The GDPR (General Data Protection Regulation) is a new EU Regulation which will replace the 1995 EU Data Protection Directive (DPD). It is a law on data protection and privacy for all individuals within the European Union (EU). The GDPR aims primarily to give control back to individuals over their personal data and to simplify the regulatory environment. Being a regulation, not a directive, it forces all countries within EU to implement GDPR by May 25, 2018.
The regulation builds on many of the requirements from the 1995 directive for data privacy and security, but includes new provisions to strengthen the rights of data subjects, the individuals whose personal data is processed, and it adds harsher penalties for companies and organizations that fail to comply with the regulation.
Quinyx has its main establishment in Sweden and our lead supervisory authority is Datainspektionen.
Under the GDPR, you have certain rights related to the processing of your personal data. These are listed below.
Quinyx is in its capacity as data controller responsible for ensuring that your personal data is processed in accordance with applicable law and that your rights are taken into account when we process your personal data. If you want to use your rights, please contact us at firstname.lastname@example.org. You can also contact our DPO, which will be assigned as of 25th of May, at email@example.com if you experience that Quinyx do not live up to your rights.
At Quinyx, we will take all reasonable and possible actions to notify any recipients of your personal data as set out in chapter 5 above regarding any rectification, erasure or restrictions carried out by us. At your request, we will also inform you of which third parties we have shared your personal data with.
You have the right to request access to personal data
You have the right to request an abstract from our data record regarding our use of your personal data. You also have the right to request a copy of the personal information being processed at no cost. However, we may charge you a reasonable administrative fee to provide you with additional copies of the personal data. If you make your access request by electronic means such as email, we will provide you with the information in a commonly used electronic format.
You have the right to request rectification of your personal data
We will at your request, or at our own initiative, rectify, anonymise, erase or complement personal data that you or we discover is inaccurate, incomplete or misleading. You also have the right to complement the personal data with additional data if relevant information is missing.
You have the right to request erasure of your personal data
You have the right to request that we erase your personal data if we do no longer have an acceptable reason for processing the data. Given this, erasure shall be made by us if:
However, there might be requirements under applicable law, or other weighty reasons, which entail in us not being able to immediately erase your personal data. In such case, we will stop using your personal data for any other reasons than to comply with the applicable law, or the relevant weighty reason.
You have the right to restrict processing
This means that we temporarily restrict the processing of your personal data. You have the right to request restriction of the processing when:
You have the right to object to the processing
You have the right to object to such processing of your personal data based upon our legitimate interest (please see chapter 4 above). If you object to such processing, we will only continue with the processing if we have a compelling legitimate reason for the processing that outweighs your interest, rights or freedoms, or unless continued processing is necessary for the establishment, exercise or defence of a legal claim.
You have the right to lodge a complaint with the data protection authority
You have the right to lodge any complaints regarding our processing of your personal data with the data protection authority. The supervisory authority for Quinyx is Datainspektionen, Sweden. https://datainspektionen.se
Should you experience that Quinyx and the DPO do not live up to GDPR and the data subject rights, read more about how to report to Datainspektionen. https://datainspektionen.se
Quinyx processes personal data so that your employer can fulfil your employment contract by allowing your manager and/or colleagues to:
Any personal data in addition to that which is managed by your employer is processed so that Quinyx can:
We do not share your personal data with any parties other than your employer and pre-approved data subprocessors, and we conform to industry best practices regarding data security to ensure that your personal data is safe.
Your personal data is stored as long as your employer chooses to keep it in the system. Typically, this is limited to your period of employment, however your employer may choose to keep some or all of your personal data in the system after your employment ends in order to comply with local legislation. After your personal data has been removed from the system, some or all of it may be kept in backups for a limited time in accordance with the terms of service that have been agreed upon between us and your employer.
Turn to your employer to get an exact summary of which personal data is stored on you.
You must turn to your employer to request a full deletion of your personal data from the system, as some or all of the data may be required to be kept for a certain period in order to comply with local legislation.
Please see this help article.