0. What’s Changing in GDPR & Member Consent (and Why)
How Can We Help?
Summary
Version 6.0.0 of Crossmember now includes a significantly enhanced and compliant GDPR mechanism for consent to use members’ data.
Crossmember now records member consent in a structured, provable way. That means you can show what you asked, the exact text you showed, when you asked, and what the member answered. This protects members’ rights and protects the club.
Key terms (plain English)
- Privacy policy: Your club’s explanation of what data you collect, why you collect it, and how you use it.
- Consent option: An optional set of specific permission you ask for (e.g., “Include your details in the Club Yearbook”).
- Version: A snapshot of your privacy policy and consent wording at a moment in time. If you change the wording, you create a new version.
- Active vs Retired: Only one version is “Active” (the live one members see). Old versions become “Retired” (frozen for history).
- Audit trail: A tamper-resistant record of who consented to what, under which version, and when.
- Stale Consent: Consent to a policy that has become aged and reconsenting should be a priority.
Why this matters to clubs
- Proof: If someone asks, “Did I agree to this?”, you can show them the exact wording and timestamp.
- Clarity: Members see simple choices they can change at any time.
- Safety: You avoid using members’ data in a way that they didn’t agree to.
- Simplicity: Less manual tracking, fewer spreadsheets, fewer mistakes.
What’s actually changing in Crossmember
- You will create one privacy policy and set it Active.
- You will add any optional consent options (e.g. inclusion in Yearbook).
- Members will see these choices when they join, and can update them in their own Member Record.
- If you change your wording in future, you will create a new version. Old answers remain attached to the old version for proof.
- Consent to a privacy policy can (optionally) have an age by which time they become stale. Stale consent can either be just ‘flagged’ or treated as No Consent.
- MailOut has always used consent to decide who may be contacted, so you’re not guessing. New additions enable Club officials to use MailOut depending on new Consent Options
- API Now passes these GDPR consent option answers to the receipient (usually your club website) so that automated web pages can adhere to member’s wishes.
What members will see
- During Join: The same consent section as in previous versions with any additional consent options included (e.g., “Include me in the Yearbook”).
- During Renew: If the member does not “log in”, then there will no-longer be a prompt to reconsent. If the member is not logged in, we don’t know who is paying. If the member is “logged in”, they will receive a prompt to confirm or change choices.
- In their Member Record: A new section showing their consent choices and a button to enable review and reconsent at any time.
What admins will do
- Create or Update a Policy. Add any optional consent options you want to ask. Save the Policy to set it Active
- Use MailOut with built-in filters that respect consent to a member’s selected options.
- In the Member Record: Club officials will be able to consent on behalf of the member, but they will need to complete a short form stating why (in-person, phone call, email, paper) etc – the method by which they can consent on behalf of, and also a text description. This will satisfy an audit trail of consent.
- New specific and detailed GDPR reports will contain all recorded consents.
- If a member gives permission verbally (at a show or on the phone), record it with a short note (who/when/how).
What these article don’t cover
- Special rules for children’s data or high-risk processing. If you do either, talk to your committee/insurer.