Collecting Consent. Blackbaud Solutions User Guide Version 1.0. April 2017

Transcription

1 Version 1.0 April 2017

2 Contents 1 Introduction etapestry Raiser s Edge Blackbaud NetCommunity Raiser s Edge NXT Blackbaud CRM everydayhero... 34

3 1 Introduction Recent enforcement actions taken by the UK s Information Commissioner s Office (the ICO ) and the upcoming enactment of the EU s General Data Protection Regulation ( GDPR ) have placed the data collection and usage practices of non-profits under intense scrutiny. The ICO s concerns focus on ensuring non-profits are transparent in their data processing activities and that donors give informed consent to such activities. In May 2018, GDPR will require all EU organisations relying on consent as a basis for processing personal information to make certain that data subjects affirmatively opt-in to processing of their data by the organisation. Further, GDPR will require that organisations be able to demonstrate they have collected such consent. The purpose of this guide is to inform our customers on how best to use our solutions functionality as they are today to collect consent, record consent, and then effectively use that consent to determine what processing activities may be taken with respect to each constituent. For the purposes of this document: - The term consent is used to describe a supporter s permission to use their data in a certain way (eg. marketing, communications, wealth screening). - The term preference is used to describe the supporter s desired content subscriptions (eg. annual report, monthly newsletter, appeals). - The term processing refers to any activities an organisation takes with respect to a supporter s data, including collection, use, storage, sharing, data enrichment or analytics. As always, it is best to work with your organisation s legal advisor, who is familiar with your practices and constituents, to determine your obligations under existing laws. We do not guarantee that use of our solutions as set forth in this guide will satisfy the requirements of laws and regulations to which your organisation may be subject. Nothing in this document should be construed as legal advice or a legal opinion on any specific facts or circumstances. Further to this Solutions Guide, please see the Data Protection section in our blog for ongoing updates:

4 2 etapestry In order to capture a constituent s consent to your organisation s processing activities in etapestry, Blackbaud recommends the use of User Defined Fields (UDFs) on the constituent s defined fields tab to track opt in consent per channel. These should reflect the current or active consent. The etapestry Journal can be used to track historical consent. Additionally, though perhaps not required for compliance with existing privacy laws or GDPR, organisations may wish to collect further preferences from constituents, such as specific communication pieces they want to receive, or frequency of communication, or preferred channel. The consent and communication preferences can be used in etapestry Queries to select which constituents to send communications to. Below we have outlined how etapestry users can collect and document consent to an organisation s processing activities. This is broken into four categories Configuration, Capture, Use and Retrieve. 2.1 Configuration UDF Category Field Application UDF Name UDF Data Type Display Type UDF Values Consent Constituent Consent* Text Single Select Consent Assumed Consent Declined Consent Given Consent Withdrawn Unknown No Response Unknown Not Asked* Communication Preferences Phone Consent* Text Single "" Select Postal Consent* Text Single "" Select SMS Consent* Text Single "" Select Third Party Data Text Single "" Share* Select Wealth Processing* Text Single "" Select Journal (all) Historical Consent Text Multi-Select , Phone, Postal, SMS, etc. Constituent Preferred Method Text Single , Mail Select Specific Text Multi-select Spring Appeal, Communications Event Invitations, etc. * You may want to make these fields required.

5 2.2 Capture Constituents can be entered or updated in etapestry in the below ways: Direct entry on the etapestry record Created via import (from external data sources) DIY Forms o Newsletter/Contact Us o Volunteer o Membership o Donation o Event Registration Cart Module (optional) everydayhero integration (optional) Consent may also be changed via the constituent unsubscribing from an sent from etapestry. Below we detail how to include consent information when capturing new constituents in etapestry and updating existing accounts Creating a New Constituent Account with Consent Fields (direct entry on the etapestry record) To create a new constituent and include consent fields: First, check to ensure that the account does not already exist. You can do so by using the Search bar at the top of your database. If you find the account already exists, then follow instructions found in the next section - Updating a Constituent Account (direct entry on the etapestry record). If you cannot find an existing account, you'll need to create one using the steps listed below: 1. Click Accounts 2. Click Add an Account 3. Ensure that the Constituent checkbox is marked below the Roles heading 4. Below the Name and Recognition heading, select the appropriate Name Format from the drop down menu. 5. If the donor is an Individual, fill in the First and Last Name fields; the Account Name and Sort Name will automatically generate based on the organisation's Data Entry Rules. If the donor is a Business or Family, fill in the Account Name field; the Sort Name will automatically generate based on the organisation's Data Entry Rules. 6. Below the Persona heading, select the appropriate Persona (address) type from the drop down menu 7. Enter the constituent's street address, address, phone number, and any additional fields you'd like to include 8. If there are any fields marked with a red dot or asterisk, complete those fields, as well (these are User Defined Fields) and locate the category of User Defined Fields which house all consent fields and select this to expand fields 9. Select each field name to select a value for the UDF 10. Enter values for consent if known, if not known, use not asked 11. Select "Save And" to save and create the account

6 2.2.2 Updating a Constituent Account (direct entry on the etapestry record) To update consent on an existing constituent: 1. Search for the account in etapestry using the search bar at the top of your database 2. Go to the Account 3. Go to the Defined Fields tab 4. Locate the category of User Defined Fields which house all consent fields and select this to expand fields 5. Select each UDF in turn to overwrite UDF with new/changed consent 6. Select "Save And Go to Journal" to complete the changes to the UDF 7. Create the appropriate Journal entry related to the interaction (i.e. what was the interaction that prompted the updated info a new gift, a participation, an inbound or outbound meeting or phone call?) i. Under the Historical Consent UDF, check all that apply of which have changed ii. In the notes area of the Journal, enter the old consent information and what it has changed to iii. The date of the change should be the Journal Date Importing New Accounts To include consent fields when importing: 1. Click Management 2. Click Import 3. Select the category where you'd like to store the import 4. Click New Import 5. Enter a name for the import template 6. Click Browse Files/Choose File 7. In the Type of Information to Import drop down menu, select Account Information 8. Select the appropriate CSV file for this import 9. Select your preference from the Name Format drop down menu a. If you have multiple types of Name Formats in your CSV file, select "Map from your import file" and select the appropriate column b. If you have only one Name Format in your CSV file, assign that Name Format to all accounts 10. Select the Country from the drop down menu (all accounts in the file must be from the same country) 11. Select your Multi Select Delimiter from the drop down menu 12. Click Next 13. Click the green arrow icon next to the name of the field 14. Select the corresponding column from the CSV file 15. Repeat for all of the fields in your import file (we will not import fields for Name Format or Country on this page since we did that on the first page) a. Please note that we can select "Use auto-generated Data Entry Rules" for the Sort Name and Salutations (we can also do this for the Account Name on the Individual names) 16. Click the link that says Import Another etapestry Field at the bottom of the screen 17. Click the names of the additional fields you'd like to import and select your consent fields:

7 18. Click the green arrow icon next to the names of these fields 19. Select the corresponding column from the CSV file: 20. Mark the checkboxes for the Import Keys 21. Click Next 22. Preview the layout of the information 23. Click Next 24. Preview the duplicates and select how you would like to handle the information (if there are no duplicates, the database will skip this step) a. Only Import Into Empty Fields (Merge) will only add new information from the CSV file, but it will not replace any existing information b. Don't Modify Any Account Info (Trust) will not change anything on the existing accounts, it will also not add any new information c. Replace etapestry Info (Replace) will override the existing information in etapestry with the information in the CSV file d. Create New Account (Create) will indicate that these are not duplicate accounts and we should create a new etapestry account for the information in the CSV file e. Ignore this Line (Ignore) will not import any information from this line in the CSV file to etapestry 25. Click Next 26. Click Run to process the import DIY Forms To capture consent via a DIY Form, you must have the relevant UDFs present on each form. 1. Click Management 2. Click DIY Forms in the Online Presence section 3. Click Edit to the right of the DIY form you would like to edit 4. Click the plus Icon in the Section where you would like to add your User Defined Field 5. Select Add Fields 6. From the drop down menu, select the category in which the User Defined Field is stored 7. Select your User Defined Field

8 8. For additional options pertaining to the selected User Defined Field, click onto the + icon to the left of your selected User Defined Field. Additional options include changing the label (what appears online), marking the field required (if you desire), changing which location this data is applied towards, or adjusting which values appear as an option on your DIY form: We recommend that you make these fields required, and only show the relevant options (eg exclude "not asked"). This way, you will have consent collected at each interaction online. 9. Click Update 10. Once your User Defined Field has been added to your DIY form, Save and then Publish to make your changes live. For newsletter sign ups via Contact DIY forms, the consent UDF should be marked with a value of yes as a hidden field as the act of signing up to receive a newsletter is giving consent Cart To capture consent via the Cart module, you must have the relevant UDFs present on each form. 1. Click the arrow next to Management in the menu bar 2. Click estore (Cart) in the Online Presence section 3. Click Edit Cart Preferences under Customise Cart 4. Select Step 2 Online Options 5. Select your User Defined Field for the Field Name under Add Question 6. Type your question under Display Text eg. "Are you happy to be contacted via in future?" 7. Mark Required, if you require a Constituent to answer this question before completing their order (we recommend you do so) 8. Click Add 9. Click Save and Finish Everydayhero Integration See Section 7: everydayhero for our guide to collecting consent through Everydayhero (EDH). New accounts are created in etapestry when EDH ID and standard duplicate checks return no matches. The UDF "EDH Communication Preference" on the constituents Defined Fields tab will be updated with the EDH consent chosen. If an existing constituent comes through EDH and do not select to opt-in, there will be no change to their UDF "EDH Communication Preference". If they do opt-in, then the UDF will be populated with the value Opt-In.

9 How to query on Opt-Ins for everyday for a specific communication channel: 1. Click Queries 2. Click Manage Queries 3. Select a category that you want to store this query in (Eg. Base) 4. Click New Query under the tasks menu 5. Name the query 6. Set the Starting Query to Base/All Constituents 7. Under Results, select Constituent as the Data Return Type 8. Under Criteria Options mark Match each criteria 9. Under Browse Fields select UDFs Constituent from the drop down menu and click on the UDF EDH Communication Preference 10. Select the value of Opted-In 11. Click Save and Preview You may then select Choose Columns and select the consent UDF s for you to then view if anyone requires these to be updated accordingly either manually or using mass update. You can repeat this for those who have a value of Opted-Out. You must also add a Journal Contact or Note to track the change in consent. This can be done individually or via Mass Update. 1. Click Management 2. Click Mass Update 3. Click "Create New Notes/Contacts" 4. Select your query category and query name that was created from Opt Out Report 5. In the note section enter Opted Out via everydayhero or Opted In via everydayhero 6. Select historical consent change UDF 7. Select Next 8. Select Next again to run the mass update Unsubscribe When a constituent unsubscribes from an advanced mass using the "Remove my name from all future correspondence" link etapestry provides, their account in etapestry is marked as Opted Out. When this occurs, you should update the consent UDF to Consent Withdrawn based on results in the Opt Out Report. 1. Click Reports 2. Click etapestry Standard Reports 3. Click Opt Out Report 4. Set a date range if desired 5. Select Find 6. Click on the Accounts name to manually update the consent UDF individually or select "Create a Custom Query in "query category", enter a query name and select "Create" to begin the process to change on mass a. Click Management b. Click Mass Update c. Click "Update Existing Accounts" d. Select your query category and query name that was created from Opt Out Report e. Set the Update Type as "Assign" f. Select consent UDF and set the value to "consent withdrawn" g. Select Next h. Select Next again to run the mass update

10 You must also add a Journal Contact or Note to track the change in consent. This can be done individually or via Mass Update. 1. Click Management 2. Click Mass Update 3. Click "Create New Notes/Contacts" 4. Select your query category and query name that was created from Opt Out Report 5. In the note section enter Unsubscribed by (see persona opt-out) 6. Select historical consent change UDF and set the value to " " 7. Select Next 8. Select Next again to run the mass update 2.3 Use and Retrieve How to query on active consent for a specific communication channel: 1. Click Queries 2. Click Manage Queries 3. Select a category that you want to store this query in (Eg. Base) 4. Click New Query under the tasks menu 5. Name the query 6. Set the Starting Query to Base/All Constituents 7. Under Results, select Constituent as the Data Return Type 8. Under Criteria Options mark Match each criteria 9. Under Browse Fields select UDFs Constituent from the drop down menu and click on the name of the field eg consent 10. Select the value of consent given (you may also include consent assumed) 11. Click Save and Preview This query can then be used for sending communications eg a mass . You can always add additional criteria to further segment. How to query on historical consent changes: 1. Click Queries 2. Click Manage Queries 3. Select a category that you want to store this query in (Eg. Base) 4. Click New Query under the tasks menu 5. Name the query 6. Set the Starting Query to Base/All Constituents 7. Under Results, select Journal Entry as the Data Return Type 8. Under Criteria Options mark Match any criteria 9. Under Browse Fields select UDFs Transaction from the drop down menu and click on the field "historical consent change" 10. Select the "field has any value" 11. Repeat steps 9 and 10 for each journal entry type 12. Click Save and Preview

11 2.3.1 Customising current views to show consent information at a glance On the Account: 1. Click Accounts 2. Click Find an Account 3. Search for and click on the account name 4. Select Tiles and Layout 5. Select Custom Tile 6. Click Save 7. On the Account Home page file the Custom Tile 8. Title Tile eg. "Current Consent Information" 9. Select Add Field 10. Change drop down menu to "User Defined Fields: Account" 11. Choose all consent UDFs 12. Select the cross icon to close window 13. Select Save 14. You can then move to your desired location on the Home page In the Journal: 1. Click Accounts 2. Click Find an Account 3. Search for and click on the account name 4. Click Journal 5. Click the "Add / Remove Columns" link at the bottom of the page, in the lower left corner 6. Under the "Select Columns to Display" tile, click on a category to see the field options available 7. Mark the checkbox next to the fields you want to display or unmark the checkbox to the left of any fields you want to remove 8. Reorder the columns by hovering over a field name in the "Select Column Order" tile and dragging the field into the desired order Click Save In Query: 1. When you are in the preview of your query 2. Select Choose Columns 3. Browse or Search for your consent fields, for example, consent. 4. Select Apply and these fields will be added to your query results.

12 3 Raiser s Edge Outline Solution The solution outlined below provides a method for capturing, recording, and tracking consent and preferences. When a supporter s consent and preferences are received (paper form, telephone, , online) they are added to the supporter s record as an attribute; recording the nature of the consent or preference, the date and any other notes, such as the source. These are Current Consent constituent attributes. For changes to consent, constituent attributes are also used. These are recorded as Historical Consent. A record of the interaction that prompted the consent change (i.e. a new gift, a phone call, a meeting, an appeal response etc.) should also be kept, as part of standard procedures of recording constituent interactions with the organisation. These can be kept on the associated record, such as the gift or action. All marketing selections and suppression lists are based on the Current Consent constituent attributes. Historical consent/audit trail of consent can be tracked through the Historical Consent constituent attributes.

13 3.2 Consent Coding Table Examples Table entries could vary but the following provide an illustration. Constituent Attribute Category Marketing Opt-in Status Table Current Opt-in (Allow only 1 per record) Consent Assumed Consent Declined Consent Given Consent Withdrawn Unknown No Response Unknown Not Asked* Current SMS Opt-in Current Post Opt-in Current Telephone Opt-in Current Data Usage Opt-in - Data sharing with similar organisations Current Data Usage Opt-in - Wealth profiling Current Data Usage Opt-in - Data enhancement Current Appeals Opt-in - All Appeals Current Appeals Opt-in Emergency Appeal Only Current Newsletters/Publications Opt-in - Monthly newsletter Current Newsletters/Publications Opt-in - Semi-annual magazine Current Newsletters/Publications Opt-in - Annual report Constituent Attribute Category Marketing Opt-in Status Table Opt-in History Consent Assumed Consent Declined Consent Given Consent Withdrawn Unknown No Response Unknown Not Asked SMS Opt-in History Post Opt-in History Telephone Opt-in History Data Usage Opt-in History - Data sharing with similar organisations Data Usage Opt-in History - Wealth profiling Data Usage Opt-in History - Data enhancement Appeals Opt-in History - All Appeals Appeals Opt-in History Emergency Appeal Only Newsletters/Publications Opt-in History - Monthly newsletter Newsletters/Publications Opt-in History - Semi-annual magazine Newsletters/Publications Opt-in History - Annual report

14 3.3 Attribute Configuration Set up fields in Raiser s Edge to store consent and preferences. The steps below illustrate how to set up the attributes and code tables for use with consent and preferences. 1. Set up constituent attributes (data type = table; Allow only 1 per record) to record current opt-in status 2. Set up another set of constituent attributes (data type = table; allow multiple per record) to store a running history of elections 3. Set up table entries

15 3.4 Create a Constituent Query for Each Channel Base the dynamic query on the specific attribute date for the given channel: 3.5 Create an Export for Each Channel Create the export for each channel based on the queries created in Step 3.4:

16 Include the Constituent ID, the Description, Date, Comments, and Import ID for the History attribute and the Import ID of the corresponding Current attribute. 3.6 Create an Import for Each Channel Create a Constituent Attribute import parameter. Map the fields in the import based on the exact format that you will get from the exports you set up. Map the fields as follows: Constituent Import ID (from the History attribute) > Constituent Import ID (for the Current attribute) Attribute Import ID (from the Current attribute) > Attribute Import ID (for the Current attribute) Description (from the History attribute) > Description (for the Current attribute) Date (from the History attribute) > Date (for the Current attribute) Comments (from the History attribute) > Comments (for the Current attribute)

17 At this point, running the exports you created in Step 5 and the Imports you created in Step 6 back to back (without user intervention) should result in an updated Current attribute for any channel that has a History attribute added in the last month. 3.7 Create a Queue Process (Optional) Add the Export and Import parameters that you just added to a single Queue. By doing this, you can execute a single process to perform both activities and effectively update the Current attribute for a given channel. 3.8 Schedule the Queue Process (Optional) As normal.

18 4 Blackbaud NetCommunity Using Blackbaud NetCommunity it is possible to surface constituent attributes using the preferences part.

19 These can be updated by the supporter. The updates are sync d back into Raiser s Edge automatically in real-time without user intervention. Caveat: This method allows the update of the existing consent status but does not provide a history or change log.

20 5 Raiser s Edge NXT Please refer to Raiser s Edge 7 guidance.

21 6 Blackbaud CRM 6.1 Overview Blackbaud Enterprise CRM provides sophisticated out-of-the-box functionality to underpin the processes of capturing, recording and using consent and preferences. When an individual s consent is received (whether online, via a hard-copy form, over the phone, by or in person) this should be added to their record as a Solicit Code 1, accessible under the Preferences tab. You can record the nature of the consent, the start date, any end date, and the source (as a Comment). Such consents can be channel-based (e.g. consent for contact by mail, , phone or SMS) and/or activity-based (e.g. consent for processing of data for specific/all purposes). When an individual s communication preference is received (whether online, via a hard-copy form, over the phone, by or in person) they are added to the supporter s record as a Communication Preference, also accessible under the Preferences tab. You can record the nature of the preference, the desired channel and contact information to be used, and the source (as a Comment), with dates held as audit data: System notifications help ensure awareness by users. Changes of consent and communication preferences over time can be stored on individuals records providing a visible audit trail. In addition, the standard functionality of Blackbaud Enterprise CRM enables a full audit history, even of deleted data, to be maintained, through the relevant audit tables. Consents can be easily captured online through integrated Blackbaud Internet Solutions functionality, or imported using the out-of-the-box import and batch tools. All processing activities, marketing selections, and suppression lists should be based on the applicable consents recorded, and standard universe or suppression lists can be created to use for each communication. In addition, relevant communications should also be based on the applicable communication preferences. At present, there are several manual steps in the end-to-end process that can be automated via the use of scheduled custom global changes. Please contact Blackbaud Europe if you would like further details about the process for creating such automated workflows based on your organisation s specific business rules. Note that further enhancements are planned in this and other related areas during 2017 and See section on Activity-based consent for a potential variant to this.

22 6.2 Capturing consent Blackbaud Enterprise CRM provides a variety of functional capabilities to underpin the processes of capturing consent and preferences Online consent and preference forms Blackbaud Internet Solutions, the web component of Blackbaud Enterprise CRM, contains a configurable Communication Preferences form through which it is possible to collect both channel- and activity-based consents and communication preferences. Users creating the forms online can select which options are displayed. For consents these can be opt-in or opt-out as applicable. See example below (n.b. all wording and styles can be customised): For communication preferences, these can also be opt-in (i.e. send me ) or opt-out (i.e. do not send me ), with a no preference option displayed in circumstances where the individual updating their details has yet to either opt-in or opt-out. Communication preferences can also be grouped into categories, such as general correspondence, fundraising/other appeals, event invitations, etc. See example below (n.b. all wording and styles can be customised):

23 Additionally, for communication preferences it is possible to provide individuals with the option to choose between mail and/or receipt of any given communication, where applicable, and to be able to select which address/ they would like the communication to be sent to. See example below (n.b. all wording and styles can be customised): In each of the above online form examples, it is first necessary for the individual in question to login, using a unique username and password 2 provided to them, since the form displays personal data that is specific to him/her, using the latest information available in Blackbaud Enterprise CRM. Using a separate Profile Update Form, the individual can also update their contact and other information. If, however, an individual is directed to update their consent/preferences online via a link included in an sent from within Blackbaud Enterprise CRM, then (if you so wish) that individual can do without needing to login, since embedded code in the will unique identify him/her and display their personalised details on the linked form. Once all such data above is processed through the web transactions area, it will appear on their individual record in the relevant Solicit Codes and/or Communication Preferences. Via a scheduled custom global change, you can also automatically populate into the relevant Comments field summarised details of the specific web form from which this data was collected (e.g. Captured online through BBIS Communication Preferences Form V1.4, published 12 September 2016 ), which coupled with the date stamp will enable you retrospectively to reference back the form in question: We recommend that you keep a record of all changes made to forms over time, with accompanying dates, so that you can maintain a full audit trail Donation, event registration and membership forms To collect consents on donation, event registration and/or membership forms, you can configure specific Attributes on such forms, covering the type of consent most applicant for the visitor to that form. Once that data has been processed through the web transactions area and exists on the individual s Blackbaud 2 Which can be through either Social Sign On (e.g. Twitter, LinkedIn etc) or Single Sign On (e.g. your organisation s Active Directory login), if this has been configured for your Blackbaud Internet Solutions webpages.

24 Enterprise CRM record, you can use a scheduled custom global change to add/update their Solicit Codes and/or Communication Preferences as appropriate. Alternatively, you can (re)direct the individual to the Communication Preferences form at any stage of the donation, event registration and/or membership process, including as part of the acknowledgement/thank you that is automatically sent upon processing of their payment Import of externally captured consents In addition to the above built-in functionality for online consent and preference capture, it is also possible to import such data from external spreadsheets, third-party forms or other data sources. Blackbaud Enterprise CRM contains sophisticated import functionality, including advanced algorithms to support duplicate matching in scenarios where your data does not have a unique Lookup or Alternate ID with which to robustly match data to existing individuals, although ID-based matching is of course always desirable. Imports can also be scheduled for Blackbaud Enterprise CRM, to automate processing in situations where for example the consent files is regularly updated into a specific file location. Blackbaud Enterprise CRM and Internet Solutions also come with a full set of web services and APIs as standard. Using these, organisations who have access to the appropriate developer resources (whether internal, partner/third-party or Blackbaud) have flexibility to build more automated integrations with other solutions to streamline adding or updating externally-captured details into Blackbaud Enterprise CRM. 6.3 Recording consent Blackbaud Enterprise CRM provides a variety of functional capabilities to underpin the processes of recording consent and preferences Recording channel-based consent Within Solicit Codes you can record channel-based consent, i.e. consent for sending communications by , mail, phone and/or SMS. These can be configured to be organisation-wide, or specific to certain parts of the organisation for example if you have a federated structure requiring a hierarchy of consents. You can select the nature of the consent, and whether it is opt-in or opt-out, any associated Site, the start date and (if applicable) end date, and the source as a Comment field. You can track changes in each of these consents over time, for example if an individual opt-in but then removes that opt-in:

25 We recommend using a naming convention for the source, to enable subsequent tracking. We also recommend recording a detail of the consent, if it was not captured online, via a separate Interaction (into which you can store linked documentation notes, attachments or media files as appropriate):

26 We also recommend that you use the built-in system notifications functionality available within Blackbaud Enterprise CRM, which can be assigned automatically per business rules established via a set of preconfigured queries, to provide simple summary notifications for your users that explain the consents currently in place for any given individual: Recording activity-based consent The process for recording activity-based consent, such as an overall Collected Consent for Marketing Activities or, if appropriate to your organisation, more granular consent for specific activities such as data enrichment, wealth screening and/or social listening can be very like that above for channel-based

27 consent. Depending on the categories required/desired, however, you may also choose to use Constituent Attributes for this rather than Solicit Codes: Using Attributes will enable you to provide multiple drop-down values to be configured for the consent: If using this approach, however, then we recommend using the built-in Page Designer capability available within Blackbaud Enterprise CRM (which requires no developer skills) to position this Attribute(s) onto the Preferences tab of the constituent record, so that this can be conveniently displayed immediately below or between Solicit Codes and Communication Preferences Recording specific communication preferences Within Communication Preferences (also called Mail Preferences), you can record more granular preferences of each individual supporter regarding specific recurring communications sent out by your organisation. The level of granularity is for you to select as appropriate. For example, you may wish to have a series of event preferences, covering different categories of recurring events (e.g. social, professional networking, peer-to-peer fundraising, interest-based, etc), a series of fundraising appeal preferences, covering different categories of fundraising communication (e.g. year-end appeal, Giving Tuesday appeal, telethon, year-group fundraising, etc), and so on. An individual can then set positive or negative preferences for each specific one. If an individual has provided a positive communication preference for a specific communication but does not have the applicable consent for that channel (which is easily identifiable by checking queries), then your organisation will need to decide the appropriate course of action to take. It may be to contact the individual to clarify their stated preference.

28 Preferences can be set to enable sending by or mail only, both (in preference order) or neither, as appropriate to that specific communication: Preferences can also be tailored to specific Sites (e.g. individual departments) and/or Business Units (e.g. Alumni Relations), and whether to an alternative address from their primary information. System dates in the backend are queryable for the preference, and the Source can be captured under Comments: Recording Fundraising Preference Service opt-out Within Solicit Codes (or elsewhere if desired), it is also possible to record an explicit opt-out to fundraising 3 as received through the Fundraising Regulator s Fundraising Preference Service (FPS), once this new service is live for charities in England and Wales in or shortly after May Which may appropriately incorporate other forms of marketing as well, depending on the specific nature of services offered by your organisation.

29 This data can be imported into Blackbaud Enterprise CRM, either as an CSV/XLS file or as SFTP (Secure File Transfer Protocol) if the Regulator makes that file format available. We recommend configuring a reusable import and batch template specifically for FPS to streamline this process, and Blackbaud Europe would be happy to assist as desired. The out-of-the-box duplicate matching thresholds, which can be set at adjustable percentages as you prefer, should assist with matching any such opt-outs you receive to specific constituents, although this is of course dependent on the matching data provided by each registering individual (e.g. full name, postal address, address etc) through the FPS: As with other consents and preferences, we recommend that you also setup a system-defined notification (using queries to determine the business rule for the pop-up notification) to provide an automatic and convenient display/alert of this opt-out for all or some system users:

30 6.4 Using consent Blackbaud Enterprise CRM provides a variety of functional capabilities to underpin the processes of using consent and preferences Communication processes Communications sent through different parts of Blackbaud Enterprise CRM can be categorised in a variety of ways, depending on whether they are Marketing Efforts, Event Invitations, General Correspondence, Acknowledgements, and so forth. Each area provides tailored functionality based around the needs of that type of communication. In many cases, you can also specify whether they are by Mail, or Phone (also covering SMS at present): For example, with Marketing Efforts you can define a universe of constituents, specific suppressions or exclusions, and segments, into any of which you can insert the relevant opt-in or opt-out consents. By linking such an effort to the specific repeated communication that it relates to, you can also ensure that it automatically adheres to the relevant communication preference, e.g. to send to an individual s business address if that is what s/he has requested: We recommend using built-in features such as Segments and Selections as much as possible, to standardise processes around building compliant communication lists. The Show this Selection in the Query Designer feature is especially useful, enabling you to build Yes/No suppression or inclusion lists

31 that can easily be reused for communications and other activities requiring consent e.g. you need only selected Yes or No (as appropriate) without rebuilding the segment from scratch each time. Other standard suppressions such as Deceased or Inactive are also excluded automatically from most communication areas, a real benefit to using the built-in functionality. Additionally, Communication Templates enable you to construct one or several reusable templates around the most common inclusions and exclusions so that they are automatically inserted into each effort that utilises that template: This is just a small selection of the features available to assist as you use the consents and preferences that you have collected and recorded. There are too many areas of functionality to list each one here, but we recommend that you carefully consider how each communication or activity undertaken by your organisation will be managed through the system to take account of the consents and preferences held. In addition to constituent based flags, consider the contact-based flags pertaining to specific addresses, s etc enabling you to block usage of those where applicable:

32 6.4.2 Other key processes We also recommend that you use naming conventions as well as query folders and other categories where available throughout the system to enable a systematic approach to using consent. Likewise, create a suite of checking queries (using the out-of-the-box Query tool) that you can run daily, weekly or monthly to detect any anomalies in the consents and preferences data (e.g. each one written so that it should return zero results unless there is an error). You can also create linked datalists, reports and/or alerts based off these data audit queries. For activities that utilise personal data held in the public domain, such as data enrichment services, wealth screening prospect research and social listening, ensure that your Privacy Notice (e.g. containing your data protection statement that sets out how you use data) is explicit and unambiguous in covering these. You may also require explicit affirmative consent to these specific processing activities, in which case services such as Social Media Finder and WealthPoint in Blackbaud Enterprise CRM can be configured to run per a specific query/batch selection. Whenever undertaking fundraising and other marketing processes, try to do so within the system if possible, rather than exporting data out as this may reduce the opportunities malicious actors may have to obtain unauthorised access to your data. For example, Blackbaud Enterprise CRM contains out-of-thebox functionality for managing the various processes around prospect/supporter research, so that s, forms attachments etc do not need to be sent outside of the system as part of this workflow: Finally, ensure that you have considered processes for handling any external requests. For example, it possible to produce a custom Subject Access Request report from within Blackbaud Enterprise CRM, in instances where an individual has requested to receive a copy of all data held about him or her, which you are obliged to provide (once you have confirmed their data via appropriate data security checks):

33 Please contact Blackbaud Europe if you would like any assistance with developing a custom SAR report for your organisation s specific needs, or need any other help with appropriately utilising the data held in Blackbaud Enterprise CRM.

34 7 everydayhero 7.1 Process: Donors As part of the donation screen the donor is prompted if they would like to receive Further Communication from the charity. The tick box is opt in and is not ticked by default, which meets best practice guidelines. The wording above the text box details that this is consent for: Post SMS Telephone It is also worth noting that the wording begins with If you are new to [CHARITY NAME]. The intention of this is to ensure that an existing supporter who is already on your database will not override any existing consents by not opting in at this stage. The payment form is currently under redevelopment and will be rolled out later this year, with improved mobile optimisation and additional fields to capture more granular consent. Until that time, it is our recommendation that, where consent is given that the charity follow up with the donor to thank them for their gift and ask them to confirm their more granular consent through a form on their own website. This data is made available to you through the Heroix Reports and the opt-in is included in the field Opt-in as shown below. A value 1 indicates positive consent from that donor.

35 7.2 Process: Fundraisers When a fundraiser creates a new page in everydayhero they will be asked to accept the site s Terms and Conditions, which contain the following clause: How your chosen charity will manage your data Your chosen charity would like to contact you to thank you for your support and, occasionally, to let you know about their projects and activities by post and telephone. They will not share your data and you can unsubscribe at any time. If you would rather not receive such information please contact your chosen charity so they can amend your preferences. There are no specific opt in boxes provided during this sign up process. The addition of further preference control is planned for fundraisers to control their communication preferences however, the fundraiser account is an everydayhero account and they may create pages for multiple charities. Therefore, the preference centre functionality will only serve to control preferences in respect of everydayhero communication, not charity communication. Accordingly, there is no Opt-in value in the Heroix reporting. It is our recommendation that following page creation, the charity contacts the fundraiser and directs them to their own preference centre.