GDPR (General Data Protection Regulation)
The General Data Protection Regulation (GDPR) is the data protection law of the European Union. The UK applies its own version, the UK GDPR. This page explains EvTrack’s role under the GDPR and how the service helps customers meet their obligations.
Roles under the GDPR
The customer using EvTrack is the controller: it decides what personal data is collected about visitors and other people, why, and for how long. EvTrack is the processor: it processes that data on the customer’s behalf and on the customer’s instructions.
See the Privacy Policy for what the service processes.
Data processing agreement
The GDPR requires a written agreement between a controller and its processor. To put a data processing agreement in place with EvTrack, contact legal@evtrack.com.
How EvTrack helps customers comply
- Data minimisation: customers choose which visitor details are required. Saving ID document images is off by default.
- Transparency: the kiosk can show a privacy notice, with text the customer controls, before a visitor registers. It is on by default; the Privacy Policy explains when it appears. Customers can also ask visitors to accept agreements, and EvTrack keeps a record of each.
- Storage limitation: customers set retention periods and EvTrack deletes data automatically. See Retention and Deletion.
- Security of processing: encryption, access control, single sign-on and audit logs. See Data Storage and Security.
- Sub-processors: the services EvTrack uses are listed on the Sub-processors page.
- Data residency: customers choose where the application and databases are hosted at sign-up, including Frankfurt (EU) and London (UK). Some sub-processors may process data elsewhere.
Rights of individuals
Under the GDPR, individuals can ask to access their personal data, have it corrected or erased, restrict or object to its processing, and receive a copy to take elsewhere. Because the customer is the controller, these requests should go to the organisation the person visited. EvTrack helps the customer respond, on the customer’s instruction.
EvTrack has no self-service export or “forget me” button for individuals. Customers find and delete a person’s records in the application; some records remain after a delete, as listed on Retention and Deletion.
Personal data breaches
EvTrack notifies the affected customer without undue delay after becoming aware of a personal data breach affecting the customer’s data, so that the customer can meet its own notification duties.
Transfers outside the EU and UK
Some sub-processors may process data outside the EU or UK (see Sub-processors). The safeguards used for these transfers are to be confirmed.
Selling personal data
EvTrack does not sell personal data.
Contact
Email legal@evtrack.com with any question about the GDPR and EvTrack.
Further information
Configure this in EvTrack
- Privacy and retention: what EvTrack holds, consent, retention and handling requests