Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Change of Privacy policy
Answer:
This is up to you basically. Usually companies choose to notify their customers about changes in their T&C or relevant Policies, so this is more like a best practice than an obligation.
You just need to make sure that the Privacy Policy/Notice is easily available to all your customers.
To learn more about privacy notices check out our webinar “Privacy Notices Under the EU GDPR” https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/ -
GDPR in a tourism company
Answer:
If you are offering goods and services to individuals in the Union then at least some GDPR requirements would be applicable to your company as well in terms of processing the data of your customers.
However, if you just provide a service other travel companies this means you are a processor and your reasonability will be limited to certain extent.
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Confidentiality agreement
Answer:
The document you are looking for is the “Supplier Data Processing Agreement” (especially article 4.Reliability and Non–Disclosure) which can be found in folder 6 of the EU GDPR Documentation Toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Risks and opportunties in ISO 9001
It is up to the organization to decide whether the responsible of the procedure is the president of the company or the quality manager. Usually the quality manager is responsible for directing the risk and opportunity assessment while the organization´s top management is responsible for creating the risk management committee and providing the resources needed to assess and manage the risks. Nevertheless, the procedure is not a mandatory document within the QMS.
It is important to note that the requirements in ISO 9001:2015 are to analyze the ris ks within your QMS and then decide what actions need to be taken. This doesn´t even need to be maintained as documented information. If you already do this ( analyze risks with FMEA analysis and take actions based on that analysis) as part of your business strategy the you already meet the requirements of ISO 9001:2015 and will be acceptable for your certification audit. Remember you will also need to address the opportunities and this cannot be done through a FMEA analysis, but you can conduct a simple brainstorming session with the relevant people of your organization.
To learn more about risks and opportunities in ISO 9001, see - Does ISO require a procedure for addressing risks and opportunities? https://advisera.com/9001academy/blog/2017/10/10/does-iso-9001-require-a-procedure-for-addressing-risks-and-opportunities/
If you want to find out more about FMEA risk assessment, see this article - Methodology for ISO 9001 risk analysis: https://advisera.com/9001academy/blog/2015/09/01/methodology-for-iso-9001-risk-analysis/ -
GDPR Compliance with Google
Answer:
There is nothing keeping you form storing personal data using Google Sheets or other cloud storage solution. As far as Google is concerned you should also check out their statement on GDPR - https://cloud.google.com/security/gdpr/
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Parental Consent & Consent withdrawal forms
2. Can we leave the forms 4.1 & 4.2 as templates to be completed when needed? If not, can we use“for the purpose of carrying out business with Grazing and communication” as specification of the purpose for processing activity?
3. On the Personal Protection Policy some of the roles specified don’t exist on our company organisation, should them be replaced? E.g. Procurement Manager, Marketing Manager, etc. Could these be replaced by “Administration Team”?
Answers:
1. The two forms you refer to are to be used only if your services are aimed at minors thus the consent of the parents/legal guardians would be necessary. If you don't intend to sell to minors the forms are not relevant to you.
2. The consent forms are to be used only if you rely your processing activities on consent. In your case most likely you will process the personal data of individuals placing order s based on “contractual necessity” since you need to know the contact details of the individual to deliver the order to them.
3. The roles in the “Personal Data Protection Policy” are to be used just as examples and they can be replaced by any relevant roles in your company that deal with a specific topic.
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Cross border data transfer
Answer:
You should be considering a cross border data transfer only if the individuals are “in the Union”.
The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual residence of those individuals is irrelevant. For example, a company based in the EU which is processing the data of Japanese individuals located in Japan will still need to comply with the EU GDPR. Consequently, the Japanese individuals will be benefiting from all rights according to the EU GDPR, even if these rights do not exist in their own nation’s laws.
When the data of EU citizens is processed outside of the EU by companies which are also outside the EU, then this is not considered to be “in the Union”. For example, the EU GDPR will not be applicable for a school which is based in the United States just because there is a possibility that one or several of its students would be EU citizens. In this case the processing does not take place “in the Union,” nor is the individual “in the Union”.
To find out more about cross border data transfers check out our webinar “How to make personal data transfers to other countries compliant with GDPR” https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/ -
Disclaimers for the footer of emails
Answer:
Such declaimers are not something which is required by the EU GDPR, you can use existing declaimers which usually refer to the confidentiality of communication between.
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
GDPR Consent for existing user
Consent forms and Privacy Notices are different things. The consent form is to be used to get the consent of the individuals for certain processing activities such as direct marketing, privacy notices on the other hand are meant to inform the individuals about the a certain processing activity.
Another difference is that privacy notices are just to be presented to the data subjects the data subject does not need to agreed to them. -
“opt-in” consent
2. What happens if an old client/prospects receives emails from us after May 25th? Are we allowed to continue to send emails? For HR: Do we require to send consent to existing employees on the data we collect on them?
3. What do we do with employees who leave the company? Do we require to send them a consent?
4. Or do you have some FAQs around typical questions for how marketing/sales handles these type of requests?
Our concern is that due to the nature of our clients if we send a new “opt-in” consent most people will ignore it and then we will not be able to send them emails.
Answers:
1. You are required to get consent only four new customers, for the existing customers you can rely on legitimate interest to carry out your marketing activities. For prospects and leads you may need to obtain their consent of you want to send them marketing materials.
To fi nd out more about consent and marketing check out our webinar “How GDPR Affects Marketing Practices” (https://advisera.com/eugdpracademy/webinar/how-gdpr-affects-marketing-practices-free-webinar-on-demand/).
2. You can continue sending marketing emails to your existing clients based on legitimate interest proved you leave them the choice to refuse marketing (opt out) as for prospects most likely you need their consent. So, unless you have appropriate grounds for processing personal data for marketing purposes you should not sent marketing.
3. If an employee leaves the company one of the thing to do is to delete the personal data which is no longer required taken into account the local legal obligations to retain certain data about employees for a certain time (e.g. Pension records).
4. You are not allowed to send marketing materials to former employees unless you obtain theirs consent or if you can identify another suitable ground for processing their data for marketing purposes.
To learn more consent check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course//