How Plumb5 implements each Data Subject right under the EU's General Data Protection Regulation.
The GDPR puts control of personal data collected by businesses in the hands of the individuals it belongs to, protecting the rights of EU residents. It sets out individuals' rights to access, rectify, and restrict the processing of their personal data, among other key provisions, and aims to unify privacy and security laws for all organizations operating within the EU.
The GDPR enforcement puts the control of personal data, collected by businesses, in the hands of the individuals it belongs to, protecting the rights of EU residents. The regulation delineates individuals' rights to access, rectify, and restrict the processing of personal data, among other key provisions, and aims to unify privacy and security laws for all organizations operating within the EU.
In the context of this document, we focus on how to implement the different rights once invoked by the Data Subjects.
Data Processing Agreement (DPA) — all customers of Plumb5 have to sign the DPA. To account for this, on login each user has to go through our Terms of Service and Privacy Policy, and accept the same.
What is it? This right allows end users to delete all information about them from Plumb5 servers.
Plumb5 Implementation — Data Controllers can use this REST API on their respective accounts to delete all data of the mentioned profiles from the Plumb5 servers, by calling one of the two unique profile identifiers (email address or phone number):
-X POST --header 'Content-Type: application/json' --header 'Accept: application/json' -d '{
"ApiKey": "{your Plumb5 API key}",
"AccountId": {your Plumb5 Account ID or AdsID},
"EmailId": "String",
"PhoneNumber": "string"
}' 'https://{your plumb5 Domain}/API/Contact/DeleteContact'
Access Control — only Admin users have the right to erase user information.
Implications
Default State — a profile is erased only when explicitly called via API by the Super Admin.
What is it? This right allows users to modify or rectify any profile data stored about them.
Plumb5 Implementation
Access Control — only Admin users have the right to modify user information.
Implications — the old profile information is overridden with the new profile for the given user identifier. If the identifier is not found, a new profile is created.
Default State — a profile is only updated when explicitly called via API or Import Contacts by the Super Admin.
What is it? This right allows users to access data that has been captured about them by Data Processors.
Plumb5 Implementation
What is it? This right allows users to opt out of sharing any data with Data Processors.
Plumb5 Implementation
Implications
Opt In — if a user who opted out chooses to opt back in, all data is appended to the same profile if identified as an existing user; the user is treated as the same user, and no new profile is created.
What is GDPR?
Is GDPR applicable to me?
Under GDPR, it is the location of the individual whose personal data is being processed that determines whether a firm should comply — meaning GDPR applies to all organizations, whether within the EU or outside of it, that offer products or services to individuals in the EU whose data is being collected. It's also recommended under GDPR that your marketing communications default to opt-out. Your legal/compliance team will be in the best position to confirm whether your business falls under GDPR.
GDPR doesn't apply to me. What next?
Life continues as usual with regards to profile creation — you can simply allow Plumb5 to track device and location.
GDPR applies to me. What next?
Your legal/compliance team needs to determine whether allowing Plumb5 to track the two data points above (Machine ID & Location) falls within the purview of your GDPR compliance obligations.