# Compliance (POPIA, Spam)

Drip CRM is designed to help you stay compliant with global data protection and communication laws, including:

* **POPIA** (South Africa’s Protection of Personal Information Act)
* **GDPR** (General Data Protection Regulation in the EU/UK)
* **Spam & Marketing Laws** (e.g. CAN-SPAM in the US, EU ePrivacy, etc.)

This page outlines the key rules and best practices for using Drip CRM responsibly.


---

## 🇿🇦 POPIA (South Africa)

The Protection of Personal Information Act governs how businesses collect, process, and store personal data.

**Key Principles**

* Collect only the data you need for a specific purpose.
* Get **consent** before adding someone to campaigns.
* Store personal information securely.
* Allow customers to request access, correction, or deletion of their data.

**Best Practices in Drip CRM**

* Use tags like “Opted-In” to mark compliant contacts.
* Keep audit logs of when/where consent was given (e.g. form submissions).
* Avoid uploading purchased contact lists.


---

## 🇪🇺 GDPR (EU/UK)

The General Data Protection Regulation is one of the strictest privacy laws globally. It applies to any business processing EU/UK citizens’ data — even if your business is not located in Europe.

**Key Principles**

* **Explicit Consent**: Users must opt-in (no pre-checked boxes).
* **Data Portability**: Users can request a copy of their data.
* **Right to Be Forgotten**: Users can request their data be deleted.
* **Transparency**: You must explain what data you collect and why.

**Best Practices in Drip CRM**

* Use double opt-in for forms to confirm consent.
* Provide clear unsubscribe links in all emails.
* Honor data deletion requests promptly via **Contacts → Delete Contact**.
* Document your privacy policy and link it on all forms.


---

## 📧 Spam & Marketing Laws

Whether you’re in South Africa, Europe, or beyond, most regions enforce laws to prevent unwanted marketing.

**Key Principles (Universal)**

* Only send marketing messages to contacts who opted in.
* Include an **unsubscribe link** in every email.
* Clearly identify your business in all communications.
* Stop messaging immediately if someone unsubscribes.

**Drip CRM Tools That Help**

* **Unsubscribe links** are automatically added to email campaigns.
* **Suppression lists** prevent you from accidentally contacting unsubscribed users.
* **Smart Lists** can segment out only “opted-in” contacts.


---

## ✅ Checklist for Compliance in Drip CRM


1. ✅ Collect explicit opt-in consent via forms.
2. ✅ Use double opt-in for EU/UK customers.
3. ✅ Tag and segment opted-in vs. non-opted-in contacts.
4. ✅ Keep unsubscribe links enabled in all campaigns.
5. ✅ Regularly clean your database of inactive or unsubscribed contacts.
6. ✅ Document your privacy policy and display it on your website and forms.


---

## 📌 Example Use Case

A South African gym collects leads through a website form:

* The form includes a checkbox: *“I agree to receive messages about promotions and bookings.”*
* Submissions are automatically tagged as *Opted-In*.
* Email campaigns are only sent to contacts with this tag.
* If a user unsubscribes, they are moved to a suppression list automatically.


---

## 🚨 Consequences of Non-Compliance

* **POPIA fines**: Up to ZAR 10 million.
* **GDPR fines**: Up to €20 million or 4% of global turnover.
* **Spam violations**: Blacklisting, domain reputation damage, loss of deliverability.