For AI agents: the complete documentation index is available at https://docs.clickmax.io/en/llms.txt, the full documentation bundle is available at https://docs.clickmax.io/en/llms-full.txt, and this page is available as Markdown at https://docs.clickmax.io/en/guides/data-protection-in-practice.md.
  • English

      • How do I stay compliant with data protection law?

      Anyone running digital marketing handles personal data all the time: name, email, phone, browsing behaviour, purchase history. This guide covers the part that depends on how you configure the platform — under Brazil's LGPD, or whichever data protection law applies to you.

      Before you start

      • Role: Owner or Admin.
      • This guide is operational guidance, not legal advice. Decisions about your lawful basis and your privacy policy belong to your legal advisers.

      The form must make clear what the person is agreeing to and what the data will be used for. A generic acceptance in small print is not informed consent.

      Ask only for what you will use. Every unnecessary field is personal data you now have an obligation to protect — and it drags your conversion down for free.

      2. Imported bases

      When you import contacts you confirm that they were obtained in accordance with applicable data privacy laws. That is not a formality: you need a lawful basis for talking to those people.

      A bought base, or one collected without consent, is a legal problem before it becomes a deliverability problem. See migrate your contact base.

      3. Make leaving easy

      Every communication needs a clear way to stop receiving it, and the request has to be honoured on every channel — not only the one it was made on.

      4. Control internal access

      Fewer people with access to the base means less exposure. Review roles periodically and remove anyone who has left — see who can do what.

      Take particular care with exports: a spreadsheet in a shared drive is the most common way data leaks. The export screen flags which columns hold sensitive data and warns that they leave in plain text — see export to BI and spreadsheets.

      5. Handle data subject requests

      A person can ask for access to the data you hold about them, for a correction, or for deletion. Have a defined path for each:

      • Access — the contact profile gathers everything that exists.
      • Correction — edit the data on the contact.
      • Deletion — delete the contact. It is irreversible.

      Decide who on the team answers these requests, and within what time.

      6. Look after the data that leaves

      Integrations carry data outside the platform — see webhooks in practice. You remain responsible for it. Map where your data goes, and why.

      If it didn't work

      • You do not know where a contact came from: with no source recorded there is no way to reconstruct it — see UTMs and lead source.
      • The person keeps receiving messages after asking to leave: check every channel and every active automation.
      • You need to prove consent: keep a record of how and when each contact came in.