EZRentOut is fully GDPR compliant.

This post will take you through what this means, and shed light on the functionality we’ve added to become compliant to the General Data Protection Regulation (GDPR).

What role do I play within the GDPR compliance framework?

In order to understand your place within this regulation, we need to flesh out three roles:

1. Data Processor

The body that processes personal data on another body’s behalf.

2. Data Controller

The body that determines the purpose and means of processing the personal data provided.

3. Data Subjects

The individuals whose data is being processed.

There are two ways in which the GDPR terms might apply to you.

1. You as the Data Subject

You are a citizen of the European Union and your data is being stored in EZRentOut. That makes you our Data Subject. Therefore, we must abide by the terms of our GDPR compliance to ensure we respect your data rights.

2. You as the Data Controller

We are the Data Processor, processing the data of your end-users on your terms. This makes you the Data Controller, and your end-users (such as staff, customers, vendors) the Data Subjects. Therefore, you must abide by the terms of GDPR to ensure you respect the data right off your end-users.

In short, EZRentOut is not only GDPR compliant itself, but also enables you as a Data Controller to become GDPR compliant. You can read on to see how this plays out with reference to the new functionality we’ve added to EZRentOut

How did EZRentOut become GDPR compliant?

EZRentOut appointed a Data Protection Officer in mid-2017. Our Data Protection team followed industry best practices to draft a roadmap to GDPR compliance. This included mapping data flows into and from our organization, and using this to identify risks in our data processing workflows. We then began carrying out the necessary data protection impact assessments, all of which ultimately culminated in the following:

Data Security:

We take your data security extremely seriously. To this end, we have combined new and existing security features to lower the chances of data breaches – either at our end or at the hands of Data Subjects.

1.We are ISO 27001 certified. This is an international standard describing best practices for all information security management systems.

2. All the data we process is encrypted using the AES-256 encryption specification.

3. Our user roles enable you to set permissions for your employees.

4. We are hosted on the Amazon Web Server (AWS). For more information on the security measures they have in place, click here.

GDPR Compliance: You as a Data Subject

We’re providing you as a Data Subject with a list of tools that can help you with your data rights. These tools will provide you with:

1.The ability to view or edit your profile information that has been added to EZRentOut.

2. The ability to receive information on any data collected on you, including the purpose of gathering the data, and the duration for which it will be stored by us.

3. The right to call for the access, alteration, or deletion of said data.

4. The right to opt in to certain features, such as email marketing, newsletters, SuperUser access, etc.

5. The ability to send complaints and queries specifically related to the GDPR directly to the EZRentOut Data Protection team.

GDPR Compliance: You as a Data Controller

We’re also providing you as a Data Controller with a list of tools and features that can enable you to achieve GDPR compliance with ease. These provide you with:

1.The ability to log the details of your Data Protection Officer and EU Representative.

2. Updated Terms of Service and Privacy Policy.

3. The ability to manage data in accordance with GDPR standards.

We already have rich features in place to support the management of our customers’ data. To expand on this functionality for GDPR compliance, however, we’ve added the following new features:

Declaration of Consent:

You will be able to inform relevant Data Subjects – such as users, customers, and vendors – that their information is going to be kept in the system. For this purpose, we’ve extended your ability to send confirmation emails to all such parties, such as:

1.Customers created through LDAP

2. Non-login customers (that is, customers who don’t have the ability to log into the system)

3. Users registered through SAML

4. Non-login users (that is, users who don’t have the ability to log into the system)

5. Vendors created

These emails also prompt users to choose whether they would like to receive notifications from EZRentOut.

Data Portability:

Data Subjects will be provided the right to data portability. This means they can request access to all their data. For this purpose, we’ve extended your ability to export data by adding the following categories to EZRentOut reports:

1.Vendors

2. Members

3. Customers

3. Address Book

Data Erasure:

Data Subjects can request that all their data is deleted from the system. The GDPR refers to this as ‘the right to be forgotten’. We have a new deletion feature out to accommodate this. For active accounts, data is backed up every 8 hours. After termination of an account, the customer’s data remains in the backup for 6 months.

Note: If the customer wants their data to be removed from backup, they can request at infosec@ezofficeinventory.com

In order to preserve the integrity of our users’ data, however, in some cases, we simply redact personally identifiable information so that your records remain consistent. This happens in cases when individuals are associated with orders, purchase orders, work orders, services, items, or any other items that might affect our customers’ data history.

Have any questions?

We’re committed to protecting your digital rights. If you have any questions about this issue, feel free to write to us at support@ezrentout.com

You can also have a look at our updated Terms of Service and Privacy Policy.