Legal & Regulatory
GDPR Data Rights
Your data protection rights under the EU and UK GDPR. Access, correction, erasure, objection, and portability, and how to exercise them with SoftSapien.
1. Introduction
This page summarizes the data protection rights available to individuals under the EU General Data Protection Regulation and the UK GDPR (together, "GDPR"). It supplements our Privacy Policy.
2. Who This Applies To
These rights apply to individuals in the European Economic Area, the United Kingdom and Switzerland whose personal information we process, including website visitors and people who contact us or submit information through our forms and chat.
3. Data Controller
SoftSapien is the controller of the personal information collected through this website. When we process personal information on behalf of a client under a services agreement, we act as a processor and the client is the controller.
4. Legal Bases for Processing
| Legal basis | Examples |
|---|---|
| Legitimate interests | Responding to business inquiries, operating and securing the website, improving our services |
| Contract | Steps taken at your request before an engagement, and performance of an engagement |
| Consent | Optional analytics cookies and certain marketing communications |
| Legal obligation | Record keeping and responding to lawful requests from authorities |
Where we rely on legitimate interests, we balance them against your rights and freedoms.
5. Your Rights
Subject to applicable conditions and exceptions, you have the right to:
- Access the personal information we hold about you
- Rectify inaccurate or incomplete personal information
- Erase your personal information in certain circumstances
- Restrict our processing of your personal information
- Port your personal information to another provider
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent at any time where processing is based on consent
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
6. International Transfers
As a global organization, we may transfer personal information outside the country in which it was collected. Transfers from the EEA, UK or Switzerland rely on appropriate safeguards, such as the European Commission's standard contractual clauses and the UK International Data Transfer Addendum, or on an adequacy decision where one applies.
7. How to Exercise Your Rights
To exercise any of these rights, submit a privacy request and select "Privacy, legal & compliance." We may ask you to verify your identity. We respond within one month of receiving your request, and may extend this by up to two further months for complex or numerous requests, in which case we will tell you within the first month.
8. Lodging a Complaint
If you believe we have not handled your personal information in line with the GDPR, please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where the alleged infringement took place.
Questions about this policy?
Contact SoftSapien about privacy, data rights, accessibility or compliance matters.