GDPR Compliance Checklist for Your WiFi Portal

Why This Matters

The GDPR, and the UK GDPR that mirrors it, require a lawful basis for collecting personal data such as email addresses, and for marketing emails that basis is normally consent. A portal that pre-ticks the marketing box, or folds marketing into the WiFi terms, does not obtain valid consent. This checklist walks through the settings that matter. It is general information, not legal advice; for your situation, speak to a qualified adviser.

Step 1: Enable the Explicit Consent Checkbox (NOT Pre-Ticked)

In Portal Builder, on the Form tab, switch on Enable GDPR Mode so the login shows consent checkboxes. Auto Marketing Opt-In is off for every venue; keep it off, because it would opt every guest in without showing a box, which is exactly what Recital 32 of the GDPR rules out when it says silence, pre-ticked boxes or inactivity do not constitute consent.

Use separate, unticked marketing consent. Every VoqadoWiFi login does this through the explicit consent form: the marketing box starts unticked and each choice is stored with its wording and time.

Write the Consent Text in plain words that say who will contact the guest and about what: "I agree to receive marketing emails from [Venue name] about offers, events and news." Never let "I agree to the terms" stand in for marketing consent.

Step 2: Link Your Privacy Policy URL

Add your Privacy Policy URL under Marketing Consent on the Form tab. Host the notice on your own website, not in a shared document that can be moved or deleted. Article 13 of the GDPR lists what it must say, including who you are, what you collect and why, who receives it (for example VoqadoWiFi and Mailchimp as processors), how long you keep it, and how guests can use their rights. Our guest WiFi privacy notice template is a starting point to adapt.

Step 3: Separate Marketing Consent from Terms Acceptance

Consent to marketing must be separate from accepting the WiFi terms. On the VoqadoWiFi login, guests see two boxes:

• WiFi terms (required): "I accept the WiFi terms of use." The guest cannot connect without it.
• Marketing (optional): "I agree to receive marketing emails from [Venue name]." The guest can connect without it.

Set your terms in Portal Builder, Deploy, Terms of Service. Guests who leave the marketing box unticked still get online and still count in your visit data, but they must not receive marketing emails. Campaigns and the Mailchimp sync rely on the consent recorded at login, which comes only from that marketing box; accepting the terms is never treated as marketing consent.

Step 4: Configure Data Retention (Auto-Delete)

The GDPR's storage limitation principle (Article 5(1)(e)) says personal data may be kept no longer than necessary, but the law does not set a number. Decide your period (for example, 24 months after a guest's last visit), write down why, and state it in your privacy notice.

VoqadoWiFi does not yet delete inactive guests on a schedule from the dashboard. Until it does, review your list against your period every few months, and contact us to have records older than it removed.

Step 5: Enable GDPR Export and Deletion Requests

Guests can ask for a copy of their data or for it to be deleted, and under Article 12(3) you must answer without undue delay and within one month (extendable by two months for complex requests).

• Access requests: in CRM, export your guests (the "all guests" option includes everyone, with their consent status) and send the guest their own row.
• Deletion requests: the preference page linked from VoqadoWiFi's post visit emails has a Delete my data option, which files a request that a person completes and confirms by email within 30 days. If a guest asks you directly, contact us with their email address.

Keep a simple log of every request: date received, date answered, and what was done.

Step 6: SMS Consent (If Collecting Phone Numbers)

If you switch on the phone field, marketing texts need their own consent, separate from email. Turn on SMS Consent in the Form tab and write the text so it names texts specifically: "I agree to receive marketing text messages from [Venue name]. Reply STOP to opt out." In the UK, the ICO's PECR guidance treats texts as electronic mail, which needs specific consent unless the narrow soft opt-in applies. VoqadoWiFi records SMS consent but does not send text messages.

Step 7: ICO Registration Reminder

UK organisations that process personal information must pay the ICO data protection fee unless they are exempt. Check the ICO site for the current tiers and whether an exemption applies to you. You remain the controller of your guests' data; VoqadoWiFi processes it on your behalf. This applies whatever WiFi platform you use.

Step 8: Test the Consent Flow End-to-End

Join your guest SSID with a test phone. On the portal, check that both boxes start unticked, the form will not submit without the terms box, the form does submit with only the terms box ticked, the privacy policy link opens, and the page is served over HTTPS (padlock in the address bar). Then find the test guest in CRM: marketing should show as not opted in. If it shows opted in when you left the box unticked, contact us straight away.