The EU General Data Protection Regulation (GDPR) applies to any organisation that processes personal data about citizens in the EU. The GDPR is intended to strengthen and unify data protection for all individuals within the EU. The Holiday Tracker is committed to GDPR compliance and this document details the steps we have taken to ensure we meet the standards set out by the GDPR.
Our policies and processes have been reviewed and updated where necessary to ensure we are fully GDPR complaint.
The data we store is encrypted, access is protected by strong passwords and the data is regularly backed up.
All of the personal data we store is available to administrators through the Reports page of The Holiday Tracker, so any “right of access” requests can be fulfilled without any required intervention from The Holiday Tracker employees. Employees can also be deleted from within The Holiday Tracker therefor enabling the customer to implement any "right to erasure” requests from their employees.
We make use of a limited number of trusted third parties and will communicate to our customers if the third parties we use change at any point.
A full list of the personal data that may be stored about an employee can be found in the following Excel document:
TheHolidayTrackerDataList.xlsx
The GDPR applies if the data controller (an organisation that collects data from EU residents), processor (an organisation that processes data on behalf of data controller) or the data subject (person) is based in the EU. In this context, you (our customer) are the data controller, and we (The Holiday Tracker) are the processor, and your employees are the data subjects.
As a data processor, we’ve taken the time to understand the requirements of the GDPR and made changes to our policies and procedures to ensure our compliance. Due to our already stringent approach to the security and privacy of your data, few changes have been required to our policies and procedures, however this document will help highlight the aspects that correlate with the GDPR requirements.
Our Terms and Conditions, which you (our customer), will need to accept when registering to use The Holiday Tracker, contain the mandatory data controller to data processor provisions under Article 28 of the GDPR.
By updating our systems, policies and procedures to meet the requirements of the GDPR, we provide a foundation for our customers to become GDPR compliant, but we do not guarantee the GDPR compliance of our customers.
We also process certain personal information about our customers, potential customers and website visitors for our own purposes, as data controllers. For further information, please see our Privacy Policy.
Policies
Data protection by Design and by Default (Article 25) requires that data protection is designed into the development of business processes for products and services.
Guided by a regularly updated internal information security policy, we ensure that all of our employees are fully versed on what is expected of them when handling any data. We refresh our employees’ training every six months to ensure they comply with our strict requirements around handling data and information.
In addition to refresher training, we continuously review and improve our security policy and our internal processes. This ensures that as our business evolves, our attitude to the security of your data evolves with it.
Our employees are vetted and trained in the confidentiality of customer data and are required to sign a confidentiality agreement. As with our security training, this is refreshed every six months.
We also regularly review and update our internal security risk assessment and business continuity plans.
Development
The security of The Holiday Tracker and the data within it is a key metric we measure as we design, develop and test new features. We use the latest framework releases and follow industry recommended development practices. Advanced automated test suites, combined with rigorous manual testing ensures all new features are robust before any updated code goes live.
We regularly subject our production code to a range of automated penetration tests to identify and fix any exploits that intruders could use to gain access to the system.
Data
We use industry standard SSL encryption to encrypt all data transferred between you and our servers – look for the padlock in your browser. We also employ encryption-at-rest on the data stored on the servers.
The GDPR also states that records of processing activities must be maintained. Every action taken in The Holiday Tracker, by any user (including our own employees) is recorded in the Audit Log against each employee. The Audit Log can be viewed and filtered by admin users.
Breach Reporting
In the case of a personal data breach (such as an accidental or unlawful loss, or disclosure of personal data), the data controller must notify the relevant supervisory authority of such breach no later than within 72 hours of becoming aware of it, unless such breach is unlikely to result in a risk to the rights and freedoms of individuals. We will notify all customers as is practicably possible after the discovery of such an event.
According to the GDPR "personal data is any information relating to an identifiable individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address."
The Right of Access
Your employees have a right to get access to all personal data and information stored about them and to information on how this data is being processed. As a data controller, you have to provide, upon request, among other things, an overview of the categories of data that are being processed as well as a copy of the actual data. The following reports enable you to export all of the data stored on your employees:
Finally, any documents that have been uploaded against an employee’s profile are downloadable from the Related Documents page of an employee’s profile.
The Right to Erasure
Under certain circumstances, the data subject can request that the data controller erases their personal data. Personal data should also only be stored for as long as is needed for the purpose it was collected, unless you have other grounds for retaining it. As the data controller, we leave the decision on how long to retain the data for in your hands, but provide you with the tools required to delete the data when you see fit.
We have developed a new feature within The Holiday Tracker which allows you to delete an employee and ALL data stored against them. This is in addition to the already existing feature of making an employee “inactive” and retaining their data.
Backups of our data are taken every 10 minutes and are retained for two weeks. So after deleting an employee, all trace of their data will be gone from our servers within two weeks of the deletion date.
The Holiday Tracker make use of a limited number of third party services to provide you with the service we make available. Any changes to the third parties we use will be communicated to all customers in advance of the change.
Our email is hosted by Google’s G-Suite, so any emails you exchange with our employees, or with our support@theholidaytracker.co.uk email address is stored and processed on Google’s servers.
The Holiday Tracker makes use of Google Analytics to better understand how our customers and their employees use our product. Google Analytics collects anonymised statistical data about the use of our website and The Holiday Tracker application.
We use Google Analytics to help us identify how users make use of our website and The Holiday Tracker itself. No personal data is passed to Google Analytics and it is impossible to correlate a particular user’s browsing behaviour with any data stored within Google Analytics. Google Analytics simply allows us to view anonymised statistical data about how our users make use of The Holiday Tracker.
Google’s Privacy Policy: https://www.google.com/policies/privacy/
Microsoft
The Holiday Tracker application and all data is hosted by Microsoft in it’s UK data centres. We chose Microsoft as their experience and reputation inspire confidence in their ability to keep your data safe and secure. By using their Azure platform, we’re guaranteed that our servers and firewalls are always up to date. Security patches are applied automatically without the need to shutdown or restart the servers hosting The Holiday Tracker
You can read more about their specific standards and procedures, and their approach to GDPR compliance at the links below.
https://azure.microsoft.com/en-gb/support/trust-center/
https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/default.aspx
SendGrid
Any automated emails sent by The Holiday Tracker, such as holiday request notifications, are sent via our email partner SendGrid, who are based in the US. To ensure the adequate protection of personal data, they have certified to the EU-US and Swiss-US Privacy Shield Framework. More details on this can be found at the links below.
https://sendgrid.com/blog/sendgrid-is-privacy-shield-certified/
https://sendgrid.com/resource/general-data-protection-regulation/
Stripe
Credit and debit card payments are handled by our partner Stripe Payments Europe Limited. As with all third parties, we provide them with the minimum amount of data required for them to provide the required service. In Stripe’s case, this is limited to the card payment details you provide on the billing page. In addition, we don’t store your card details ourselves at all, other than the last four digits of your card and the expiry date.
Stripe’s parent company are based in the US and in order to process payments, Stripe Payments Europe transfers personal data to Stripe, Inc. in the US. To ensure the adequate protection of personal data, they have certified to the EU-US and Swiss-US Privacy Shield Framework. More details on this can be found at the link below.
https://stripe.com/privacy-shield-policy
If you decide to terminate your use of The Holiday Tracker, then at the end of the contract we will hold the personal data of your employees for three months, and then delete ALL such data from our database. Backups of our data are taken every 10 minutes and are retained for two weeks. So after deleting your data, all trace of the data will be gone from our servers within two weeks of the deletion date.
The Nature and the Purpose of the Processing
The Holiday Tracker enables its customers to record, monitor and analyse employee holiday and absence data. In addition to absence data, customers can record HR-related data against each employee and upload documents to be attached to an employee’s profile.
The Types of Data to Be Processed
An Excel document containing the exact fields of data that can be stored against an employee can be downloaded from here. Below is a summary of the types of data.
If you have any questions about any of this document, please contact Anthony Burns on 0191 241 3754 or support@theholidaytracker.co.uk
7 Days Completely Free
No obligation. No credit card required.
Safe and Secure
Hosted in the UK. Backed up every 5 minutes.
Help Always on Hand
Questions answered quickly over email or phone.
Enter your email address to login:
Not currently using The Holiday Tracker? Start a Free Trial