The GDPR

[graphicz]

Problem is people are being told to look for the padlock and not seeing it may be an issue. Also any newsletter signups or anything on an 'ordinary' page will be problematic.

Also, if SSL is selected for Checkout, Login and Account details pages, the Contact us page (http://www.webeg.net/abc/cgi/mf00000...CTION=SHOWFORM) will be loaded as http and therefore insecure. The input boxes will therefore attract the browsers' increasingly unsettling popup warnings.

Finally Barclays ran a TV advert through the Christmas season about internet fraud telling people to 'Look for the padlock', the suggestion being that if there is no padlock the site may be suspect:

https://www.youtube.com/embed/vO1HVvgQCWA

[graphicz]

Hi Sarah

Who are you hosted with? I will post some alternative http to HTTPS redirects that work. Heartinternet for example needs a particular code.

These are the redirects I use - uncomment the one (only one) you want to use:

## Write all pages to https: uncomment if wanted
#RewriteEngine On
#RewriteCond %{HTTPS} off
#RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

##OR

#RewriteEngine On
#RewriteCond %{HTTPS} !=on
#RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

## OR ##

#RewriteEngine On 
#RewriteCond %{SERVER_PORT} 80 
#RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

## OR ##

# Forcing HTTPS
RewriteCond %{HTTPS} !=on
# Pages to Apply
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

#EDIT: ***** Please note – if you’re on a Heart Internet server, you will need to use: ******
# All calls go to SSL
#RewriteEngine On
#RewriteCond %{ENV:HTTPS} !=on
#RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

It doesn't work if it is too high up the htaccess, it needs to be after pretty much everything else and before the 404/301 page redirects (after domain 301 redirects) like this:

# Turn on Expires and set default to 0 
ExpiresActive On 
ExpiresDefault A0 
## EXPIRES CACHING ##
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg "access plus 1 year"
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/gif "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/pdf "access plus 1 month"
ExpiresByType text/x-javascript "access plus 1 month"
ExpiresByType application/x-shockwave-flash "access plus 1 month"
ExpiresByType image/x-icon "access plus 1 year"
ExpiresDefault "access plus 2 days"
</IfModule>
## EXPIRES CACHING ##

# compress all text, js, css & html:
 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/x-javascript 

<IfModule mod_deflate.c>
  # Compress HTML, CSS, JavaScript, Text, XML and fonts
  AddOutputFilterByType DEFLATE application/javascript
  AddOutputFilterByType DEFLATE application/rss+xml
  AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
  AddOutputFilterByType DEFLATE application/x-font
  AddOutputFilterByType DEFLATE application/x-font-opentype
  AddOutputFilterByType DEFLATE application/x-font-otf
  AddOutputFilterByType DEFLATE application/x-font-truetype
  AddOutputFilterByType DEFLATE application/x-font-ttf
  AddOutputFilterByType DEFLATE application/x-javascript
  AddOutputFilterByType DEFLATE application/xhtml+xml
  AddOutputFilterByType DEFLATE application/xml
  AddOutputFilterByType DEFLATE font/opentype
  AddOutputFilterByType DEFLATE font/otf
  AddOutputFilterByType DEFLATE font/ttf
  AddOutputFilterByType DEFLATE image/svg+xml
  AddOutputFilterByType DEFLATE image/x-icon
  AddOutputFilterByType DEFLATE text/css
  AddOutputFilterByType DEFLATE text/html
  AddOutputFilterByType DEFLATE text/javascript
  AddOutputFilterByType DEFLATE text/plain
  AddOutputFilterByType DEFLATE text/xml

  # Remove browser bugs (only needed for really old browsers)
  BrowserMatch ^Mozilla/4 gzip-only-text/html
  BrowserMatch ^Mozilla/4\.0[678] no-gzip
  BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
  Header append Vary User-Agent
</IfModule>
 
 ## Gzip compression
<ifModule mod_gzip.c>
mod_gzip_on Yes
mod_gzip_dechunk Yes
mod_gzip_item_include file .(html?|txt|css|js|php|pl)$
mod_gzip_item_include handler ^cgi-script$
mod_gzip_item_include mime ^text/.*
mod_gzip_item_include mime ^application/x-javascript.*
mod_gzip_item_exclude mime ^image/.*
mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</ifModule>
 
# Set up caching on media files for 1 year (forever?) 
 <FilesMatch ".(flv|ico|pdf|avi|mov|ppt|doc|mp3|wmv|wav)$"> 
 ExpiresDefault A29030400 
 Header append Cache-Control "public" 
 </FilesMatch> 
 
# Set up caching on media files for 1 week 
 <FilesMatch ".(gif|jpg|jpeg|png|swf)$"> 
 ExpiresDefault A604800 
 Header append Cache-Control "public" 
 </FilesMatch> 
 
# Set up 7 day caching on commonly updated files 
 <FilesMatch ".(xml|txt|html|js|css)$"> 
 ExpiresDefault A604800 
 Header append Cache-Control "proxy-revalidate" 
 </FilesMatch> 
 
## Force no caching for dynamic files 
 <FilesMatch ".(php|cgi|pl|htm)$"> 
 ExpiresActive Off 
 Header set Cache-Control "private, no-cache, no-store,
 Header set Pragma "no-cache"  
 </FilesMatch>
 
Options +FollowSymLinks

RewriteEngine on

RewriteBase /

## force "www"

RewriteCond %{HTTP_HOST} ^domain\.co\.uk$ [NC]
RewriteRule ^(.*)$ http://www.domain.co.uk/$1 [R=301,L]
## Add if SSL
#RewriteCond %{HTTP_HOST} !^$
#RewriteCond %{HTTP_HOST} !^www\. [NC]
#RewriteCond %{HTTPS}s ^on(s)|
#RewriteRule ^ http%1://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

## remove 'index'

RewriteRule ^index\.(php|html?)$ http://www.domain.co.uk/ [R=301,L]

## 301 redirect alternate domain names 

RewriteCond %{HTTP_HOST} ^www.anotherdomain.co.uk$ [NC,OR]

RewriteCond %{HTTP_HOST} ^anotherdomain.co.uk$ [NC]

RewriteRule (.*) http://domain.co.uk/$1 [R=301,L]

## Write all pages to https: uncomment if wanted
#RewriteEngine On
#RewriteCond %{HTTPS} off
#RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

##OR

#RewriteEngine On
#RewriteCond %{HTTPS} !=on
#RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

## OR ##

#RewriteEngine On 
#RewriteCond %{SERVER_PORT} 80 
#RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

## OR ##

# Forcing HTTPS
RewriteCond %{HTTPS} !=on
# Pages to Apply
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

#EDIT: ***** Please note – if you’re on a Heart Internet server, you will need to use: ******
# All calls go to SSL
#RewriteEngine On
#RewriteCond %{ENV:HTTPS} !=on
#RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}


##Error Pages


ErrorDocument 401 /not-found.html

ErrorDocument 400 /not-found.html

ErrorDocument 403 /not-found.html

ErrorDocument 500 /not-found.html

ErrorDocument 404 /not-found.html


##To redirect the contents of a whole directory to another:

#RewriteRule ^subdirectory/(.*)$ /anotherdirectory/$1 [R=301,NC,L]

## Page redirects

#Redirect 301 /acatalog/old-page.html http://www.domain.co.uk/acatalog/new-page.html

The other thing that messes things up is that if you elect to have SSL on the whole site in business settings payment and security, Sellerdeck does NOT rewrite

<actinic:variable name="CatalogURL" />

to the secure form. So if you have coded any/many URLs with this variable they will break the padlock. Sellerdeck expect you to trawl through the site changing

<actinic:variable name="CatalogURL" />

to

<actinic:variable name="SSLCatalogURL" />

which can be a pain.

You cannot enter https in the non SSL bit of network settings but this is the workaround:

Tick SSL on login and checkout and complete the SL and non SSL parts of the network settings apropriately.

Export the network settings

Change to SSL on whole site in business settings.

Edit all the http in the exported network settings file to https and import.

All will now be well.

I have done this a few times now and lknow it to be so. Example network settings follow. To check for causes of broken padlocks use: https://www.whynopadlock.com/

EG:

HTTPPROXYMODE	0
HTTPPROXYADDRESS	
HTTPPROXYPORT	80
HTTPPROXYUSER	
HTTPPROXYPASSWORD	
FTPPROXYMODE	0
FTPPROXYADDRESS	
FTPPROXYPORT	21
FTPPROXYUSER	
FTPPROXYPASSWORD	
SCRIPTID	1
SCRIPTEXT	.pl
SMTPHOST	localhost
WEBSITEURL	https://www.webeg.co.uk/abc/
IGNOREPASSIVEERRORS	true
USERELATIVECGIURLS	false
PATHTOPERL	/usr/local/bin/perl
USEENHANCEFTP	true
FTPBUFFERSIZE	4
FTPCLIENTTIMEOUT	15000
FTPRETRYDELAY	3000
FTPKEEPALIVEINTERVAL	30000
FTPSILENT	false
FTPMAXRETRIES	3
FTPCONNECTTIMEOUT	25000
SMTPAUTHREQUIRED	false
SMTPUSERNAME	
SMTPPASSWORD	
COMPRESSIONPACKETSIZE	1024
COMPRESSEDUPLOAD	true
SSLCATALOGURL	https://www.webeg.co.uk/abc/acatalog/
SSLCGIBINURL	https://www.webeg.co.uk/abc/cgi/
SSLPATHFROMCGITOCATALOG	../acatalog/
SSLFTPHOST	ftp.webeg.co.uk
SSLFTPUSERNAME	webegxxxx
SSLFTPPASSWORD	xxxxxxxxxxx
SSLPATHTOCGIBIN	public_html/abc/cgi/
SSLUSEPASSIVEFTP	false
CATALOGURL	https://www.webeg.co.uk/abc/acatalog/
ONLINESTOREFOLDERNAME	acatalog
CGIBINURL	https://www.webeg.co.uk/abc/cgi/
PATHFROMCGITOCATALOG	../acatalog/
FTPHOST	ftp.webeg.co.uk
FTPUSERNAME	webegxxxx
FTPPASSWORD	xxxxxxxxxxx
PATHTOCGIBIN	public_html/abc/cgi/
USEPASSIVEFTP	false
FTPPATHFROMCGITOCATALOG

[saucysal]

Been reading up Google's Advice

I have today, orders being slack, been reading up on Google's advice, straight out of the horse's mouth, about ssl. They say that it must be installed on pages that handle customers' names, addresses, email addresses and telephone numbers, and passwords and any payment details. This means pages handling registrations, logins and Checkout. In Sellerdeck this can easily be done with a tick of a Checkbox. It does NOT say that the whole site needs to be in ssl.

Sarah

[saucysal]

SSL whole site?

I do not understand why an ssl certificate needs to be applied for the whole site. We have it applying to the registration/login system and to the Checkout. Customers do not enter any personal information anywhere else. Having it for the whole site messes up existing links in search engines and elsewhere. A couple of years ago I tried to set up an .htaccess file to redirect https to http and it broke the site each time - wasted a lot of time trying to get it to work and had to give up. I guess I will have the same problem with the reverse. I do not want to change to Sellerdeck 365 to get the .htaccess code that will work.

Sarah

[brucet]

We recently published a blog article with some useful information:
http://www.sellerdeck.co.uk/2017/12/14/need-know-gdpr/

We will be following this up in due course with more tangible information relating specifically to our own products and services

[graphicz]

Gdpr

Please read the above links and take what I say here without warranty express or implied, but...
GDPR is relatively straightforward and you can modify Sellerdeck/Actinic Desktop versions relatively simply to comply.

You need to:
1. Ask before you collect data.
2. Explain why you need the data
3. Look after the data
4. Don't share the data
5. Delete the data when asked
(If you want/need to share the data especially if you want to share it outside the EU you need to study the documents in depth and make appropriate decisions.)

Create a Privacy Policy along the lines of the link above and paste it into SD. You can paste it in addition into the Privacy Policy section of Terms and Conditions in Business Settings, or you can repace this by pasting into the Layout Code Privacy Policy Text.

In Page type Checkout Page 0 open the Layout 'Both Addresses address Fields RWD'
Comment out lines 112 and 113: (Moving in One Month RWD and Keep Details Private RWD


Copy the two layout expressions and paste them above 'Both Address Salutation RWD' line 89ish.


Open Responsive CSS, look for invoicePrivacy line 1230 and add a reference to inoviceMoving so it looks like this:

.content-area form .checkout label.rememberMeText, .content-area form .checkout label.invoicePrivacy, .content-area form .checkout label.inoviceMoving {width:85%; float:left;}

Design Text GoTo Phase 0 ID 15

Tick Show and Required of Invoice Privacy Check Status, and change Current Value to:

We do not share your data with anyone else, but we may email you from time to time with relevant information about our products and services. Please tick this box if you consent to this. <a href="info.html"><em>Privacy</em></a>

Design Text GoTo Phase 0 ID 13

Tick Show and Required of Invoice Moving Check Status, and change Current Value to:

To process and deliver your order we need to collect your name, address, email address and telephone number. Please tick here to consent to us doing this. If the box is unticked we will not be able to process your order. <a href="info.html"><em>Privacy</em></a>

You are now getting consent to collect data and to use the emails for newsletters etc. If you want to do more with the data best check the regulations yourself. We should ask if our payment processors and Mailchimp are GDRP as it is our responsibility if they collect/use data on our behalf.

Now we need to explain why we need the data.

At the bottom of the Responsive Outer Layout (or whatever is your outer layout) and before the </body> tag paste:

<script type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jquery.ui/1.10.0/jquery-ui.js"></script>
    <script>
$(function () {
    $(document).tooltip({
        content: function () {
            return $(this).prop('title');
        },
        show: null, 
        close: function (event, ui) {
            ui.tooltip.hover(

            function () {
                $(this).stop(true).fadeTo(600, 1);
            },

            function () {
                $(this).fadeOut("600", function () {
                    $(this).remove();
                })
            });
        }
    });
});
</script>

Note: If you use Fancybox this script will stop the title appearing under the fancybox large image in preference to displaying a tooltip. It is better here to use a blockif"<actinic:variable name="PageType" /> == 'Checkout Page 0'" round the JS code.

At the bottom of Javascript Header Functions paste this:

<link href="http://ajax.aspnetcdn.com/ajax/jquery.ui/1.10.0/themes/black-tie/jquery-ui.css" rel="stylesheet" type="text/css" />

At the bottom of Current Stylesheet paste:

  .red {
      color: red;
  }

You then need four bits of code to add popups to the respective checkout inputs:

title="<span class='red'>To process and deliver your order we need to collect your name. <a href='info.html'><em>Privacy</em></a></span>"

title="<span class='red'>To process and deliver your order we need to collect your address. <a href='info.html'><em>Privacy</em></a></span>"

title="<span class='red'>We need to collect your email address to communicate with you about your order. <a href='info.html'><em>Privacy</em></a></span>"

title="<span class='red'>We need to collect your telephone number to communicate with you about your order. <a href='info.html'><em>Privacy</em></a></span>"

This is where these bits go:

Both Addresses Name RWD - the first input box change to read:

<label><actinic:block if="%3cactinic%3avariable%20name%3d%22InvoiceFirstNameRequired%22%20%2f%3e" ><span id="idINVOICEFIRSTNAMElabel" class="actrequired"></actinic:block><actinic:variable name="InvoiceFirstName" /><actinic:block if="%3cactinic%3avariable%20name%3d%22InvoiceFirstNameRequired%22%20%2f%3e" >*</span></actinic:block></label>
		<div class="InvoiceField">
			<input title="<span class='red'>To process and deliver your order we need to collect your name. <a href='info.html'><em>Privacy</em></a></span>" type="text" id="idINVOICEFIRSTNAME" name="INVOICEFIRSTNAME" size="30" maxlength="40" value="<actinic:variable name="InvoiceFirstNameOnline" selectable="false" />" tabindex="NETQUOTEVAR:TABINDEXINVOICEFIRSTNAME">
		</div>

Both Addresses Line 1 RWD - the first input box change to read:

<label><actinic:block if="%3cactinic%3avariable%20name%3d%22InvoicePrompt004Required%22%20%2f%3e" /><span class="actrequired"></actinic:block><Actinic:Variable Name="InvoicePrompt004"/><actinic:block if="%3cactinic%3avariable%20name%3d%22InvoicePrompt004Required%22%20%2f%3e" />*</span></actinic:block></label>
<div class="InvoiceField">
	<input title="<span class='red'>To process and deliver your order we need to collect your address. <a href='info.html'><em>Privacy</em></a></span>" type="text" name="INVOICEADDRESS1" size="30" maxlength="200" value="<actinic:variable name="InvoiceAddress1" selectable="false" />" tabindex="NETQUOTEVAR:TABINDEXINVOICEADDRESS1" />
</div>

Both Addresses Phone RWD - the first input box change to read:

<label><actinic:block if="%3cactinic%3avariable%20name%3d%22InvoicePrompt010Required%22%20%2f%3e" /><span class="actrequired"></actinic:block><Actinic:Variable Name="InvoicePrompt010"/><actinic:block if="%3cactinic%3avariable%20name%3d%22InvoicePrompt010Required%22%20%2f%3e" />*</span></actinic:block></label>
<div class="InvoiceField" >
	<input title="<span class='red'>We need to collect your telephone number to communicate with you about your order. <a href='info.html'><em>Privacy</em></a></span>" type="tel" name="INVOICEPHONE" size="20" maxlength="25" value="<actinic:variable name="InvoicePhone" selectable="false" />" tabindex="NETQUOTEVAR:TABINDEXINVOICEPHONE" />
</div>

Both Addresses Email RWD - the first input box change to read:

	<label><span id="idINVOICEEMAILlabel" <actinic:block if="%3cactinic%3avariable%20name%3d%22InvoicePrompt012Required%22%20%2f%3e" /> class="actrequired"</actinic:block> ><Actinic:Variable Name="InvoicePrompt012"/> <actinic:block if="%3cactinic%3avariable%20name%3d%22InvoicePrompt012Required%22%20%2f%3e" />*</actinic:block></span></label>
	<div class="InvoiceField" >
      <input title="<span class='red'>We need to collect your email address to communicate with you about your order. <a href='info.html'><em>Privacy</em></a></span>" type="email" id="idINVOICEEMAIL" name="INVOICEEMAIL" size="30" maxlength="255" value="<actinic:variable name="InvoiceEmail" selectable="false" />" tabindex="NETQUOTEVAR:TABINDEXINVOICEEMAIL" />
   </div>

These give popup boxes explaining why you need the data. Try it at http://www.webeg.co.uk/gdpr/

When you download the order and open the order in 'Orders' the boxes are ticked. The wording ideally needs changing and I think you might need Crystal Reports to do this, however you will know regardless of the caption that if the two boxes are ticked that consent is given.


If yu want them to appear in the customer email checkout the AUG page 127 http://portal.sellerdeck.co.uk/index...ed-user-guide1

All without prejudice, and without any warranty express or implied. Please satisfy yourself with the requirements laid out in the documents referred to in above posts.

[graphicz]

GDPR Privacy Policy

Nice downloadable one available here: http://vinciworks.com/blog/gdpr-read...licy-template/

[graphicz]

Encryption

Windows has built-in encryption (pro versions) called BitLocker Drive Encryption

If you don't want to encrypt your main drive you can use a second or external drive for Sellerdeck data and encrypt that.

You can make external drives behave like internal drives here: https://garvis.ca/2013/02/21/convert...ndows-devices/

[graphicz]

Read all about it....

https://www.itgovernance.co.uk/resou...th-the-eu-gdpr

https://ico.org.uk/media/1624219/pre...r-12-steps.pdf

https://ico.org.uk/for-organisations...y-and-control/

https://ico.org.uk/for-organisations...e=pdf&patch=38

(Without prejudice) It seems that there needs to be no inherent change in the software as regards the operation of the site, the privacy policy needs revision and it may be that a revised privacy policy is what SD is going to roll out. You will also need to have systems in place for the supply of data to the customer in an easily machine readable form and show you have the ability to delete it. You must also ensure you keep the data securely. Here is some stuff on privacy policy:
https://www.econsultancy.com/blog/69...-with-examples

You may also need to have popups by the email fields of the checkout for example stating what the data is used for, you may also need to obtain express rather than implied consent to the collection of data prior to collecting it so it may be some form of consent will need to precede the checkout process. Again, this is my guesswork and I take no responsibility! Please do read it up yourselves...


Image from : https://www.econsultancy.com/blog/69...-with-examples

[graphicz]

Thanks Bruce

I think a summary article would be useful for your customers and unlikely to expose your company to risk.

There seems to be a reluctance to give information

[brucet]

Sorry, that was a bit of a mouthful. We will not cause our users to be non-compliant. That's all I can say at this stage.

[graphicz]

At this stage I can only say that we will not be a reason why our users cannot be compliant.

Thanks Bruce - please re-read and re-phrase?

[brucet]

Hi Jonathan

We are actively working towards publishing such a statement regarding our software. At this stage I can only say that we will not be a reason why our users cannot be compliant. We will implement whatever changes are necessary, and provide as much additional information as we can.

However, please be aware that cannot provide legal advice with regard to GDPR. Every business owner will have to familiarise themselves with the new rules, and take responsibility for their own compliance.

With regard to older versions, I can't be specific ATM. However, v9 is approaching its tenth year! There have been many security changes in the meantime. Some of them are connected with other changes in the code. It will not be technically feasible, or indeed affordable, to port all of them back to such an old version.

The fact is, anyone relying on such an old version is already taking an inadvisable risk with their business.

[graphicz]

Just had a client on the phone and SD was filling his head with all sorts of scare stories that his site (v9) would probably stop working (guess what) unless he upgraded.

Please can Sellerdeck post a summary document of the changes neccessary to the software to make sites GDPR compliant and a summary document about what the GDPR requirements actually are and how they will impact Sellerdeck users?

AND telling everyone to upgrade is not a solution!

[Mike Hughes]

Can I just add that should there be changes such as encryption of customer's personal details to protect privacy that these changes be limited to the customer's personal details and not the whole database.

I know there are quite a few of us, myself included, that query the database directly for things like stock management, google shopping feeds, pricing adjustments, etc so the ability to keep doing this is important.

I'd imagine the people that have developed tools to work with sellerdeck would also have similar requirements.

Mike