The General Data Protection Regulation (GDPR) is the European Union regulation that aims to ensure protection of the individual right to data privacy.
Personal data is any information that relates to an individual who can be directly or indirectly identified. Names and email addresses are obviously personal data. Location information, ethnicity, gender, biometric data, religious beliefs, some web cookies, and political opinions can also be personal data. Pseudonymous data can also fall under the definition if it’s relatively easy to identify someone from it.
Data processing is any action performed on data, whether automated or manual, that includes collecting, recording, organizing, structuring, storing, using, etc.
Data protection principles
In all our data collection we process data according to following principles of:
- Processing this data with transparency to the data subject.
- We only process data for legitimate purposes specified explicitly to the data subject.
- We only collect and process as much data as absolutely necessary for the purposes specified.
- We keep personal data accurate and up to date.
- We only store personally identifying data for the necessary time for the specified purpose.
- Processing is done with appropriate security, integrity, and confidentiality.
To ensure we comply with regulation, we have in place measures that ensure our internal compliance:
- We have a data protection officer responsible for ensuring the correct procedures in the management of all the data collected.
- Maintain detailed documentation of the data we are collecting ensuring compliance on why it is collected, how it’s used, where it’s stored, and who is responsible for it.
- We have regular internal training of our staff and implement technical and organizational security measures.
- We do not share data with third parties.
Data security
We handle data securely by implementing as a “by design and by default” technical and organizational measures like staff training, having a data privacy policy, and limiting access to personal data to only those who need it.