Client Terms and Conditions: Quick Guide

Consent requests are often used to gather additional personal information from visitors. They are typically presented in one of three ways:

1. A pop-up box appears when someone visits your website.

2. An overlay appears over the page where the visitor is viewing.

3. You ask permission to collect data via a form embedded within the page.

The most common use case is collecting email addresses. However, there are many other uses for consent requests. For example, some sites use them to gather demographic information such as age, gender, location, etc. Others use them to learn how visitors interact with certain parts of the site.

Asking for consent is important because it provides you with a way to show visitors that you respect their privacy. This makes it less likely that they will choose to leave your site without providing you with the requested information. In addition, asking for consent helps you comply with GDPR.

What information should be included in a consent request?

Consent requests should be specific and informative. They should provide people with enough information about how their personal data might potentially be used. This includes what type of data you’re collecting, why you want it, where it’s stored, whether you’ll use it together with other data, and how long you plan to keep it.

A consent request should be concise, clear, and easy to read. You don’t need to write a novel to make yourself understood.

You should also explain how the person can withdraw their consent. And you should let people know what consequences there will be if they choose not to grant permission.

The GDPR requires that consent requests be “specific”. This means that you should describe the controllers, purposes, and activities for which you collect personal data. In addition, you should specify the categories of personal data you’re requesting consent for.

If you’re asking for consent to process sensitive personal data such as health records, financial information, or genetic material, you should inform people of the legal basis for processing those types of personal data.

Informative consent requests are important because they help protect people’s privacy. When we’re asked for our consent, we tend to think carefully about whether we really want to give up control over our personal data. If we’re given enough information, we feel like we’ve been treated fairly and have had some say in the matter.

What approaches are available for obtaining consent?

Consent forms are often bundled together. This makes it difficult to understand what you’re agreeing to. Some people don’t read the entire form carefully because they assume that ticking a box means “yes.” Others just check off everything without reading anything.

The law says that consent must be given clearly and unambiguously. If you ask someone to sign something, make sure there’s no ambiguity about whether they agree to it. You might want to include a link back to where they agreed to the terms and conditions.

Children under 13 cannot give consent, and parents need to consent on behalf of children. Make sure you know how old your child is.

If you’re unsure whether a person understands what he or she is signing, ask for clarification. Don’t rely on assumptions.

How should we record consent?

Article 7(1) states ‘where processing is carried out on the basis of consent’, you are required to prove consent. This applies to every type of processing, including automated decision making. You must show how consent was obtained and what was said during the process.

Keep records of all consent statements – even those that do not involve data protection law. These include recordings of conversations where consent is given verbally.

Record consent statements in writing, electronic form, or both. Make sure you document everything that happens.

Consent must be specific and granulary. Consent must cover exactly what you intend to do.

When consent is withdrawn, you must update your records accordingly. If consent is withdrawn, make sure you know when it happened. You must know whether consent was withdrawn because of a change in circumstances, such as a request to stop sending emails.

For offline consent, you need records that allow you to show what was said or done during the conversation.

If consent is withdrawn, you have to know when it happened and why.

How should we manage consent?

Consent management is an important aspect in data protection law. However, many businesses are still struggling with how to best handle consent. They think that once they receive consent, everything is fine and dandy. But this isn’t true. Consent doesn’t just stop when you collect it. It needs to be viewed as a dynamic part of a long-term relationship of trust between you, the individual, and yourself.

People expect that companies will respect your wishes and give you choices over what happens to your personal information. And they’re right to do so. After all, they gave you their personal information because they trusted you to use it responsibly. So, you owe it to them to respect that trust and give them control over their data.

You should ask for consent before gathering any personal data. This way, you know exactly what you’re doing and why. If you want to start building a relationship with your customers, you’ll need to make sure that they understand what you’re doing and how you intend to use their data.

You shouldn’t assume that everyone wants to hear about every single thing you plan to do with their data. Instead, you should let them decide whether they want to be involved in your plans. For example, some people might prefer to opt out of receiving marketing emails. Others might like to participate in surveys or promotions. Still others might want to see certain products or services offered by you. By asking permission up front, you can ensure that you’re respecting people’s preferences and helping them feel comfortable with your actions.

Once you’ve collected consent, you need to explain what will happen to their personal information after you’ve given it to you. This helps people understand why you need their consent in the first place. In addition, you should tell them what will become of their data after they give it to you. This way, they can make decisions based on facts rather than assumptions.

Finally, you should remember that consent management is never done. Even after you’ve asked for consent and told people what will happen to their information, you should continue to listen to feedback and keep improving your practices.

How should the right to withdraw consent be managed?

Article 7(3) states you need to inform the individuals about how to withdraw consent. This article explains what those requirements are and why they matter.

You need to provide a way to withdraw consent, whether it’s through an email, telephone, or postal address.

Don’t forget that not everyone wants to withdraw consent through email or phone, so don’t assume that everyone will do so. Make sure you offer a physical option too. If you use cookies, you might consider offering a cookie removal tool.

The law says that consent can be withdrawn at any time. However, there are some situations where withdrawing consent could cause harm to the individual. For example, if an organisation fails to delete personal data because the person has withdrawn consent, then the organisation could face fines. So, if you plan to process sensitive information, such as health records, make sure you check whether the individual can withdraw consent.

If you plan to process sensitive data, such as health records or credit card numbers, you should think carefully about how you handle consent withdrawals. Here are some things to keep in mind:

• Do you allow individuals to withdraw consent for specific types of processing? For example, if you collect genetic data, you might ask for consent to store that data. But if someone later asks to have the data removed, you won’t be able to comply unless you have already stored the data.

• Does the individual have the right to withdraw consent for each type of processing? For example if you collect genetic data and medical test results, you need to ensure that the individual can withdraw consent for both types of processing.

Frequently Asked Questions

How much must be paid in Income Tax and National Insurance Contributions?

The worker has been employed by the same employer since January 2017. They are self-employed and pay £100 per week into the National Insurance scheme. Their wages are £500 per month and they earn no income outside of the £100 weekly contribution. How much Income Tax and National insurance must be paid on the £100 weekly wage?

You can use either:

1. your payroll software

2. the HMRC calculator

Calculation of deemed direct payments

The deemed direct payment is the sum of the following amounts:

• The value of the goods or services provided to the employer.

• Any money received by the intermediary as commission.

• An amount equal to the cost of materials used in providing those goods or services.

• Expenses incurred by the intermediary that are normally deductible from taxable earnings.

If you don’t know how much the deemed direct payment is, contact us. We’ll help you figure it out.