GDPR (AVG) compliant from start to activation
During the introduction of CompanyPass you decide how employees get access. Both methods are fully GDPR (AVG) compliant; you never share more data than necessary.
Two ways to give access
Choose what suits your organization, both GDPR (AVG) compliant.
Without email addresses
Employees activate their pass themselves via an invitation link or a unique code. You do not share any personal data with us, so no employee data enters our systems unless the employee registers themselves.
- No personal data provided by the employer
- The employee decides whether and when they register
- Ideal when you want to keep data sharing to a minimum
With provided email addresses
You provide the business email addresses; we load them in and send the invitations. This takes place under a data processing agreement, so that the processing is fully GDPR (AVG) compliant.
- Fast, complete rollout to all employees
- Processing set out in a data processing agreement
- We process the data solely for the introduction and access
Data processing agreement
When you provide personal data (such as email addresses or employee numbers) to us, CompanyPass acts as the processor and you as the controller. We set this out in a data processing agreement as referred to in the GDPR (AVG), with arrangements regarding purpose, retention period, security and sub-processors. Feel free to request it before you share any data.
Security
We take appropriate technical and organizational measures against misuse, loss and unauthorized access. Data is stored in a secure database and connections are secured with reliable SSL certificates.
Retention period & purpose limitation
We only process what is necessary for the introduction and access to the platform. Data is retained for the duration of the collective subscription and afterwards deleted or anonymized. We never use the data for purposes other than those agreed.
How we handle the data of employees as end users is explained in our privacy statement.
Questions about the GDPR (AVG) or the data processing agreement?
We are happy to think along about the rollout method that suits your privacy policy. Schedule an introduction or get in touch.