GDPR - General Data Protection Regulation
Senast ändrad: 27-02-2024The iRaiser platform complies with the GDPR (General Data Protection Regulation) for storing personal data. Managers can use the dashboard to manage, for example, all consent texts displayed in forms that require Users to grant permission by checking a box. Below is general information on how to comply with the GDPR within iRaiser and some general explanation of what the GDPR is.
Content of article:
- Introduction
- Controller versus Processor
- What is personal data?
- What is a special personal data?
- When is there processing of personal data?
- General rules for processing personal data
- Overview Personal data
- Exporting personal data: transfer
- What are the rights of data subjects?
- Expressive consent
- Rights of data subjects
Introduction
To safeguard the data of our customers and their Users, we have established privacy and data protection policies within iRaiser.
Privacy protection & personal data; General Data Protection Regulation
Privacy protection is regulated by various laws and treaties. The most important is the General Data Protection Regulation (GDPR), which comes into force from 25 May 2018. This is a European regulation (i.e. with direct effect) that standardises the rules for the processing of personal data by private companies and public authorities throughout the European Union. In addition, the Telecommunications Act provides rules on mailings, spam and cookies.
Processor versus Processor
The GDPR makes a clear distinction between the duties and responsibilities of a so-called Controller and a Processor. iRaiser's customer owns the website and the data acquired with the website. They are the Controller. iRaiser carries out the technical operation of the website and does not do anything with the data without the consent of the customer. iRaiser is in GDPR terms a processor. The powers, duties and responsibilities of us as a Processor in terms of processing personal data are agreed in the so-called Processor Agreement that we conclude with our customers.
What is a personal data?
Personal data is any data by which a person can beïdentified. A person can be identified if the person using the personal data can identify the person without making a special effort. This could include name and address data. E-mail addresses, passport photos, fingerprints and, for example, IP addresses are also considered personal data. And data that give a rating about a person, for example someone's IQ.
What is a special-personal data?
In addition to ordinary personal data, the law also recognises special personal data. These are data that are so sensitive that processing them could seriously affect someone's privacy. Such data may therefore only be processed under very strict conditions. Special or sensitive personal data include, for example, data that says something about someone's race, religion, health, criminal past or sexual life. Trade union membership and the citizen service number (BSN) are also special personal data.
Special personal data is data about someone's:
- race or ethnic origin
- political opinions
- religion or belief
- membership of a trade union
- genetic or biometric data for the purpose of unique identification
- health
- sexual life
- criminal history
An organisation may not use special personal data unless there is an exception for this in the law. There must be a need to request this data.
When is personal data processing?"
Processing means any operation involving personal data. The law lists as examples of processing: the collection, recording, organisation, storage, updating, modification, retrieval, consultation, use, provision by means of forwarding, dissemination or any other form of making available, bringing together, linking, blocking, erasing and destroying of data. From this enumeration, it is clear that the processing of personal data is readily apparent. One could argue that everything one does with personal data do falls under processing.
General rules for processing personal data
Main rule is that personal data shall only be processed in accordance with the law and in a proper and careful manner. In addition, personal data may only be collected if a precise purpose is given for it. Moreover, the law states that personal data may only be processed insofar as they are adequate, relevant and not excessive.
An example from practice is the making of a copy passport.
An important obligation arising from the law is the notification that the processor must make to the Personal Data Authority AP. This notification is intended to promote transparency: all notifications made to the AP are included in a public register. Some processing operations do not need to be notified under the law, such as the trade register of the Chamber of Commerce. In addition, the GDPR includes a large number of processing operations that are exempt from notification. For such exempted processing operations, the other requirements of the GDPR simply remain in force.
In addition to the general rules mentioned above, a justification ground must be present for any processing of personal data. This is explained below.
Conditions for processing personal data: justifications
In addition to the general rules mentioned above, the GDPR requires that at least ééone of the justifications listed in the law must apply to any processing of personal data. The GDPR has the following bases:
-
Consent
. The processing of personal data of a child under 13 requires the consent of a parent or legal representative. An organisation must make a reasonable effort to verify that consent.
The data subject (this is the person whose data is being processed) has given his unambiguous consent to the processing. This explicit consent is also called informed consent or informed consent -
Execution of contract
Data processing is necessary for the performance of a contract to which the data subject is a party. -
Legal obligation
Data processing is necessary for compliance with a legal obligation. -
Vital interest
Data processing is necessary to counter a serious threat to the health of the data subject. -
Public law task
The data processing is necessary for the proper performance of a public law task. -
Justified interest
Data processing is necessary for the fulfilment of a legitimate interest of the data controller (or of a third party to whom the data are disclosed). This means that the person processing the data must weigh his own interest against the interest and rights of the person concerned. The processor must also check beforehand whether the same result cannot be achieved with less data.
Overview Personal data
In the dashboard, via Administration > Overview Personal data, you can see a complete and current overview of all data processed by iRaiser for the website. This is governed by the concluded Collaboration Agreement or the General Terms and Conditions for the protection of personal data.
A distinction is made between the personal data that iRaiser processes by default and the, for this website, specific personal data from set-up forms. You can have an Excel file generated from these via the Download button. This is sent by e-mail to the e-mail address of the site administrator requesting the download and can be retrieved there via a link. If desired, you can also filter the data by:
- All data
- The additional form data (additional questions)
- The default data (without the extra questions)
Exporting personal data: transfer
Exporting personal data, also known as transmission, is a form of processing personal data. The conditions described above apply to it in full. In addition, depending on the country to which the data is transferred, additional conditions apply.
What are the rights of data subjects?
The GDPR also grants rights to individuals whose data is processed:
-
Right of inspection
This right allows everyone to check whether, and in what way, their data are processed. -
Right of rectification and supplementation and/or restriction of processing
When someone has used their right of inspection and comes to the conclusion that their data needs to be corrected, they can submit a request to that effect to the data controller. -
Right to oblivion
The data subject may object to certain forms of data processing, as a result of which the processing of his personal data may have to be stopped. - Right to data portability
This is the ability to take data from one platform to another platform.
Express consent
When and Users give permission (consent) for the storage of personal data anywhere within the iRaiser platform, a number of things are stored in the database to be able to resolve any dispute later. This explicit consent is also called informed consent or informed consent.
This explicit consent is also called informed consent.
The following data will be stored
- id of the user (to retrieve the information)
- consent text (which can be managed in the dashboard)
- date/time
- version number of the general terms and conditions
- version number of the cookie statement
- version number of the privacy settings
data subjects' rights
Every person whose personal data is stored has a number of different rights under the GDPR legislation to view or delete his/her data. Below we explain how we handle the different rights within iRaiser and what you or the Users can/should do to make use of these rights.
Users with an account can log in via the dashboard itself to exercise these rights. One does this by going to Accounts > Data protection when logged in:
Following this, they enter the dashboard where everything is explained about their rights and they can request different downloads for each right:
Right of access
This right allows everyone to control whether, and how, their data is processed.
Procedure Users
Users can use the dashboard (see image above) to download their own archive containing all their data. After clicking on the button Download my archive , the user receives a message "Archive is being created now. You will soon receive an e-mail containing a link to download your archive." The link in the e-mail is valid for 24 hours.
Procedure Clients
When a customer addresses you and does not want to or cannot log into the dashboard himself, you (customer) can do so.
To do so, go to Accounts > Users and click on the three dots behind the relevant user and go to Data Protection:
If a contributor asks this question then a request must be sent by you (customer) in writing on behalf of the requestor(consumer) to iRaiser via iRaiser's support desk.
After receiving the request, iRaiser will contact the customer to verify the request. In doing so, iRaiser asks for identification of the customer which is recorded in a logging.
After verification of the request, iRaiser will, within 5 working days, collect all the data of the requester (consumer) and bundle it in a password-protected zip file.
The password-protected zip file will be sent by iRaiser to the customer by secure WeTransfer.
We will send the corresponding password to open the zip file by SMS.
Right to rectification and completion and/or restriction of processing
When someone has used their right of inspection and comes to the conclusion that their data needs to be corrected, they can submit a request to that effect to the person responsible for data processing; the Controller (read: you as iRaiser's customer of iRaiser). You can already adjust a lot of data yourself via the dashboard at fer the user's request.
Should you not be able to change the data via the dashboard please contact support via a written request on behalf of the applicant(consumer). After receiving the request, iRaiser will contact you as customer to verify the request. In doing so, iRaiser will ask for identification of the customer which will be logged. After verifying the request, iRaiser will change the data within 5 working days and notify the customer accordingly.
Right to erasure
Users with accounts can request the deletion of their personal data themselves. After clicking the "Delete personal data" button, they will receive an email about this and can still withdraw the request within a week. After that, all data will be irrevocably deleted.
You as a customer can also trigger this customer request via the dashboard:
To do so, go to Accounts > Users and click on the three dots behind the user in question and go to Data Protection.
If a user cannot log in themselves or does not have an account, we can do so at the klnat's request.
At the request of Data Subject (End User):
There are three possibilities for this:
- The data subject/end user addresses the request to the customer. Customer orders deletion to iRaiser;
- The affected/end user uses the option for deletion of his/her personal data via the iRaiser Dashboard (option: Data Protection).
- The affected/end user addresses the request directly to us.
iRaiser deletes Personal Data on dedicated servers and any hosted servers and from (internal) mailboxes, and other systems completely and irrevocably within 14 working days after being ordered to do so by customer. Within 30 days, Personal Data will be deleted from backup copyëns and from backup files.
Upon termination of contract:
If it is established after the end of the contract that the customer possesses all acquired Personal Data, iRaiser will completely and irrevocably delete all Personal Data on dedicated servers and any hosted servers and from (internal) mailboxes within 14 working days of being ordered to do so by the customer. Within 30 days, Personal Data will be removed from backup copyëns and from backup files.
Netherly 3 months after termination of the agreement, iRaiser will completely and irrevocably anonymise all acquired Personal Data, whether or not it has received an order to do so from the customer. iRaiser will inform Customer two weeks prior thereto.
The account manager (sales consultant) of the relevant customer is responsible within iRaiser for initiating this procedure.
Right to data portability
When a user wants to take their data with them, they can do so by downloading a file containing their data. This works exactly the same as with the Right of Inspection.
Procedure Clients
If a customer contacts you and does not want to or cannot log into the dashboard themselves, you (customer) can do so.
To do so, go to Accounts > Users and click on the three dots behind the relevant user and go to Data Protection.
If a contributor asks this question then a request must be sent by you (customer) in writing on behalf of the requestor(consumer) to iRaiser.
After receiving the request, iRaiser will contact the customer to verify the request. In doing so, iRaiser will ask for identification of the customer which will be recorded in a logging.
After verification of the request, iRaiser will, within 5 working days, collect all data of the requester (consumer) and bundle it into a password-protected zip file.
The password-protected zip file will be sent by iRaiser to the customer via secure WeTransferPlus.
The corresponding password to open the zip file will be sent in a separate email.
After verification of the request, iRaiser will contact the customer to collect and bundle all data of the requester (consumer) into a password-protected zip file.
Questions?
Do you still have questions about the GDPR within iRaiser after reading this information? Then send an email to iRaiser