How to grow and secure your customer base under the new POPIA regulations – Part 1

New Customers Acquisition

The creation of the Protection of Personal Information Act (POPIA) in South Africa began as early as 2013 but it took a long time to formulate.  One of the many reasons that it took so long to finalise was the question whether the South African government would be required to comply with the Act (it was finally decided that the government should also comply).

After many debates and changes to the Act, it officially came into effect on 1 July 2020 with a grace period of one year.  Companies had therefore until 1 July 2021 to ensure that they had the necessary processes and procedures in place to adhere to this watershed Act. The POPI Act covers both consumer communications as well as Business-to-Business (B2B) communications.

One thing to remember is that POPIA is not here to ‘kill’ marketing but rather to protect customers from unsolicited communications.  One of the key tenets of POPIA is consent (meaning the when, how, what, where of communications).  It will still allow organisations to market to new to file customers as well as cross-sell and upsell to their existing customer base.

It is important to bear in mind that although it may seem to be a simple task to obtain consent from your existing customer base, experts warn against this as the possibility that customers will opt-out means that you could lose access to a large portion of your customer database if you do not have a well thought through approach.

Since the 1^st of July 2021 (and earlier in a lot of cases) there have been two questions on every South African direct marketer’s mind.  Firstly, “how do I continue to send direct marketing campaigns or invitation to apply messages to new customers to grow my customer base?” and secondly, “am I allowed to send direct marketing messages to my existing customer base, and do I need consent to do this?”

In this article we will attempt to address the first question related to new customer acquisition and what POPIA allows and prohibits.  We will also give some ideas on the tools available when selecting and campaigning to new to file customers. Look out for the second part to this article, which will deal with marketing to existing customers under the new POPIA regulations.

It is important to understand and to unpack what POPIA and the intent of the Act is all about.  POPIA is strongly focused on Information Security.  There are effectively three components to POPIA which will be discussed in more detail throughout this article, namely Availability, Integrity and Confidentiality.

To know when to apply the rules of POPIA one needs to understand what ‘Direct Marketing’ means and the channels that are affected by this Act.

Direct marketing consists of any marketing that relies on direct communication or distribution to individual consumers, rather than through a third party such as mass media. Direct marketing is a promotional method that involves presenting information about your company, product, or service to your target customer without the use of an advertising middleman. It is a targeted form of marketing that presents information of potential interest to a consumer that has been determined to be a likely buyer.

Direct Marketing Approaches

Behavioural marketing is seen as direct marketing when you know the individual to whom you are marketing.  If you only send demographics to a social media platform of whom you want to approach, then it is not considered direct marketing.  If, however, you have the names of the customers, then it is seen as direct marketing.

Content marketing or advertorial marketing is only seen as direct marketing if you send it to specific or known customers.

Channels

Channels used for direct marketing include telemarketing, email marketing and SMS marketing.

When we approach the problem of “how do I continue to send direct marketing campaigns or invitation to apply messages to new customers to grow my customer base?”, it is important to be able to answer the following six questions before sending any direct marketing campaigns to new prospects.

The first question deals with the ‘where’ factor.  Where did you get the information or leads you are planning to use in your campaign? POPIA states that you must get the information directly from the customer. You are also not allowed to scrape the internet for leads as customer information available on the internet is not seen as a public record.

If you are making use of a credit bureau as part of your marketing process you are required to ensure that the credit bureau has the customer’s consent to sell the information on to you.

If you are part of a group of companies, can you sell your product to the rest of the group?  The simple answer is NO, you must get consent from the customer that you can market to them from other group companies.  If in this example, the company is part of a financial services institution, you cannot necessarily cross-market from the home loans customer base to the vehicle finance customer base. The only way around this is if you received consent at the time of the sale of the first product and you clearly mentioned the name of the other division to which the customer gave consent to be marketed from.

Cross-selling within a company, for example a retailer that is selling clothes but also offers loyalty cards and insurance products, is allowed if it is the same or similar products. Consent is required if the new product that is offered is unrelated to the existing product.

The second question is ‘what’ does the consent have to look like and how many times can I ask?  For any unsolicited marketing you should get explicit consent from the customer. The customer must explicitly opt-in i.e., not be opted-in by default with the opportunity provided to opt-out.  If the customer does not respond with an opt-in consent, then you cannot market to them, they are to be treated as opt-out. Of bigger concern, you can also only ask them once, making it particularly important to get the messaging right the first time. There are no second chances!

Furthermore, consent must be informed and be very specific.  It must be voluntary and not only included in the terms and conditions. There must be an expression of will (it cannot be by default).

The third question is ‘when’ do you need consent?  The golden rule is that you need consent when the person does not know who you are.  If they indeed do know you, but you never said you are going to use their information for marketing purposes, then you also need their explicit consent.  If you obtained their information from somewhere or from someone, for example, a referral campaign, then you will also need their consent to market to them.  For existing customers, the rule is that you have to re-consent if you are selling something vastly different from what you were selling to them before.

There are also scenarios when you do not need consent. For example,  you obtained their contact details in the context of the sale of a product or service AND you are marketing the same or similar products or services AND you told them they could object or unsubscribe when you collected their contact details (and every time you contacted them thereafter).

The fourth question is to ask if what you are doing is considered as direct marketing.  The ‘how’ factor, or “how am I communicating with the customer?”  It is direct marketing if you know who you are communicating with via any of the previously mentioned channels.  If you are doing telemarketing and have never spoken to the customer before, it is seen as unsolicited direct marketing. In this case you must ask the customer if they give consent to market to them or give them the option to unsubscribe.  In addition, there should always be an option to opt-out or unsubscribe for SMS and email marketing campaigns.

The fifth question deals with what happens if the customer unsubscribes.  Here the most important thing is to have a proper process in place to unsubscribe the customer.  If you are making use of a third-party company who is sending out marketing materials on your behalf, then you need to ensure that they have the latest unsubscribed list before sending any communications to customers.  For telemarketing the agents need to clearly disposition the customer as unsubscribed, and a proper process should be followed to ensure that the lead is removed from the dialler and the marketing campaign.

The sixth question is determining whether you have the capability to delete a customer’s information on request.  Customers can demand that all of their information is deleted but you may need limited information to ensure that the person does not receive any further marketing communications. It is recommended that you either keep the contact number or email address that you have used to market to the customer to ensure that they are not used again in any future marketing communications.

Myths

Once the six questions are answered, we turn to some interesting myths of POPIA. Some of these myths are:

• “POPIA will stop spam and kill marketing”
• “POPIA doesn’t apply to telemarketing”
• “You MUST reconsent your whole database”
• “You can just put a consent in your terms & conditions and then you are good to go”
• “You will get fined ZAR 10 million on 2 July 2021 if you do not comply”
• “You can go to jail if you do not comply”

With all the above in mind it is important to optimise your database and have a well thought through marketing approach.  The first step in this new marketing journey is to secure an opt-In database. If you obtain data from a third-party leads provider, you need to make sure that each of the customers on the list gave explicit consent to be marketed to and that they clearly stated the channels to which they consented. It is both the responsibility of the leads provider as well as the direct marketing company to ensure that they only use consented leads.

Planning for Success

Once you have a secure database it is good practice to make use of the available tools to ensure that your campaign is planned professionally.  Using the old mantra of direct marketing, namely, “target the right customer, with the right product, at the right price, at the right time, via the right channel with the right call-to-action.”

Customer – there are many tools and models available, such as risk and response models, to help prioritise your database and select the most likely customers not only to respond to your campaign but who will also be approved during the application process.  There are many external data analytic companies who can assist building these models if you do not have in-house capabilities.

Product – tools such as next-best-product models and behavioural models are available to select the best customer for your product, and the best product for your customer.

Price – the use of external repayment data is also available in certain instances to ensure that the customer will be able to afford your product.

Time – plan your marketing campaigns with seasonality in mind and optimise on delivery and response.  Also make use of specific offers and promotions that are relevant to each customer segment and thereby also build your brand and eventually loyalty when they become a customer.

Channel – market to each customer via the most relevant channel for them – email vs SMS vs telemarketing and make use of an omni-channel approach if you have multi-channel consent.

Call-to-action – it is extremely important to ensure that the way in which a customer can apply for your product is relevant and effective.  Tools such as geo-spatial data is available to enable targeting of customers in proximity of store or branch if online is not an option.

It is now, more than ever before, critically important to engage with your database in the most efficient and customer centric way and to ensure that you have a compelling offering.  Failing to do this will eventually demolish your database as once a customer has opted out or unsubscribed you will no longer be able to use this lead in any shape or form.

As consented leads are hard to obtain and expensive to generate, it is important that you have an effective marketing strategy.  Good practice is to follow an established process before communicating to new prospects.  It is recommended that you use the following steps when acquiring a database for new account acquisition:

• Ensure that the database that you purchase is consented prospects and fully POPIA compliant.  This is a dual responsibility between you and the leads provider.
• Apply segmentation and/or risk and response models to rank-order the highest probability of response or conversion.  Start marketing communication from the highest probability to the lowest.
• Apply channel preference or omni-channel communication to ensure that you target the right person via the best suitable channel.
• Use personalised or customer tailored marketing messages to target customers with the right product and a practical call-to-action.
• Positive responses should be contacted or actioned in a timely and efficient manner.
• Converting responses into sales should be a seamless process.
• Customers should always be given the option to opt-out or unsubscribe.
• If the company is also selling other products, make sure that you ask the customer if you can market other products to them at the time of sale or at a later stage.  By doing this you ensure that the customer is an opt-in prospect for cross-selling opportunities where the products that you are selling are not of a similar nature.
• After-sales customer service is one of the most important and often neglected steps in the sales process.  Emphasis should be placed on ensuring that you have a ‘happy customer’, and you continue to optimise your database.

Sometime the ‘less is more’ approach is better.  Rather target a limited audience or segment by using the highest probability of positive response or conversion first to maximise the marketing budget as well as to avoid customers opting out.  Customers with a higher probability to opt-out or unsubscribe can be targeted at a later stage or ‘best time to market to’, in order not to fill the prospect base with opt-outs and non-responders.

It is always advisable to run champion/challenger strategies when targeting new prospects.  This should include testing of different channels, different messages and different offerings or promotions.  It is also good practice to analyse the results in a timely manner, in order to make changes to your strategies and optimise your target database.

The next phase will be to optimise your existing customer base.  POPIA is a more lenient when it comes to cross-selling and up-selling to existing customers as long as you are still selling similar products and provide your customer with the option to opt-out or unsubscribe.

Keep an eye open for part two of this direct marketing article, which will address the challenges of optimising your marketing strategy for your existing customer base.

About the Author

Ulandi Steenkamp is a Client Solutions Consultant at ADEPT Decisions.

About ADEPT Decisions

We disrupt the status quo in the lending industry by providing lenders with customer decisioning, credit risk consulting and advanced analytics to level the playing field, promote financial inclusion and support a new generation of financial products.