Contest: GDPR consent, CSV export and purge

Feature being rolled out. Depending on your version of BoothX, the registration form may differ from this description.

The contest asks players for their contact details before they play (or to receive their prize). It's the ideal tool for collecting qualified leads at a trade show, as long as you comply with the GDPR. BoothX helps you, but you remain responsible for the data you collect.

This article gives practical guidance; it is not a substitute for legal advice.

The registration form

Before the game, the player fills in a short form on the touch screen, with the virtual keyboard:

• the fields you choose: first name, last name, email, phone, company…;
• the mandatory consent checkbox, with your text;
• a link or text pointing to the contest rules.

Ask for the minimum: an email is often enough for a prize draw. Every extra field drives players away, and the GDPR requires you to collect only what is necessary.

Consent

The consent checkbox:

• is never pre-checked;
• must be checked to take part;
• is saved with the registration, along with its date and the text accepted.

Write a clear text, for example:

I agree that my contact details may be used by [Company] to contact me about the contest and its offers. I can withdraw my consent at any time by writing to [address].

If you want to use the contacts for marketing in addition to the contest, provide a second, separate checkbox that is optional.

Where is the data?

Registrations are stored on the booth only, with the event. BoothX does not send them over the internet. So protect the booth:

• enable the lock with a PIN code or pattern;
• enable Block unknown USB drives (Kiosk mode and security);
• encrypt the computer's disk (BitLocker on Windows, FileVault on macOS).

Exporting to CSV

At the end of the event, export the registrations in CSV format, which spreadsheets can read and most contact management tools can import. The file contains one row per registration: the form fields, the date, the consent status and the game result.

Open it in your spreadsheet choosing UTF-8 encoding so that accented characters display correctly.

Transfer the file securely to your client (no unprotected attachment on a public email service), then delete any unnecessary copies.

Purging the data

The purge permanently deletes the event's registrations from the booth. Do it:

• as soon as the export has been delivered and checked;
• at the latest, at the end of the retention period stated in your rules.

The purge asks for confirmation and cannot be undone. Anonymous statistics (number of games, wins per prize) are kept.

GDPR checklist

• Rules available at the stand (prizes, duration, terms, data controller).
• A form reduced to the bare minimum.
• An unchecked consent checkbox, with a clear text.
• A retention period announced and respected.
• The booth locked during the activity.
• Export delivered securely, then purge.

What about minors?

If your audience may include minors, set out the conditions for taking part in the rules (minimum age, parental consent) and don't collect data without the necessary safeguards.