GDPR and external forms

This page shows how to ensure data privacy when you collect personal data on the website and store data in an external system. In this example we collect an email address from the visitor in a web form, ask the visitor for their consent, and store the data in IBM Watson Marketing. The example uses the Magnolia External Forms IBM module and the Magnolia Data privacy API.

Installation

Install the External Forms module which is an EE Standard module. The module is not bundled with Magnolia by default.

Required artifacts:

• External forms: eenders external forms as Magnolia forms.

• External forms IBM: example implementation for the IBM Watson Campaign Automation tool.

•  External forms Infusionsoft: not needed, you can exclude this.
•  External forms Eloqua: not needed, you can exclude this.

How the example works

External forms IBM adds a page named watsonFormSample in the Pages app. The page contains a form with an email field. The form was created in IBM Watson and is rendered by Magnolia.

When a visitor types their email address into the field and submits the form Magnolia processes the input using an ExternalFormService named ibm. Magnolia asks the visitor to give consent for storing personal data and how long that consent should be valid.

The example uses Magnolia's default data privacy mechanism from the magnolia‐privacy‐visitor‐manager module which is a submodule of the Privacy module. A custom visitor reference searcher called info.magnolia.extforms.consent.WatsonReferencesSearcher processes the personal data on the form.

Similar to the IBM Watson example, you can connect to a different external marketing automation tool or your own CRM system. See the examples for Eloqua and InfusionSoft. You need to render the forms created in the external system and process the submitted data in Java or JavaScript/Nashorn. For data privacy, use the Magnolia default VisitorManager or implement your own.

Configuring the IBM Watson sample

To enable the sample with your implementation of IBM Watson Campaign Automation, follow the steps in the sections below.

We assume that you are familiar with IBM Watson Campaign Automation.

Connecting to the external database

1. If you do not already have one, create a Single Opt-In database in your Watson Campaign Automation account. Make sure that Email is one of the fields in your database. 
2. Once created, open the additional details and copy the Database ID.
   
3. In Magnolia, open the configuration of the magnolia-privacy-visitor-manager module: Configuration app > /modules/visitor-manager/config/visitorReferencesSearchers/watson/databasesIds
4. Add a property node under databaseIds with the Database ID you copied previously as the value.
   The name of the property node is unimportant. You can add as many database ids as required. 
5. In Magnolia, open the configuration of the magnolia-external-forms-ibm module: Configuration app > /modules/external-forms-ibm/config
6. Add your IBM Watson credentials for the three property nodes:
   • clientId
   • clientSecret
   • refreshToken

Creating an external web form with a GDPR-aware email field

If you already have an IBM Watson Marketing Automation web form with an Email field, connect to it directly in the watsonFormSample page External Form component. 

The External Form component in the watsonFormSample page extends the default externalForm component and is preconfigured to:

• Fetch data from IBM Watson once the site URL is provided.
• Ask for visitor consent before submitting the form by displaying consent checkboxes.
• Send the visitor an opt-in email for the second phase of the opt-in procedure.

To create an external web form and connect it to Magnolia:

1. In your IBM Watson Automation Campaign database, create a new standard web form.
2. Keep the default fields in the new form and follow the instructions in the IBM wizard. 
3. Publish the form.
4. On the Publish Confirmation page, click Publish Site.
5. In the Site Settings, copy the site URL. For example: http://www.pages03.net/trial-magnoliainternational/<sitename>/Form
6. In Magnolia, go to the Pages app and open the watsonFormSample page: http://localhost:8080/magnoliaAuthor/.magnolia/admincentral#app:pages:detail;/watsonFormSample:edit. 
7. Edit the External Form sample component to add the URL of the site you just published.
   
   The component can now fetch data from IBM Watson Automation Campaign.

Viewing consent in Magnolia and IBM Watson Campaign Automation

Preview the watsonFormSample page in the Pages app. When a visitor submits their email address in the form, they are asked to give consent for their personal data to be processed.

Once they have checked the box, their email address appears in the Tools > Visitors app. However, no consent is recorded until the double opt-in process is complete. You can see this by selecting the item in the Visitors app and clicking Update consent.

To complete the double opt-in process in this sample, the visitor must follow a link contained in an email that is sent to them and click Proceed to confirm their consent. The email visitors receive is preconfigured in the  Opt-in Email  tab of the External Forms component. See GDPR and Forms for details about configuring email options and consent duration settings.

Once the visitor confirms their consent, you can see a record of it in the Visitors app:

In the Visitors app, click Show dependencies to see the link to external sources (in this example: IBM Watson Campaign Automation). The clickable link takes you to your Watson dashboard where you can see an entry for the visitor along with the consent recorded.

 

Note that the other data privacy features provided by Magnolia can be used with an external source: send all data (export from JCR but also JSON from Watson), forget a visitor, delete a visitor's data (request sent to Watson).