GDPR Statement

Created by Bernhard Hafting
Last updated: Nov 22, 2021
3 min read

At Dataloy Systems AS, we take personal data information obligations seriously.

Together with our Privacy Policy, this document will help you better understand the personal information we collect, why we collect it, how we use personal information and how we protect it.  In full compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) which comes into effect May 25, 2018, it also explains the various rights of the data subject, including the right of access and the right to erasure (aka “the right to be forgotten”).

What You Should Know

The GDPR distinguishes between a Data Controller (the legal entity that determines the purpose for which, and the manner in which, any personal data is collected) and a Data Processor (the legal entity responsible for the handling of personal data on behalf of the Data Controller). In cases where Dataloy Systems AS is hosting the systems, and/or provide support on the systems, we act as Data Processor.

How Dataloy Systems Can Help

In keeping with our obligations as a Data Processor, Dataloy Systems promises to:

  • Keep personal data safe, secure, and private

  • Process personal data in a manner that ensures appropriate security, using lawful, fair and transparent means

  • Disclose our sub-processors and responsibly monitor their GDPR compliance

  • Keep all required compliance records and audit logs

  • Make available tools to handle data subject requests, such as the right-to-erasure and right-to-access

  • Provide timely notice of personal data breaches

The Data Processing Addendum

To satisfy the GDPR, each Data Controller must receive “sufficient guarantees” from its Data Processors that they can implement measures (technical and organisational) to meet the requirements of the GDPR.  Since there are currently no codes of conduct or certifications upon which Data Controllers can rely, standard contractual clauses and data processing agreements are quickly becoming the norm.

Dataloy Systems’ Data Processing Addendum is available here: Data Processing Agreement  If you are an existing Dataloy Systems customer or partner, our Data Processing Addendum amends your Services Agreement as applicable and governs the processing of any personal data which is provided or made available to us.

Sub-Processors

We use the following third-party data processors when providing our service:

  • Amazon AWS

  • MailChimp

  • HubSpot

  • Chargebee

  • Atlassian

  • Stripe

  • Inline Manual Ltd.

Integration Partners

You also have the option to enable additional Dataloy Systems integrations (either built-in or through our APIs or webhooks).  We do NOT directly evaluate or attest to the GDPR qualifications of our integration partners.  Each customer is responsible for evaluating any third-party before creating or enabling an integration.

Who Is Dataloy Systems’ Data Protection Officer (DPO)?

The DPO is Bernhard Hafting, Head of Research and Development at Dataloy Systems AS. You can contact him at privacy@dataloy.com.

How Can You Request Access to Your Personal Information?

We recommend you first contact the Data Controller (i.e. the merchant organisation to whom Dataloy Systems is providing the Dataloy Systems AS service).

You may request a full report on the personal information we hold for you by sending an e-mail to privacy@dataloy.com.

In the subject line, please indicate “Request for Personal Information”.  In your email, please specify:

  1. Your full name

  2. Whether you are an individual or a representative of a Data Controller

  3. If you are an individual, the name of your Data Controller (i.e. the merchant organization to whom Dataloy Systems is providing the Dataloy Systems Service).

Please note that we will need to share your request with the Data Controller to verify and action it.  We will endeavour to fulfil all access requests within 30 days of our receipt.

How Can You Request Deletion of Your Personal Information?

We recommend you first contact the Data Controller (i.e. the merchant organization to whom Dataloy Systems is providing the Dataloy Systems Service).

You may request the deletion of personal information by sending an e-mail to privacy@dataloy.com.  

In the subject line, please indicate “Request for Deletion”.  In your email, please specify:

  1. Your full name

  2. Whether you are an individual or a representative of a Data Controller

  3. If you are an individual, the name of your Data Controller (i.e. the merchant organization to whom Dataloy Systems is providing the Dataloy Systems Service).

Please note that we will need to share your request with the Data Controller to verify and action it.  We will endeavour to fulfil all access requests within 30 days of our receipt.

How Can You Contact Us?

If you have any questions about this document or our Privacy Policy, please contact us directly at privacy@dataloy.com.