undefined | Better HN

0 pointsCodeWriter238y ago0 comments

Consider this case, startup app in a niche market, only available on US app stores, and a one man dev team that needs to focus on app dev not compliance for some regulation that could never apply to their customers. Yet needs to be sure they don’t end up giving the company to the EU because someone over there signs up on a marketing list.

That’s the startup I’m presently working on. We’ll expand beyond the US borders (and implement GDPR) when we advance to a larger revenue stream. But right now, GDPR compliance is a distraction that interferes with gaining enough traction to help us afford the engineering and legal resources to ensure such compliance.

NOTE: we delete all client data when they cancel already. And we don’t do any creepy marketing.

0 pointsCodeWriter238y ago0 comments

NOTE: we delete all client data when they cancel already. And we don’t do any creepy marketing.

0 comments

4 comments · 4 top-level

lima8y ago

> NOTE: we delete all client data when they cancel already. And we don’t do any creepy marketing.

This does sound like you'll have an easy time complying with GDPR! :)

djhworld8y ago

> _NOTE: we delete all client data when they cancel already. And we don’t do any creepy marketing_

So what's there to worry about? Sounds like you're well on your way to being compliant

If anything, this allows you to be transparent with your users too.

matwood8y ago

> NOTE: we delete all client data when they cancel already. And we don’t do any creepy marketing.

Do you inform your users what data you're collecting, why you're collecting it, and get their consent? Are you taking proper precautions with the expanded PII data (encrypting at rest for example)? You've basically covered the requirements.

> Yet needs to be sure they don’t end up giving the company to the EU because someone over there signs up on a marketing list.

What kind of FUD are people reading...if someone voluntarily gives you their email to sign up for a list that's fine. You just need to keep that they consented to receive what they agreed to. What you can't do is use that email for crap they didn't sign up to receive. Obviously normal unbsub rules apply, which in this case says forget that someone ever signed up.

1 more reply

ryanwaggoner8y ago

An admirable effort, but all the fans of this law seem to hear is "You're not 100% compliant with the GDPR? You're scummy and shady and don't care about my privacy. I hope you fail immediately because the world is better off without you."

Meanwhile they'll be using VPNs to access your site anyway :)

1 more reply

j / k navigate · click thread line to collapse