GoHighLevel and GDPR usually get tackled from the wrong end. A company asks where the servers are, gets a reassuring answer, and looks no further. But the real risks lie elsewhere: in the spreadsheet of old contacts, in the checkbox on a form, and in the first newsletter that goes out to people who never asked for it.
In accounts I take over from someone else, I keep seeing the same picture. The whole database under one tag named after the import, with neither a date nor a source. A campaign has already gone out to it once. And today nobody can say which of those people it was okay to write to.
Where the data lives and who’s responsible for it
Data in GoHighLevel sits on servers in the United States, and the responsibility for it is yours. For your contacts, HighLevel acts as the processor and you as the controller: you decide what you upload, why, and how long you keep it.
You don’t have to sign the data processing agreement separately anywhere. According to the text on HighLevel’s website, it applies from the moment you accept the terms of service, and you can download a signed copy. Transfers to the US are covered by standard contractual clauses, and HighLevel is also certified under the EU-U.S. Data Privacy Framework. Under the agreement, HighLevel will notify you of a data breach within 72 hours at the latest, and you have thirty days to object to a new subprocessor.
One sentence in the agreement deserves attention. HighLevel counts data anonymization and running its AI features among your instructions. If you supply large customers with their own rules, you should know this before they do. I cover what to ask about other services in the article on where your data flows with AI tools.
One click on the terms of service takes care of the agreement with HighLevel. Nobody will take care of your customers’ consent for you.
Who can you email without consent?
Without consent, you may only write to your own customers, and only about your own similar products or services. Under Czech Act No. 480/2004 Coll. (the law that governs commercial messages), you may send commercial communications to everyone else only with their prior consent.
And “customer” means someone who has entered into a contract with you, even a free one. According to the FAQ on the law kept by the Czech Office for Personal Data Protection (ÚOOÚ), a lead from an inquiry isn’t a customer, and neither is a contest entrant. A purchased database, according to the office, is practically unusable for mailings. And more messages count as commercial communications than you’d expect: Christmas greetings, birthday wishes, and even a request for a review.
For a migration, another answer from the same FAQ matters most. You can’t ask people who aren’t your customers for consent by email or text message, because such a request is itself a commercial communication. That rules out the popular idea of “before the import, we’ll write to everyone and ask them to confirm they still want our news.” Consent is collected where people come on their own: on your website, in a form, when they place an order.
Migrating contacts: consent gets decided on import day
Every contact should arrive in GoHighLevel with information on where it came from and what its processing is based on. Adding it later is nearly impossible, because a year from now nobody will remember which event an address came from.
A contact’s birth certificate
Four pieces of information every contact in your CRM should have: where it came from, when, on what legal basis you work with it, and how you can prove that (a confirmed form, an order, a contract). Without them, you can’t answer the simplest question a customer or the authority can ask: why are you writing to me?
So before the import, I split the CSV into three piles. Customers with an order or a contract go into campaigns about similar services. People with documented consent go into the newsletter. Everyone else gets imported into the CRM only, with a tag and no campaigns, until they give consent themselves. I sort this way with every migration from other tools. It belongs on the list of things to check before a migration just as naturally as a data backup.
In GoHighLevel, all you need is a custom field called Legal basis with the values consent, contract, and legitimate interest, plus a tag for quick filtering. HighLevel’s help center describes exactly this. The import can add a tag to contacts right away, so you label a whole pile in one step. One trap: if you leave a DND column in the CSV, GoHighLevel switches off every channel for that contact at once. A block on email only is set through a tag and a workflow. You can then carefully wake up the customer pile with a reactivation campaign.
Ten random rows
Open the export from your old tool and pick ten random contacts. For each one, try to say where it came from, when it arrived, and how you’d prove consent. According to the authority, the burden of proof is on the sender, so consent you can’t prove counts as consent you don’t have.
What GoHighLevel can do for consent on its own
GoHighLevel has three tools for consent: a checkbox on forms, a confirmation email via a workflow, and Do Not Disturb on the contact. Together, they cover collecting consent, proving it, and unsubscribing.
You can add a consent checkbox to a form, a booking calendar, an order form, and the chat widget on your website, and the answer is saved to the contact. For the chat, the settings even offer a pre-checked box. Leave that option off, because under the GDPR (Recital 32), a pre-ticked box isn’t consent. The proof then comes from a confirmation email: the contact gets a link and only gets into the newsletter by clicking it. The authority itself recommends this process, known as double opt-in. Websites and funnels in GoHighLevel can also show a cookie banner. I cover separately how to have one in your own branding.
DND (Do Not Disturb)
A communication block on a contact in GoHighLevel, set separately for email, SMS, calls, WhatsApp, and other channels. For email, it switches on by itself when someone unsubscribes, marks a message as spam, or the address hard-bounces. Invoices and calendar notifications still get through; marketing doesn’t. So DND works as a list of people who don’t want your messages. That’s exactly the kind of list the authority expects every sender to keep.
Every commercial message must clearly identify the sender and have a working unsubscribe link. The authority recommends putting a label like “newsletter” or “promo” right in the subject line. And when someone asks you to delete their data, only an admin can delete the contact. A deleted contact can be restored for sixty days, but its conversations and notes won’t come back.
When settings won’t solve it
All this sorting isn’t worth it for a company that sends no campaigns from GoHighLevel. If you only use it to confirm bookings and send invoices, you’re answering people at their own request and don’t need the three piles. You can go through a database of a few dozen people by hand in an afternoon.
At the other end are clinics, counseling practices, and anyone collecting health data in their forms. There, settings aren’t enough, and a lawyer belongs in the picture. For the record: I’m not a lawyer, and this article isn’t legal advice. I describe how the authority interprets the law and how I translate that into settings. In disputed cases, a lawyer decides, not a checkbox in the CRM.
The whole system in a nutshell
- Download the signed data processing agreement and put a link to your privacy policy on every form.
- Before the import, split contacts into customers, people with consent, and everyone else.
- Give every contact a custom field with the legal basis and a tag with the source.
- Add an unchecked consent box to your forms, followed by a confirmation email.
- Keep an eye on DND so someone who unsubscribed doesn’t get marketing from another campaign either.
- Only let the first two piles into campaigns and leave the rest in the CRM.
So the US servers take the least work in this whole thing. What decides it is an afternoon over a spreadsheet, writing down where each address came from. If you don’t want to put it together yourself, you can order a GoHighLevel setup from me. I’ll sort and import the contacts, and from the first call to the handover, you’re always talking to me. Your first newsletter then goes only to people who wanted it.
