GDPR and external forms

This page shows how to ensure data privacy when you collect personal data on the website and store data in an external system. In this example we collect an email address from the visitor in a web form, ask the visitor for their consent, and store the data in IBM Watson Marketing. The example uses the Magnolia External Forms IBM module and the Magnolia Data privacy API.

How the example works

The External Forms IBM module adds a watsonFormSample page in the Pages app. The page contains a form with an email field. The form was created in IBM Watson and is rendered by Magnolia.

When a visitor types their email address into the field and submits the form, Magnolia processes the input. Magnolia uses an ExternalFormService named ibm to process the form data. Magnolia asks the visitor to give consent for storing personal data and how long that consent should be valid.

The example uses Magnolia's default data privacy mechanism. The mechanism records the consent in the Visitors app Magnolia and links to IBM Watson as the external data storage. The default privacy mechanism comes from magnolia‐privacy‐visitor‐manager which is a submodule of the Privacy module. A custom visitor reference searcher called info.magnolia.extforms.consent.WatsonReferencesSearcher processes the personal data on the form.

Similar to the IBM Watson example, you can connect to a different external marketing automation tool or your own CRM system. See the examples for Eloqua and InfusionSoft. You need to render the forms created in the external system and process the submitted data in Java or JavaScript/Nashorn. For data privacy, use the Magnolia default VisitorManager or implement your own.

Installation

Install the External Forms module which is an EE Standard module. The module is not bundled with Magnolia by default.

Required artifacts:

• External forms: eenders external forms as Magnolia forms.

• External forms IBM: example implementation for the IBM Watson Campaign Automation tool.

•  External forms Infusionsoft: not needed, you can exclude this.
•  External forms Eloqua: not needed, you can exclude this.

Configuration

Connecting to IBM Watson database

1. Create a Single Opt-In database in Watson Campaign Automation account.
2. Make sure that Email is one of the fields in your database. 
3. Open the additional details and copy the Database ID.
   
4. In Magnolia, go to Configuration app > /modules/visitor-manager/config/visitorReferencesSearchers/watson/databasesIds
5. Add a watsonid property node under databaseIds and set its value to the Database ID you copied earlier. The name of the property is arbitrary. You can add as many database IDs as required. 
6. Go to Configuration app > /modules/external-forms-ibm/config
7. Add your IBM Watson credentials for the three properties:
   • clientId
   • clientSecret
   • refreshToken

Creating an external web form with a privacy-aware email field

If you already have an IBM Watson Marketing Automation web form with an Email field, add the form on the watsonFormSample page. Use the External Form component. The component extends the default externalForm component and does the following:

• Fetches a form from IBM Watson as configured in site URL.
• Asks for visitor consent before submitting the form. The consent is given by checking a box.
• Sends the visitor an opt-in email for the second phase of the opt-in procedure.

To create an external web form and connect it to Magnolia:

1. In your IBM Watson Automation Campaign database, create a new standard web form.
2. Keep the default form fields and follow the instructions in the IBM wizard. 
3. Publish the form.
4. On the Publish Confirmation page, click Publish Site.
5. In Site Settings, copy the site URL, for example http://www.pages03.net/trial-magnoliainternational/<sitename>/Form
6. In Magnolia, go to the Pages app and open the watsonFormSample page: http://localhost:8080/magnoliaAuthor/.magnolia/admincentral#app:pages:detail;/watsonFormSample:edit. 
   
7. Edit the External Form sample component. Add the URL of the site you just published.
   

The component can now fetch data from IBM Watson Automation Campaign.

Viewing consent in Magnolia and IBM Watson Campaign Automation

1. Preview the watsonFormSample page in the Pages app.
2. Fill the form with your email address.
3. Give consent to processing personal data.
   
4. Open the Tools > Visitors app. Your entry as a visitor is created but no consent to storing personal data is recorded yet until the double opt-in process is complete. You can see this by selecting the item in the Visitors app and clicking Update consent.
   
5. Complete the double opt-in process. Open your email inbox and click the link in an email that was sent to you. Click the Proceed button on the web page to confirm your consent.
   
   The email message sent to visitors is configured in the  Opt-in Email  tab of the External Forms component. See GDPR and Forms for details about configuring email options and consent duration settings.
   
   
6. Once a visitor confirms their consent, you can see a record of it in the Visitors app.
   
7. Click Show dependencies to see the link to the external source, in this case IBM Watson Campaign Automation.
    
   The link takes you to your Watson dashboard where you can see an entry for the visitor along with the consent recorded.
   

You can also use other Magnolia data privacy features with an external source:

• Export all data (export from JCR but also JSON from Watson)
• Forget a visitor
• Delete a visitor's data (request sent to Watson)