3

My website features trips and tours from various travel operators.

The customer, my website visitor, is able to access the tour operator's profile page and contact them directly with any questions or enquiries via contact form placed on this page.

The form is asking the visitor to fill up their Name, Email, Phone and Message.

Now with the GDPR, I understand that I need to inform the visitor and guarantee that their details will not be misused or put on any email lists without their consent.

But how can I guarantee this if the message sent via this contact form is sent directly to the tour operator and I have no control over what will happen with the contact details once it arrives to the tour operator's inbox?

Would I be able to put a clause in the terms and conditions that the operators must agree to that they will not use the contact details for their own marketing purposes or is this just simply not enough?

Improve this question

1 Answer 1

Reset to default
1

It's pretty hard to answer your question, since you are missing some much needed information.

It depends on how you collect the information as well, and since I am not a lawyer, I cannot and will not hand out legal advice.

From my understanding you have several options on how to collect your forms information:

  1. You integrate a pre-made external form as an iFrame on your website. Here, you indeed have no control over how information is collected and if the external form's provider is GDPR-compliant. Check with your external provider on how to comply fully!
  2. You integrate a javascript, which builds a form on your website. With this option you may have an option to tinker with the displayed form to show additional GDPR-compliant information alongside your form. This depends on the implementation method if you as well as your external partner need to conform both to GDPR.
  3. You have your own form on your website and send the gathered information yourself somewhere. This is by far the trickiest part, since you and your external partner need to be GDPR-compliant in handling personal identifiable information.

In either three cases, you do however gather this information via your website, thus you need a written contract with your partner that your partner is allowed to process your customer's data on your behalf.

Perhaps someone else can chip in who knows how to handle iFramed content with GDPR.

Improve this answer
6
  • Hi David , many thanks for your reply. It's only the option 3 that adresses my question. As my mentioned in my question, my website features tours from various operators. Each of these operators have a profile page on my website and on each of these profile pages, there is a contact form provided by my website.
    – Joe Bloggs
    May 28, 2018 at 7:04
  • When the customer/visitor sends a message from this contact form, the output of this contact form goes directly to the tour operator. So it is not me who receives the message from the customer, it is the tour operator that receives the message directly into his email address together with the customer's details.
    – Joe Bloggs
    May 28, 2018 at 7:06
  • My question is then, how can I go about this form in terms of GDPR? How can I guarantee the data sent from this form won't be mis-used by the tour operator that will receive the customer's message?
    – Joe Bloggs
    May 28, 2018 at 7:11
  • If you're emailing the data then your are handling it temporarily, so you would still need to be compliant
    – jrtapsell
    May 28, 2018 at 7:45
  • @jrtapsell I am already compliant! All my forms are compliant, I have a PP as well as T&S in place. That's not what I'm asking. It's like Ebay for example. If I want to buy a TV then I go to the seller's profile page on ebay and ask the seller a question about the TV the I want to buy. The seller will receive my message into his inbox together with all my private details such as my email. So I know that eBay must be compliant, but does the seller who sells this TV also need to be compliant in order to receive my message?? and how can I make sure he is compliant?? That is what I'm asking.
    – Joe Bloggs
    May 28, 2018 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.