Register and privacy statement (template)

This is The company's registration and privacy statement in accordance with the EU General Data Protection Regulation (GDPR). Prepared dd.mm.yyyy . Last change dd.mm.yyyy .

1. Data Controller

Company, Address, 01234 Postcode

Other contact information

2. Contact person responsible for the register

First name Last name, email, phone number

If your organization has a data protection officer, enter at least their contact information here. Otherwise, any contact person.

3. Register name

The company's customer register, marketing register, stakeholder register, online service user register, member register, employee register, etc.

4. Legal basis and purpose of processing personal data

The legal basis for processing personal data under the EU General Data Protection Regulation is
- the person's consent (documented, voluntary, individualized, informed and unambiguous)
- a contract to which the data subject is a party
- law (which)
- performing a public task (on what basis), or
- the legitimate interest of the controller (e.g. customer relationship before contract, employment, membership).

The purpose of processing personal data is contact with customers, customer relationship management, marketing, etc.

The information is not used for automated decision-making or profiling.

5. Data content of the register

The information stored in the register includes: person's name, position, company/organization, contact information (phone number, email address, address), website addresses, IP address of the network connection, IDs/profiles in social media services, information about ordered services and their changes, billing information, other information related to the customer relationship and ordered services.

If there are several groups of data subjects (e.g. a customer register and a marketing register), list them and outline their data content.

Please also state the retention period of the data here, if possible. Also state if, for example, the data will be anonymized after a certain period of time.

The IP addresses of website visitors and cookies necessary for the operation of the service are processed on the basis of legitimate interest, including for data security purposes and for the purpose of collecting statistical data on website visitors in cases where they can be considered personal data. If necessary, consent is requested separately for third-party cookies.

6. Regular sources of information

The information stored in the register is obtained from the customer, for example, through messages sent via web forms, email, telephone, social media services, contracts, customer meetings and other situations in which the customer provides their information.

Contact information for companies and other organizations can also be collected from public sources such as websites, directory services, and other companies.

7. Regular data transfers and data transfers outside the EU or EEA

The information is not routinely disclosed to other parties. Information may be published to the extent agreed upon with the customer.

Data may also be transferred by the controller outside the EU or EEA. Data will not be transferred to the United States without the express consent of the data subjects.

If you disclose personal data to different parties, please state here the potential recipients or groups of recipients (including personal data processors/subcontractors), the related purposes of processing the personal data, and the transfer grounds if the data is transferred outside the EU.

8. Principles of register protection

The register is handled with care and the data processed by the information systems are protected appropriately. When the register data is stored on Internet servers, the physical and digital security of their equipment is appropriately ensured. The controller ensures that the stored data, as well as the access rights to the servers and other information critical to the security of personal data, are handled confidentially and only by employees whose job description requires it.

9. Right to inspect and right to request correction of information

Every person in the register has the right to check their data stored in the register and to demand correction of any incorrect data or completion of incomplete data. If a person wishes to check the data stored about them or to demand correction of them, the request must be send in writing to the controller. The controller may, if necessary, ask the requester to prove their identity. The controller will respond to the customer within the time period specified in the EU Data Protection Regulation (generally within one month).

10. Other rights related to the processing of personal data

The person in the register has the right to request that personal data concerning him or her be deleted from the register ("right to be forgotten"). Data subjects also have other rights Rights under the EU General Data Protection Regulation, such as the restriction of processing of personal data in certain situations. Requests must send in writing to the controller. The controller may, if necessary, ask the requester to prove their identity. The controller will respond to the customer within the time period specified in the EU Data Protection Regulation (generally within one month).