SatisMeter is GDPR compliant. If you're a data controller, sign a data processing agreement (DPA) before you send us personal data. To learn how to get one, see Data processing agreement.
In this article:
- About GDPR
- Our approach to GDPR compliance
- Resources
- What is the GDPR? How does the GDPR compare to the EU Data Protection Directive?
- Data processing agreement
About GDPR
The General Data Protection Regulation (GDPR) took effect on May 25th, 2018. This important legislation unifies and strengthens the protection of personal data for people living in European Union (EU) member states.
The GDPR aims to give individuals in the EU better protection and control over their data. It also aims to harmonize these protections throughout the whole world.
Our approach to GDPR compliance
SatisMeter is based in the EU (Czech Republic). We've taken all necessary measures to be GDPR compliant as both a data processor and a data controller.
Our DPA addresses the requirements under the GDPR and specifies the measures we've taken to comply with the regulation.
If you plan to send user data of EU-based individuals into SatisMeter, sign our DPA before you send us any personal data. This makes SatisMeter the contractual data processor under the GDPR.
To get the prefilled DPA, email our data privacy officer at support@satismeter.com.
Resources
For more on how SatisMeter handles your data, read these documents:
- SatisMeter's Privacy Policy
- SatisMeter's General Terms and Conditions of Use
What is the GDPR? How does the GDPR compare to the EU Data Protection Directive?
This section explains the GDPR in more detail.
Many consider the GDPR the most significant piece of European data protection legislation introduced in the EU in 20 years. It replaces the 1995 Data Protection Directive. The GDPR enhances EU individuals' privacy rights and places significantly greater obligations on organizations that handle data.
The GDPR regulates the processing of personal data about individuals in the EU, including its collection, storage, transfer, or use. Under the GDPR, the concept of "personal data" is very broad. It covers any information relating to an identified or identifiable individual, also called a "data subject."
The GDPR gives data subjects more rights and control over their data by regulating how companies handle and store the personal data they collect. It also raises the stakes for compliance by increasing regulatory enforcement and imposing greater fines on companies that fail to comply.
Here are some of the key changes the GDPR introduces:
- Expanded rights for individuals: The GDPR expands the rights of individuals in the EU. Among other things, it grants them the right to be forgotten and the right to request a copy of any personal data stored about them.
- Compliance obligations: The GDPR requires organizations to implement appropriate policies and security protocols and to conduct privacy impact assessments. Organizations must also keep detailed records on data activities and enter into written agreements with vendors.
- Data breach notification and security: The GDPR requires organizations to report certain data breaches to data protection authorities and, in some circumstances, to the affected data subjects. It also places additional security requirements on organizations.
- New requirements for profiling and monitoring: The GDPR places additional obligations on organizations that profile or monitor the behavior of EU individuals.
- Increased enforcement: Under the GDPR, authorities can fine organizations up to €20 million or 4% of a company's annual global revenue, whichever is greater. The fine depends on the seriousness of the breach and the damages incurred. The GDPR also provides a central point of enforcement for organizations with operations in multiple EU member states. These companies work with a lead supervisory authority on cross-border data protection issues.
The GDPR matters even if your company is outside the EU. It applies to any organization that processes personal data of individuals in the EU, including tracking their online activities. This is true regardless of whether the organization has a physical presence in the EU.
Data processing agreement
We updated our Terms of Service to incorporate our DPA.
If you prefer a separate, explicitly signed DPA, you can e-sign it here:
https://www.productboard.com/dpa
Fill out the name and email of your signer, then e-sign the agreement. We then countersign, and DocuSign automatically sends you the fully executed agreement for your records.
Our DPA incorporates the Standard Contractual Clause to allow transfers of personal data from EU member countries to Productboard. This means data transfers to Productboard remain GDPR compliant, even after the Court of Justice of the European Union invalidated the EU-US Privacy Shield.
If you have any questions, email us at privacy@productboard.com.
We're here to help as you work through your GDPR compliance efforts.