Zen Cart Logo
Forums / General Questions / General Data Protection Rules GDPR

General Data Protection Rules GDPR

Views: 266,303

Results 21 to 40 of 177
28 Mar 2018, 5:24 AM
#21
design75 avatar

design75

Totally Zenned

Join Date:
Dec 2009
Location:
Amersfoort, The Netherlands
Posts:
2,862
Plugin Contributions:
5

General Data Protection Rules GDPR

gilby:

Not sure what "deleting their account" actually means?
What about all their "orders"?
Can't delete those as by law we need to keep this info for at least 7 years for tax purposes here in Oz
As well if you actually deleted "orders" we wouldn't be able to do basic stock control and profit and loss etc....

Perhaps it means renaming the account somehow to keep the actual data but to remove all customer identifying details?
If so then how would you handle cases when the government wants details on who you sold stuff to?

Perhaps it only applies to online data. Maybe you can keep printed offline records of all this stuff?
Just thinking here....
You may delete or change orders that are final, as that is prohibited by law, but you should probably have to tell the customer you need to save that information for a limited amount of time (7 years in EU countries).

28 Mar 2018, 12:53 PM
#22
wilt avatar

wilt

Oji-san

Join Date:
Jun 2003
Location:
Newcastle UK
Posts:
1,865
Plugin Contributions:
3

Re: General Data Protection Rules GDPR

As the only core team member residing in the EU, thought I would offer my thoughts here.

First, as mentioned in a previous post, be wary of scaremongers, especially when they are consultants looking to make some money from you.

The first steps in compliance is to make sure your Privacy and Conditions of use tell the customer exactly what data you are collecting, what use it is put to, and how to contact you if they have concerns or want you to amend/delete their data.

Another big issue is consent. Using Agree to terms on both sign up and checkout will help here. Also remember that any consent should be opt in, don't automatically check those checkboxes.
Zen Cart by default does not have a Cookie consent pop up, although there are modules that you can install.

When you are collecting information, make sure you are only collecting information you really need. Do you really need a customers telephone number, their date of birth etc. If you are collecting that information then tell the customer why you need it.

On the right to forget, there are obviously some conflicts here. While its easy to delete a customers record, if they have made orders then personal info is also stored in the order. However as a general principle, the tax requirements to keep order information for n years will override the GDPR requirements. Again this fact should be shared with the customer in your privacy policy.

On encryption. The actual section in the wonderful GDPR documentation does not make it an absolute necessity, at least as far as database encryption is concerned. However no store now should ever operate without SSL, and as a general principle should use SSL site wide and not just for admin/checkout.

Finally, I am not a lawyer. My advice above is based on my reading of GDPR, and my experience working with Zen Cart for many many years :)

4 Apr 2018, 9:13 AM
#23
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

I never took close look on the customers tables and all that stuff.
I was thinking about creating a new table that could save the customers agreement in the new gdpr laws. But there's a beautiful table called customers_info, that could hold this extra info.
My concern is on future zencart updates. I belive in principle that it will update tables without removing extra columns , right ?

About the 7 years. I believe this depends if one is using zencart as a accounting software.

4 Apr 2018, 10:49 AM
#24
mc12345678 avatar

mc12345678

Totally Zenned

Join Date:
Jul 2012
Posts:
16,908
Plugin Contributions:
2

Re: General Data Protection Rules GDPR

mesnitu:

I never took close look on the customers tables and all that stuff.
I was thinking about creating a new table that could save the customers agreement in the new gdpr laws. But there's a beautiful table called customers_info, that could hold this extra info.
My concern is on future zencart updates. I belive in principle that it will update tables without removing extra columns , right ?

About the 7 years. I believe this depends if one is using zencart as a accounting software.

This has been the operation of ZC for as far back as I have seen the install/upgrade process work. In fact there was discussion that one of the ZC provided tables had a field in it that was never used in core code (final_price as found in the customers_basket table). Removal of that field (from the install script and from the database in the upgrade process) was under review for nearly a year. Now, this was a direction to affect a field within a table that was generated by core Zen Cart code. Otherwise, the process has been to still generally leave other fields and tables alone to be controlled by some other process. So, provided the path forward continues to be one of Zen Cart taking care of its own tables and fields with any other modifications made to be addressed by an applicable process, you can yes use the customers_info table to track this additional field.

4 Apr 2018, 11:16 AM
#25
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

Thanks !
I see now that I was inventing the wheel. The zencart terms and conditions configuration, can handle this bit at the registration page! Cool!

Edit:
Not so cool! However it seems that it's not inserting this data anywhere...

4 Apr 2018, 1:53 PM
#26
rixstix avatar

rixstix

Totally Zenned

Join Date:
Aug 2009
Location:
North Idaho, USA
Posts:
2,015
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

I'm glad our volume of sales exempts us from all/Most of this.

5 Apr 2018, 1:57 PM
#27
carlwhat avatar

carlwhat

zennedOut

Join Date:
Nov 2005
Location:
los angeles
Posts:
2,958
Plugin Contributions:
8

Re: General Data Protection Rules GDPR

mesnitu:

But if a site uses SSL I guess it's encrypted.

SSL encrypts data transmission between a users browser and the web server.

it does NOT encrypt the data that resides on the web server.

5 Apr 2018, 5:42 PM
#28
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

I guess something like bbc.com , where you can control what cookies are in place. So one could stop analytics or whatever to run before user consent.
However zencart uses IP from visitors, and IP are now considered personal information.
A lot of issues here.

13 Apr 2018, 6:20 PM
#29
simon1066 avatar

simon1066

Totally Zenned

Join Date:
Feb 2009
Location:
UK
Posts:
1,326
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

I've given some thought to how to implement the 'right to be forgotten'. Some years ago Kuroi highlighted a potential fraud issue with allowing customers to delete their own accounts. So given that I'm unlikely to have to deal with many account deletions I've gone down the road of having a customer request that their account be deleted - click on a button and it sends me an email requesting such. In case anyone's interested:

I added a link in the customers Account page (\includes\templates\my_template\templates\tpl_account_default.php) pointing to a 'Delete My Account' page.

I created 3 new files:

\includes\languages\english\my_template\account_delete.php

define('HEADING_TITLE', 'Delete My Account');
define('NAVBAR_TITLE_1', 'My Account');
define('NAVBAR_TITLE_2', 'Delete Account');
define('TEXT_SUCCESS_ACCOUNT_DELETE', 'Your request for your account to be deleted has been successfully sent and will be actioned as soon as possible.');
define('ACCOUNT_DELETE_INFORMATION', 'Do you wish to delete your account? Please confirm by clicking the button below. <br/><br/>This will notify us of your request and we will delete your account as soon as possible (by law we must action your request within one month).<br/><br/>Please note that this will permanently remove all of your personal information, including order history, from our system.');
define('EMAIL_SUBJECT', 'Website Enquiry from ' . STORE_NAME);
define('ENTRY_NAME', 'Full Name:');
define('ENTRY_EMAIL', 'Email Address:');
define('ENTRY_ENQUIRY', 'Message:');
define('MESSAGE_BODY', 'Please permanently delete my account');
define('MESSAGE_CUSTOMERS_ID', 'customers_id: ');

\includes\templates\my_template\templates\tpl_account_delete_default.php

<article id="main">
<header><h1><?php echo HEADING_TITLE; ?></h1>
							
						</header>
						<section class="wrapper style5">
							<div class="inner">							
							
<?php echo zen_draw_form('account_delete', zen_href_link(FILENAME_ACCOUNT_DELETE, 'action=send', 'SSL')); ?>

<?php
  if (isset($_GET['action']) && ($_GET['action'] == 'success')) {
?>

<div class="mainContent success"><?php echo TEXT_SUCCESS_ACCOUNT_DELETE; ?></div>
<br class="clearBoth" />
<div class="buttonRow"><?php echo zen_back_link() . zen_image_button(BUTTON_IMAGE_BACK, BUTTON_BACK_ALT) . '</a>'; ?></div>

<?php
  } else {
?>
<?php echo zen_draw_input_field('contactname', $name, 'style="visibility:hidden; display:none;"'); ?>
<?php echo zen_draw_input_field('email', ($email_address), 'style="visibility:hidden; display:none;"'); ?>
<?php echo zen_draw_input_field('enquiry', $enquiry, 'style="visibility:hidden; display:none;"'); ?>
			

<fieldset class="accountDelete">

<legend><?php echo HEADING_TITLE; ?></legend>

<?php echo ACCOUNT_DELETE_INFORMATION; ?>

</fieldset>

 <div class="buttonRow forward"><?php echo zen_image_submit(BUTTON_IMAGE_CONFIRM,BUTTON_CONFIRM_DELETE_ALT); ?></div>
 <div class="buttonRow back"><?php echo '<a href="' . zen_href_link(FILENAME_ACCOUNT, '', 'SSL') . '">' . zen_image_button(BUTTON_IMAGE_BACK, BUTTON_BACK_ALT) . '</a>'; ?></div>
<?php
  }
?>
</form>	
<br class="clearBoth" />
</div>
</section>
	</article>

\includes\modules\pages\account_delete\header_php.php

$zco_notifier->notify('NOTIFY_HEADER_START_ACCOUNT_DELETE');

if (!$_SESSION['customer_id']) {
  $_SESSION['navigation']->set_snapshot();
  zen_redirect(zen_href_link(FILENAME_LOGIN, '', 'SSL'));
}

require(DIR_WS_MODULES . zen_get_module_directory('require_languages.php'));

$error = false;
if (isset($_GET['action']) && ($_GET['action'] == 'send')) {
  $name = zen_db_prepare_input($_POST['contactname']);
  $email_address = zen_db_prepare_input($_POST['email']);
  $enquiry = zen_db_prepare_input(strip_tags($_POST['enquiry']));
   
      $sql = "SELECT customers_id, customers_firstname, customers_lastname, customers_password, customers_email_address, customers_default_address_id
              FROM " . TABLE_CUSTOMERS . "
              WHERE customers_id = :customersID";

      $sql = $db->bindVars($sql, ':customersID', $_SESSION['customer_id'], 'integer');
      $check_customer = $db->Execute($sql);
      $customer_email= $check_customer->fields['customers_email_address'];
      $customer_name= $check_customer->fields['customers_firstname'] . ' ' . $check_customer->fields['customers_lastname'];
	  $send_to_email = trim(EMAIL_FROM);
      $send_to_name =  trim(STORE_NAME);    

    // Prepare extra-info details
    $extra_info = email_collect_extra_info($name, $email_address, $customer_name, $customer_email);
    // Prepare Text-only portion of message
    $text_message = OFFICE_FROM . "\t" . $name . "\n" .
    OFFICE_EMAIL . "\t" . $email_address . "\n\n" .
    '------------------------------------------------------' . "\n\n" .
    strip_tags($_POST['enquiry']) .  "\n\n" .
    '------------------------------------------------------' . "\n\n" .
    $extra_info['TEXT'];
    // Prepare HTML-portion of message
    $html_msg['EMAIL_MESSAGE_HTML'] = strip_tags($_POST['enquiry']);
    $html_msg['CONTACT_US_OFFICE_FROM'] = OFFICE_FROM . ' ' . $name . '<br />' . OFFICE_EMAIL . '(' . $email_address . ')';
    $html_msg['EXTRA_INFO'] = $extra_info['HTML'];
    // Send message
    zen_mail($send_to_name, $send_to_email, EMAIL_SUBJECT, $text_message, $name, $email_address, $html_msg,'contact_us');
   
    zen_redirect(zen_href_link(FILENAME_ACCOUNT_DELETE, 'action=success', 'SSL'));

} // end action==send

// default email and name if customer is logged in
if($_SESSION['customer_id']) {
  $sql = "SELECT customers_id, customers_firstname, customers_lastname, customers_password, customers_email_address, customers_default_address_id
          FROM " . TABLE_CUSTOMERS . "
          WHERE customers_id = :customersID";

  $sql = $db->bindVars($sql, ':customersID', $_SESSION['customer_id'], 'integer');
  $check_customer = $db->Execute($sql);
  $email_address = $check_customer->fields['customers_email_address'];
  $name= $check_customer->fields['customers_firstname'] . ' ' . $check_customer->fields['customers_lastname'];
  $customers_id = $check_customer->fields['customers_id'];
  $enquiry = MESSAGE_BODY . ' (' . MESSAGE_CUSTOMERS_ID . $customers_id . ')';
  
}

$breadcrumb->add(NAVBAR_TITLE_1, zen_href_link(FILENAME_ACCOUNT, '', 'SSL'));
$breadcrumb->add(NAVBAR_TITLE_2, zen_href_link(FILENAME_ACCOUNT_DELETE, '', 'SSL'));

// This should be last line of the script:
$zco_notifier->notify('NOTIFY_HEADER_END_ACCOUNT_DELETE_PROCESS');

and added a line to:

\includes\languages\english\my_template\button_names.php

define('BUTTON_CONFIRM_DELETE_ALT', 'Yes, Delete My Account');

All this gives give me

Attachment 17789

A click on the button gives a 'message received and understood' page and an email is sent to the address in the admin > configuration > e-mail options > Email Address (sent FROM) field.

This is just a copy and paste job (so there are probably plenty of errors/omissions/redundant code).

Edit: forgot to say that I've posted the full code from the three files so there'll be some custom HTML tags that won't relate to the standard ZC template

13 Apr 2018, 11:38 PM
#30
gilby avatar

gilby

Totally Zenned

Join Date:
Aug 2005
Location:
Vic, Oz
Posts:
1,816
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

And just for my curiosity, as I don't need to implement this (yet)
What data do you actually delete when you decide to go ahead with their request?

14 Apr 2018, 7:12 AM
#31
simon1066 avatar

simon1066

Totally Zenned

Join Date:
Feb 2009
Location:
UK
Posts:
1,326
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

That's a good question. I haven't quite decided that, still looking into it.

14 Apr 2018, 7:46 AM
#32
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

simon1066:

This is just a copy and paste job (so there are probably plenty of errors/omissions/redundant code).

Thanks!
I'm going on the same road, was about to do that, so it's a good thrust.
So far I've battle with javascript to manage to change the cookiecontent script to allow a user configuration.
Basically, it starts with zenid ( but I think that analytics with IP anonymization is allowed) and sets some other cookies uppon user configuration.
They will permit or not, the entrance of different levels of FB pixel, remarketing, etc... with tag manager (that I still have to learn a bit more)
I've created a new table "customers_gdpr" that will save the users consent on registration, date, etc...
A observer that will check the registration page to insert thos values on that table, and also check registers customers prior to this law, so if they start a session, redirects then to the account where may signal their agreement. (it's the same form used on registration page. ) .
That notification is also recorded in the customers_gdpr, so even if a customer chooses not to agree, there is a record that has been notified.( with a date)

Now it's that part, allowing the deletion of a account upon request.

What to delete: there's no general answer to that, it really depends on the the size of the business and what kind of data that business asks and holds and the business informs.

As far as I'm concern:
There's a registered user that never made a purchase, or a comment. Don't see a problem here
There's a registered user that never made a purchase but made some comments, etc. I don't see a problem here.
There's a customer, bougth some stuff:
We don't use zencart as a accounting software, neither we have integrations between other accounting plataforms (ie: sage pay) and zencart, so that purchase is registered on another software and can not be deleted according to our national law. We only ask the necessary data and hold the necessary data.
But online, I don't see a problem either. The customers for what ever reason wants to leave, he leaves. I agree with that.

That's the conclusion that our team of lawyers, highly reputable consultants, and implementation jscript programmers, php and mysql made.
A team made up of me, myself, and sometimes I.

And that's it. I'm done with this.

In fact I'm looking forward for this law, because I'm also a customer, and I want to ask some questions to some big communication companies over here about my data.

14 Apr 2018, 8:18 AM
#33
simon1066 avatar

simon1066

Totally Zenned

Join Date:
Feb 2009
Location:
UK
Posts:
1,326
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

Re Cookie Control, I'm probably going to do something like cookiebot . com, although I don't like the way their cookie banner disappears when I start scrolling. Hopefully when I sign up for a free account, and taking into account your ideas, I'll get a better idea of how to implement it on my site .

On my system I think that deleting the Customer and their associated Orders from withing the ZC Admin will be enough to remove customer identifiable information. Deleting an order affects a number of dbase tables but I think I might adjust this to keep the Order in TABLE_ORDERS_PRODUCTS at least then ZC has a record of products sold.

14 Apr 2018, 9:15 AM
#34
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

Cookie Control, now it's the time to make money. I've searched for some free scripts that would allow some sort of configuration. Didn't find any, but it's a big internet.
Maybe the cookieconsent script will be updated to give this option.
I'm using foundation has a base template. I've added a link "Configure" to the cookie consent that will use the foundation reveal "module" ( a popup), a form using the foundation switch module. So it's mix of php and jscritp and cookies
But it all can be done using jscritp, but I don't have the knowledge to do that neither the time.
https://cookieconsent.insites. com/documentation/disabling-cookies/

In the cookie consent script I created another status ( Config) , basically a copy from the "allow" status. More or less you can get the idea, just check where the cc.status.allow is used.

// valid cookie values
  cc.status = {
    deny: 'deny',
    allow: 'allow',
    dismiss: 'dismiss',
    config: 'config'
  };

In the configuration ( window.addEventListener("load", function () { ) ( has to be set to add the new status ( When I say has, please read maybe )

"content": {
     
   "allow": "Allow",
   "config": '<i class="ic_settings_white_1x_small"></i>Configure'
    },

"revokable": "true",
"type": "opt-in",

Then all is going to be on the
onPopupOpen: function onPopupOpen(status, chosenBefore, options, utils) {

onStatusChange: function onStatusChange(status, chosenBefore) {

The only reason I don't paste here the complete code, it's because I know that makes the job for me, but it's a quick bandage, and it's using foundation base modules, and it's cookies strategies to configure cookies ( a paradox )
To be a general scritp , a lot of JavaScript knowledge is required.
But what was the more complicated part for me, was this.
The rest is a form, with input checkboxes, etc... With PHP i'm checking the cookie config , and allowing or not analytics etc....
Again, this is not a copy paste, but a general idea.

"use strict";

function delete_cookie(name, domain) {
  document.cookie = name + '=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Domain=' + domain;
}

window.addEventListener("load", function () {

  var host = window.location.hostname;
  window.cookieconsent.initialise({

    "palette": {
      "popup": {
        "background": "#000"
      },
      "button": {
        "background": "#f1d600"
      }
    },
    "layout": "basic",
    "theme": "edgeless",
    "content": {
      "message": "bla bla bla:",
      "dismiss": "ok",
      "allow": "Aloow Cookies",
      "link": "Privacy Link",
      "href": "thelinink . com ",
      "config": '<i class="ic_settings_white_1x_small"></i>Configure'
    },
    "revokable": "true",
    "type": "opt-in",

    onPopupOpen: function onPopupOpen(status, chosenBefore, options, utils) {
      
      var type = this.options.type;
      var hasConsented = this.hasConsented(); // allow, dismiss, deny, config 
      var didConsent = hasConsented;
      var cfgCookiesAnalytics = '';
      var cfgCookiesExternal = '';
      // to check if analytics is GDPR compliant

      var isAnalyticsChecked = document.getElementById('c-analytics');
      var isExternalChecked = document.getElementById('c-external');

      function updateState(input) { //This is update the input buttons state 

        var inputName = input.name == 'secondaryC-switch' ? 'secondaryC-switch' : 'secondaryC-switch-external';

        if (inputName == 'secondaryC-switch' && input.checked) {
          cfgCookiesAnalytics = 'active';
        } else if (inputName == 'secondaryC-switch' && !input.checked) {
          cfgCookiesAnalytics = 'inactive';
          isExternalChecked.checked = false;
          cfgCookiesExternal = 'inactive';
        }

        if (inputName == 'secondaryC-switch-external' && input.checked) {
          cfgCookiesExternal = 'active';
          isAnalyticsChecked.checked = true;
          cfgCookiesAnalytics = 'active';
        } else if (inputName == 'secondaryC-switch-external' && !input.checked) {
          cfgCookiesExternal = 'inactive';
        }
        return false;
      }

      var cookieForm = document.getElementById("ccForm");
      // listen to input events
      cookieForm.addEventListener("click", checkInputState, false); // It's going to listen to the INPUT buttons


      function checkInputState(e) {
        if (e.target.nodeName == "INPUT") {
          var listen = updateState(e.target);
        }
        e.stopPropagation();
      }

      // console.log('ce: ' + cfgCookiesExternal + ' - ca ' + cfgCookiesAnalytics);

      var saveConfig = document.querySelector('[aria-label="config cookie"]');

      // define cookie
      var cname = this.options.cookie.name;
      var expiryDays = this.options.cookie.expiryDays;
      var path = this.options.cookie.path;
      var domain = this.options.cookie.domain;
      var allDomains = '.' + document.location.hostname;

      if (saveConfig.addEventListener) {
        saveConfig.addEventListener("click", function (checkInputState) { // On save will get the Input Buttons State
          //event.preventDefault();
          if (cfgCookiesAnalytics == 'active' && cfgCookiesExternal == 'active') {

            didConsent = 'config';
            var set = cookieconsent.utils.setCookie(cname, 'allow', expiryDays, domain, path);
             setTimeout(function () {window.location.reload(true);}, 100);
          } else {
            didConsent = 'config'; // flag some user interaction

            delete_cookie('_ga', allDomains);
            delete_cookie('_gid', allDomains);

            var set = cookieconsent.utils.setCookie(cname, didConsent, expiryDays, domain, path);
            setTimeout(function () { window.location.reload(true);}, 100);
          }

          var getCookieName = '';
          if (cfgCookiesAnalytics == 'active') { // Analytics is good to go
            var set = cookieconsent.utils.setCookie('cc_analytics', 'allow', expiryDays, allDomains, path);
          } else {
            getCookieName = cookieconsent.utils.getCookie('cc_analytics');
            if (getCookieName) {

              delete_cookie('cc_analytics', allDomains);
            }
          }

          if (cfgCookiesExternal == 'active') {
            // review this bit, if it's active, analytics cookie is also active

            var set = cookieconsent.utils.setCookie('cc_allowSocial', 'allow', expiryDays, allDomains, path);
          } else {
            getCookieName = cookieconsent.utils.getCookie('cc_allowSocial');
            if (getCookieName) {

              delete_cookie('cc_allowSocial', allDomains);
            }
          }
        }, false);
      }
    },

    onInitialise: function onInitialise(status, chosenBefore) {
      var type = this.options.type;
      var hasConsented = this.hasConsented();
      var hasAnswered = this.hasAnswered();
      //console.log( 'onInitialise' + hasConsented + hasAnswered + type);
     
      if (type == 'opt-in' && hasConsented == true) {
        // enable cookies

      } 
      if (type == 'opt-out' && !hasConsented) {
        // disable cookies
      }
    },

    onStatusChange: function onStatusChange(status, chosenBefore) { // The user revoke his choice
      var type = this.options.type;
      var hasConsented = this.hasConsented();
      var hasAnswered = this.hasAnswered();
     
      if (this.hasAnswered() && this.hasConsented()) {
        setTimeout(function(){ window.location.reload(true) }, 100);
            // Put Your Google Analytics Tracking Code here ( Not using this, but this is the way to go ) 

      }  
      if (!hasConsented || !hasAnswered) {
        setTimeout(function(){ window.location.reload(true) }, 100);
            // Put Your Google Analytics Tracking Code here
      }     

    },

    onRevokeChoice: function onRevokeChoice() {
      var type = this.options.type;
      var hasConsented = this.hasConsented();
    
   
      if (type == 'opt-in' && hasConsented) {
        // enable cookies

      }
      if (type == 'opt-out' && !hasConsented) {
        // disable cookies
      }
    }

  });
});
14 Apr 2018, 9:36 AM
#35
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

I forgot to put the link https://www.kirupa.com/html5/handling_events_for_many_elements.htm

That's the function ( checkInputState ) that it's called on save. First I had a bunch of listeners that row me nowhere.
Bits of this, bits of that

17 Apr 2018, 11:45 AM
#36
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

What would be the implications in Zencart if instead of deleting orders, we could update orders only deleting personal information ?
Something like returning the table to default values ?

UPDATE orders SET
customers_name = 'User Deleted OR EMPTY',
customers_company = DEFAULT,
customers_street_address = DEFAULT,
customers_email_address = DEFAULT,
customers_street_address = DEFAULT
etc, etc, etc,
WHERE customers_id = 1;

17 Apr 2018, 12:07 PM
#37
design75 avatar

design75

Totally Zenned

Join Date:
Dec 2009
Location:
Amersfoort, The Netherlands
Posts:
2,862
Plugin Contributions:
5

Re: General Data Protection Rules GDPR

You should not delete the orders, or edit personal data in the orders. That is in may countries illegal, and will destroy your audit trail.
It is allowed to keep personal data in the orders, as long as you tell your customers you have that data, and tell them it has to be kept for a certain amount of years.

mesnitu:

What would be the implications in Zencart if instead of deleting orders, we could update orders only deleting personal information ?
Something like returning the table to default values ?

UPDATE orders SET
customers_name = 'User Deleted OR EMPTY',
customers_company = DEFAULT,
customers_street_address = DEFAULT,
customers_email_address = DEFAULT,
customers_street_address = DEFAULT
etc, etc, etc,
WHERE customers_id = 1;

17 Apr 2018, 1:24 PM
#38
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

Ok, but let's say in theory, this could be done. No zones stuff would get in the way, etc ? That's what I'm trying to find out ( in a lazy way I confess)

I'll start now by not deleting any orders ( honestly I'm really tired :sleep1: ).

More or less I made the changes and we are ready for the new regulation.
My only doubt is this one, since we are not using zencart as a accounting software, neither we could use it here, since it's not certify , etc..
So the customers with orders that asks to delete their personal data, we will give then the option to remove online data, but we can not delete a invoice from the accounting software. That's clear crystal.
But online, we really don't need that info, since we are not providing their info to google or whatever.
We have "physical" stores, and that assembles to a customer that enters the shop, provides me with his name, address, mail, phone number, etc , and goes to a corner of the shop and stays there for the rest of his live.

I'm not expecting tons of removal requests, but we have to be ready for the first, since we will notify our customers (all of them) but specially the ones without orders of our new privacy policy.

17 Apr 2018, 7:58 PM
#39
heathenmagic avatar

heathenmagic

Totally Zenned

Join Date:
May 2005
Location:
England
Posts:
730
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

RixStix:

I'm glad our volume of sales exempts us from all/Most of this.

Hello there. I just wondered if you heard what threshold exempts some companies from the GDPR rules? Thanks in advance

17 Apr 2018, 8:41 PM
#40
mesnitu avatar

mesnitu

Totally Zenned

Join Date:
Aug 2014
Location:
Lisbon
Posts:
597
Plugin Contributions:
0

Re: General Data Protection Rules GDPR

There are no exceptions in terms of data protection, and it's not just online. Just different levels of implementation regarding what kind of data do you hold, the amount of data and for what purposes.
For example, your site sets analytics cookies without asking. If the IP is anonymous ( there's a configuration in analytics for that ), it's considered not personal Information. If it tracks the complete IP , then it's personal data, since it can track your localization , and google loves locations to sell.
Basically we all work for google for free.
For security reasons, a company can track IP. But the user has to consent, or at least there must be some sort of information that explains why a company need that data.
If you have more than 250 employees, then a company must have a kind of data manager.
If there's a data breach, all companies are obliged to report that to authorities ( dont« recall the name )