GDPR / AVG regulation Introduction
The European Union has taken a monumental step in protecting the fundamental right to privacy for every EU resident with the General Data Protection Regulation (GDPR) which will be effective from May 25, 2018. Simply put, EU residents will now have greater say over what, how, why, where, and when their personal data is used, processed, or disposed. This rule clarifies how the EU personal data laws apply even beyond the borders of the EU.
Any organization that works with EU residents' personal data in any manner, irrespective of location, has obligations to protect the data. Claire is well aware of its role in providing the right tools and processes to support its users and customers meet their GDPR mandates.
Claire's Commitment
At Claire, we have always honored our users' right to data privacy and protection. We have never relied on advertising as a revenue stream. We have never served ads to our users. This means
that we have no necessity to collect and process users' personal information beyond what is required for the functioning of our products.
We already have strong Data Processing Agreements, and we are revising them to meet the requirements of the GDPR. Claire Corporation participates in and has its compliance with the EU-U.S. Privacy Shield Framework. We recognize that the GDPR will help us move towards the highest standards of operations in protecting customer data.
Basic regulations about GDPR
With a cloud application used by 3000+ users across 4 countries, Claire is up to be GDPR compliant across all of its application. As a data processor, Claire understands its obligation to help customers get GDPR Compliant.
● Identifying personal data - providing a roadmap for compliance in the days leading up to implementation.
● Providing visibility and transparency - The most important aspect of GDPR is how the collected data is used.
● Enhancing data integrity and security - By implementing IT policies and procedures that provide end-to-end security.
● Portability and transferability of data - GDPR gives end users the right to either receive all the data provided and processed by the controller or transfer it to another controller.
What does this mean for our customers?
We understand that meeting the GDPR requirements will take a lot of time and effort. And as your partner, we want to help you make your process as seamless as possible, so that you don't have to worry about compliance and can focus more on running your business. Some of our product enhancements are about to make it easier for you to:
● Provide access controls
● Anonymize or delete user data
● Perform data audits or assessments using data processing logs
● Create provisions for data subjects rights
● Enhance security for user data
What should you do to be GDPR-ready?
If you are started with GDPR compliance in your organization, here's a quick to-do list to keep in mind.
● Create a data privacy team to oversee GDPR activities and raise awareness
● Review current security and privacy processes in place & where applicable, revise your contracts with third parties & customers to meet the requirements of the GDPR
● Identify the Personally Identifiable Information (PII)/Personal data that is being collected
● Analyze how this information is being processed, stored, retained and deleted
● Assess the third parties with whom you disclose data
● Establish procedures to respond to data subjects when they exercise their rights
● Establish & conduct Privacy Impact Assessment (PIA)
● Create processes for data breach notification activities
● Continuous employee awareness is vital to ensure continual compliance to the GDPR
Claire - Customer - Customer data and GDPR
Claire is a Data Processor it means that we process / store data that we receive from your systems or manual put into or systems by You the Data Controller
Data we process
We receive and store Personal data from your customers as:
Name, Title or Gender, email, Phone nr, adres.
General Car and Workorder information. Car Reg nr, Vin nr, Brand, type, APK date,
Data WE DO NOT Process:
Special personal information like, religion, way of life, race, political art, health, personal financial situation, social security nr.
Claire will not share or deliver data with other companies without your permission, except for the company's we use to process and store or data as provided into this document.
What are your sub-processors, as defined by the GDPR?
Under the GDPR, a sub-processor is any business or contractor customer data may pass through.
We use partners for some business processes that are not core to our expertise but are critical to our customers having a quality experience. Here is our list of sub-processors:
- Google Cloud infrastructure cloud.google.com - We host or software in the Datacenter in The Nederlands - Belgium
- ZoHo Analytics zoho.com/analytics - we are hosting the analytics of the data about using the Claire product in a Zoho Datacenter in Europe (Germany)
- Mail Gun mailgun.com - All email send from the Claire app are send true mailgun and we are using the Datacenter in Europe (Germany)
- Twilio if you are using SMS
You can read the full version of the GDPR AVG agreement in de pdf attachment