The deadline for GDPR is fast approaching on 25 May, 2018. The OneFitStop team has been working to ensure that all the necessary steps are taken to ensure compliance with GDPR and we thought it would be valuable to provide this set of common questions asked by our customers about GDPR. If you cannot find the answer you are looking for, please contact us on support@onefitstop.com.
This is not legal advice. We urge you to consult your own legal counsel to familiarize yourself with the requirements that govern your own specific situation.
Is OneFitStop GDPR compliant?
OneFitStop has been reviewing all our processes and procedures and taking the necessary steps to ensure we are compliant with GDPR. Like all businesses that process personal data on behalf of EU citizens, there are specific roles and responsibilities OneFitStop has been implementing to ensure compliance by 25 May 2018.
Does the GDPR affect my business?
Any organization with a presence in an EU country or any company that processes personal data of EU residents and citizens will be impacted by this regulation.
Does it impact small businesses too?
Yes. Any business that processes the personal data of EU citizens and residents must comply with the GDPR.
GDPR and OneFitStop
Where is OneFitStop’s consumer data stored? Where are OneFitStop’s backup servers located?
OneFitStop stores all data in servers located within the United States. OneFitStop’s infrastructure is hosted within Amazon Web Services (AWS) which has a Privacy Shield certification ensuring compliance with GDPR regulations related to transferring data outside of the EU. Click here for a detailed explanation of how the Privacy Shield requirements align with the new GDPR guidelines.
Will clients and members have “the right to be forgotten” and have their data removed from OneFitStop upon request?
OneFitStop is currently implementing tools for customers to field requests to remove client and member data. These tools will enable customers to conduct these activities on their own accord. The OneFitStop support team will currently field these requests.
Does OneFitStop have a documented Breach Notification Process?
Yes, we have an internal, documented Breach Notification Process. Externally, we will be updating our Terms of Service to include a more detailed description of our notification obligations in the event of a data breach.
What are my responsibilities (as a customer of OneFitStop)?
Customers of OneFitStop are considered ‘data controllers’ under GDPR terminology. You are responsible for ensuring the compliance with the key requirements of GDPR. While you contract with us (OneFitStop are the ‘data processors’) to store and process data on your behalf, it is important to understand that under the GDPR the primary obligation remains with you the controller.
As the data controller, you are responsible for ensuring compliance with the key requirements of the GDPR. This includes notifying individuals of how you handle their personal information, obtaining their consent where appropriate, addressing their requests for access to their information, etc.
OneFitStop will provide you with assistance in meeting those requirements where possible and appropriate. For example, OneFitStop may provide you with tools and processes to assist you in honoring individuals’ requests, including requests for deletion, data portability, access, and rectification. However, please note that you remain ultimately responsible for compliance with these requirements, including, for example, to answer your clients’ requests.
How does GDPR affect my ability to communicate with my Customers?
Under GDPR, you are required to obtain consent of the client to whom the data relates. Communication with your clients requires consent when processing data directly related to marketing your service.
OneFitStop is currently making changes to the mobile app that clients access to opt out of such communication that is triggered by OneFitStop. Clients will not be able to opt out of certain triggered emails like password reset emails etc.
How do I get ready for GDPR?
We have prepared a guide to GDPR which is available on our blog here. This will help you get started but ultimately it is up to you to ensure that you are compliant with GDPR when the time comes around. GDPR is not something to be afraid of but it is definitely something you should not ignore.
What emails will clients receive even if they have opted out for communication?
The following triggered emails are considered operational, and will be sent regardless of whether a client has opted out of communication preferences:
- Session Confirmation
- Successful Charge Notification (if turned on by customers)
- Failed Payment Notification
- Welcome Email Containing Username and Access Details
- Forgot Login Information
Where can I post my privacy notices, consent requests or other similar elements within the OneFitStop product to help me prepare for GDPR?
OneFitStop has implemented new functionality related to the ‘liability release’ policies that can be configured to include business owners Privacy Policy and Terms & Conditions. The Liability Release can be configured in Account Settings > Configurations.
Business owners can now require clients to re-agree to the updated policy at time of next booking and the policies have been integrated into the mobile applications suites as well as all web experiences.
The historical policies and most recent agreed policies by clients are stored within their client file > client information section.
Comments