. Your privacy policy must be made available for the customer to view and different rules apply if you want to send marketing content to the customer.

Despite consent not being required, Qudini has the functionality to enable you to require customer consent if you wish to take additional precautions.

Do you need customer consent to send marketing communications?

You cannot use the customer’s personal data collected for marketing purposes, (for example sending the customer information about products, unrelated services to that which the customer has indicated they are visiting for, or discounts) unless they have separately opted-in for this purpose. If you do want to send marketing communications, it is possible within Qudini to provide a separate option to opt-in for marketing communications.

If this is used, your privacy policy must state how the data will be used. It also needs to be possible to opt-out of the marketing messaging at any point. If a customer opts-in or out of marketing content within the appointment booking experience, this should undertake the applicable action for your entire company/marketing database. Integration with your company CRM system is therefore required to make this feature work in compliance with GDPR standards.

Your privacy and cookie policy should be visible

Before providing their personal data, even for transaction purposes, a customer should have the option to view your privacy policy before you process their personal data. It should contain the information required by article 13 of GDPR, including a description of how personal data will be processed. It should also list the appointment scheduling software provider as a processor of their data.

Qudini’s appointment booking interface settings include the capability to link to your company’s online privacy policy for the customer to read if they would like to. For customers being manually booked in to an appointment time-slot by staff members, it would be best to keep a physical copy of your privacy policy in a folder for customers to read if they request to. In addition, providing customers with a piece of paper with a URL/QR code link to your online privacy policy may also be of use (especially during Covid-19).

The standard Qudini booking interfaces use Cookies for the purposes of providing you with Google Analytics-style data on your customers’ geographic location, devices used and referrer site. As a result, the Qudini Cookie policy is made visible to all customers using our online interfaces to book an appointment.

GDPR standards recommend that you explain to customers why you are collecting certain pieces of information about them. As a result, on the ‘enter details’ page of the Qudini appointment booking interfaces we allow you to enable ‘information’ buttons next to each data field. When a customer clicks on any of these they can then read information as to why each piece of data is being requested.

Can you communicate with customers via SMS or email?

When communicating with customers, it’s important that all customer messages should only include transaction/service information.

Qudini offers a variety of features that enable you to automatically communicate with customers about their intended service within your business, including SMS and email.

Because customer data is collected primarily for ‘transaction’ purposes, it is appropriate to use these communication channels only to provide your customers with informative messages about their intended service (this can include appointment updates, information about their visit or advisor, and any information they have requested). These SMS messages and emails must not include marketing content within them (such as information about products, unrelated services to that which the customer is waiting for, or discounts) unless the customer has explicitly opted in to receive these kind of marketing communications when they provided their details. Any marketing opt-in button must be disabled by default, providing the customer with the option to actively opt-in should they wish to.

SMS messages

Template SMS – Qudini offers the ability to set-up template SMS and email messages that your store associates can manually trigger to customers at any point during their visit.

Free hand SMS – It is also possible for store associates to free-hand message customers. This feature by default is disabled.

Under GDPR standards, these Qudini SMS features can be used for the following transaction focussed purposes (without requiring specific consent from the customer):

We recommend that you fully brief your store associates on the difference between transaction content and marketing content before enabling these features.

Follow-up messages and surveys

Qudini offer the capability to send customers follow-up SMS or email messages after their visit. You may wish to use this feature for a variety of purposes as suggested below, alongside how to use these capabilities within the standards of GDPR without requiring specific consent from the customer:

Can you ask customers to complete questions when booking an appointment?

Qudini offers the ability to customise questions that customers are requested to respond to when booking an appointment, whether by online or through a staff member. You may choose to use these questions to capture additional information about the customer. This is fine as long as you reference the new type of data collected within your privacy policy and have a clear purpose for requiring this data.

You cannot collect sensitive personal data without an exemption. Sensitive personal data is a data subject’s racial or ethnic origin, political opinions, religious beliefs, physical or mental health status, sex life, trade union membership, financial background, criminal background, genetic data or biometric data. Under Article 9 of GDPR, sensitive personal data can only be processed if an exemption applies. An exemption will apply if you have explicit consent; or, where you are working in the health sector, you are collecting personal data for medical diagnosis or treatment. There are other exemptions, too, but care should be taken and you should check that they apply to you.

How should customer data from a booking system be stored?

As the data controller, it is your decision as to how long customer data should be stored within the booking system. Qudini’s platform enables you to easily configure how long after a customer’s visit their personal data (phone, email, notes, question responses) will be stored (whether a matter of hours, days or months).

Our default setting is that customer data is deleted immediately after their transaction has finished, but some retailers store customer data for a certain period due to compliance requirements and others import data into their CRM to support customer loyalty and clienteling. This seamless automated deletion of data enables you to easily ensure that all data is retained within the timeframes agreed within your company privacy policies, without the need to consistently manage this data deletion.

Even if your customer’s personal identifiable data is deleted (such as name, mobile number, email address) Qudini will still retain generic data about their visit such as visit time, advisor service information, product interest, outcomes and beyond for the benefit of providing you with rich analytics about your business.

Requests from customers for personal data

Under GDPR, a customer has the right to require you to provide them with the personal data you hold about them; they also have the right, in certain circumstances, to ask you to delete their personal data. To support the seamless performance of this request across your business, Qudini has created a portal that will enable your head office team to easily search for customer records and to delete that individual customer’s data from our database. Most clients do not need to make use of this feature within Qudini because they have enabled the setting to delete customer data on a scheduled basis within a matter or hours, days or months after their service has been completed.

Find out more about GDPR compliance with Qudini here.



Thank you!

A member of our team will be in touch.