Getting ready for the GDPR (General Data Protection Regulation)

Who does the GDPR apply to?

The GDPR applies to all organizations, located within the EU and outside of it, processing and holding the personal data of data subjects residing in the European Union. It means that regardless of the location, all companies processing personal data of EU citizens are affected by the GDPR.

What is personal data?

“Personal data” is information that can be used directly or indirectly to identify a person, such as email address, name, IP address. Personal data is the main focus of the GDPR, the way it's collected, the way it's stored and processed.

“Controller” vs “Processor”

“Controller” and “processor” are two very important terms used throughout the GDPR. A controller is a person or organization that collects personal data and determines the purposes and means of its processing. A processor is an entity that processes personal data under the controller's instructions. When you are using Getsitecontrol widgets on your website to collect personal data of your website visitors (email subscriptions, contact form submissions, survey responses, etc.), you are the controller and Getsitecontrol is the processor. You collect personal data and determine how it should be used while we store and process this data for you following your instructions.

Both controllers and processors have their own responsibilities under the GDPR. Both controllers and processors should ensure the security of the personal data that they process and respect the rights of data subjects.

Rights of data subjects

The GDPR states that data subjects (people you collect personal data from) should be provided with the information concerning the purposes for which their personal data will be processed. They also have the rights of access, rectification, erasure, data portability, the right to restrict or object processing. In practice, it means that a person can contact you and instruct you to delete their personal data or stop processing it.

IMPORTANT: Getsitecontrol is ready to accommodate any such requests from data subjects.

Data Processing Agreement (DPA)

Under the GDPR, whenever a controller uses a processor it needs to have a written contract in place. You can now sign such an agreement with Getsitecontrol! You can access your copy of the DPA by going to the Profile section in your account.

Consent

Data subjects' consent is another important area the GDPR focuses on. The basic principle is the same as before — a person needs to give their consent for the processing of their data (unless there is another lawful basis). However, the GDPR clarifies how consent should be collected:

• data subjects should be provided with a clear explanation of the processing to which they are consenting;
• the consent mechanism should be genuinely of a voluntary and “opt-in” nature;
• organizations are not allowed to rely on silence or inactivity to collect consent (e.g., pre‑ticked boxes do not constitute valid consent) — silence is not consent;
• the nature of the processing should be explained in an intelligible and easily accessible form, using clear and plain language;
• the data subject should be aware of the identity of the controller and the purposes for which the personal data will be processed;
• consent can be provided by any appropriate method enabling a freely given, specific and informed indication of the data subject's wishes.

Simply put, the controller should make sure data subjects understand how their data is going to be used and give explicit consent to such use.

It's important to understand that collecting consent is the responsibility of the controller (that's you). Please note that we won't be able to provide legal advice in each specific case, so if you have any doubts, please talk to a lawyer. However, we are investigating this question as thoroughly as possible and will make sure to provide recommendations on how to better collect consent using Getsitecontrol forms.

What we have been doing to prepare

We have been hard at work getting ready for the GDPR. Here is what we have done so far:

• we have revised our Privacy policy to include the new requirements;
• we have reviewed the list of our sub-processors to make sure all of them are GDPR compliant;
• we have introduced Data Processing Agreements (written contracts between controllers and processors). If you want to sign the agreement, open the 'Profile' section of your Getsitecontrol account;
• we have made sure that we will be able to assist you, the controller, in complying with the rights of data subjects;
• we have made sure that we have the ability to destroy personal data at the end of the relationship.

If you have any questions, please let us know. We will do our best to answer them to the best of our ability. However, please understand that we won't be able to provide legal advice, so if you have legal questions, do speak to a lawyer.