Q1. Legal Basis & Consent

Do you collect explicit consent before sending marketing emails or texts?

Yes

You need documented consent for each marketing channel if you're sending marketing messages.

Q2. Legal Basis & Consent

Do you keep a record of when and how someone gave their consent?

Yes

You must be able to prove consent if asked.

Q3. Legal Basis & Consent

Do your forms include unchecked opt-in boxes or toggles for marketing consent?

Yes

Pre-ticked boxes aren’t valid under GDPR.

Q4. Privacy Notices & Transparency

Do all your website and funnel forms link to a privacy policy?

Yes

A contact needs to understand what they are consenting to at their point of entry.

Q5. Privacy Notices & Transparency

Does your privacy policy explain what data you collect, why, and who you share it with?

Yes

This is required under Articles 12–14 of GDPR.

Q6. Cookies & Tracking

Do you have a cookie banner that allows users to accept or reject non-essential cookies?

Yes

Under GDPR, consent must be given before cookies are dropped.

Q7. Cookies & Tracking

Do you list all non-essential cookies individually in your cookie/privacy policy?

Yes

You must provide clear and specific information about each cookie used.

Q8: Data Handling & Systems

Do you have a process for handling Data Subject Access Requests (DSARs)?

Yes

You’re required to respond to access, correction, and deletion requests within 30 days.

Q9: Data Handling & Systems

Do you regularly review and update your contact lists to remove outdated or unnecessary data?

Yes

GDPR requires data minimisation and accuracy.