See the steps we ensure your privacy and protection with Ideanote
On May 25, 2018, the General Data Protection Regulation (GDPR) became fully enforceable across the European Union (EU), creating a higher standard for data protection, privacy, and security for the processing of personal data from the EU. The GDPR applies to the processing of personal data regardless of where that takes place in the world, and impacts any company that handles personal data of EU citizens and others within the EU.
The GDPR is an attempt to strengthen, and modernize EU data protection law and enhance individual rights and freedoms, consistent with the European understanding of privacy as a fundamental human right. The GDPR regulates, among other things, how individuals and organizations may obtain, use, store, and remove personal data. In a nutshell, it's giving EU citizens and residents control over their personal data while simplifying the regulatory environment for international business that takes place in the EU.
The Data Protection Principles include requirements such as:
GDPR adds some new requirements regarding how companies should protect individuals' personal data that they collect and process. It also raises the stakes for compliance by increasing enforcement and imposing greater fines for breach. Beyond these facts it's simply the right thing to do. At Ideanote we strongly believe that your data privacy is very important and we already have solid security and privacy practices in place that go beyond the requirements of the GDPR.
Ideanote is committed to GDPR compliance and there are no shortcuts when it comes to meeting these requirements. We offer a data processing addendum (DPA) for our customers who collect data from folks in the EU. Our DPA offers contractual terms that meet GDPR requirements and that reflect our data privacy and security commitments to our customers.
Our DPA is already part of of the Terms of Service, so no further action is really needed on your part. But if you have any special DPA needs, feel free to contact us. You can always link to https://ideanote.io/legal/dpa in case you need to provide documentation that Ideanote is indeed a GDPR compliant data processor or download the page as a PDF.
Yes, Our Terms of Service have been updated to reflect strict GDPR requirements & compliance. We work with the best in the market to ensure complete compliance and data safety so you can rest easy.
An extensive standardized DPA has been added as an extension of our Terms of Service and includes both the relevant information on data processing along with a list of sub-processors.
We have turned every stone and examined every detail in our design by meticulously reviewing our product, its processes and procedures to make sure we meet the necessary GDPR standards:
Compliant. Updated policies and contract language and DPAs.
Compliant. Updated guidelines, implemented two-factor authentication, audited vendors and IT systems.
Compliant. Developed processes for DSR requests.
Compliant. Completed data mapping and inventory of systems that manage personal data, including implementation of data retention guidelines, data minimization standards, and de-identification methods.
Compliant. Conducted training and implemented additional data controls at the functional level.
Compliant. Updated enterprise Security Incident Response Plan and Database access logging.
Compliant. We have appointed Frederik Wessberg as our Data Protection Officer. He can be contacted at dpo@ideanote.io.
We only work with industry standard service providers for Our Service to be able to supply a service that is up to the highest standards of availability, stability, security and privacy. In other words, we are building on the shoulders of giants. We provide a full and up-to-date list of our Sub-Processors that You can review, if necessary.
Yes, we have in place written Data Processing Agreements (“DPA”) with all of Our Sub-Processors.
We've formed a core privacy team of leaders from each area of the Ideanote business, headed by our internal Data Protection Officer (DPO). The representatives in this group are the project managers who will ensure all the requirements of GDPR are covered from Marketing to Engineering to People Ops.
We have reviewed and identified all the areas of Ideanote where we are collecting and processing Customer data; categorizing and taking inventory of everything from cookies to help desk conversations. Using this matrix we have validated our legal basis for collecting and processing personal data and double checked that we are applying the appropriate security and privacy safeguards across our entire infrastructure and software ecosystem.
Having a managed data protection impact assessment (DPIA) process is a requirement for GDPR. A DPIA process is simply a way to help us identify and minimize the data protection risks of a project. The Ideanote engineering team has always undergone security and privacy due diligence when making tooling and implementation decisions, so this requirement is an easy one for us.
Any time we introduce a change to the way we handle personal data, we spend time discussing the potential impact on Customers of Ideanote and possible privacy and security risks to personal data. If any risk is identified, no matter how small, our product and engineering teams collaborate on a solution that will mitigate the data privacy and security risk to anyone who interacts with the Ideanote platform. We will continue to execute this risk assessment process as we expand the Ideanote offerings.
We already have in place a breach management and communication plan and have updated this existing process to comply with the GDPR regulations concerning the escalation process and requirements for data subject notification.
Consenting to our Terms of Service is an active step in the sign-up process. However, you’re also free to opt-out and be forgotten as per the GDPR Right-To-Be-Forgotten. As you delete content on your Space, such as a member, all relevant member data will be permanently deleted in our user database, and any peripheral data such as ideas will be transferred to an anonymous placeholder.
You’re always welcome to contact us in case you’d like to access, correct, amend or delete information that we hold about you.
At Ideanote we practice transparency internally and we believe that transparency extends to our Customers. With our updated Terms of Service and Privacy Policy we openly describe which personal data we are collecting, processing, why, how we use it, who we share it with and how long we store it. We have always made an effort to keep the language in our Terms of Service and Privacy Policy as clear as possible and we have updated these notices to describe how we are respecting and protecting your personal data. We hope you find it concise, transparent, intelligible and easily accessible.
We've updated our cookie policy to provide you with complete transparency into what is being set when you visit our site and how it's being used. On our cookie policy page you can also read about steps you can take in order to control how your browser handles cookies.
We are committed to helping our customers meet the data subject rights requirements of GDPR. Ideanote processes or stores all personal data in fully vetted, DPA compliant vendors. We do store all conversation and personal data for up to 6 years unless your account is deleted. In which case, we dispose of all data in accordance with our Terms of Service and Privacy Policy, within 60 days. Information regarding legal transactions between Customers and Ideanote will be stored for up to 10 years. We are aware that if you are working with EU customers, you need to be able to provide them with the ability to access, update, retrieve and remove personal data and will assist you with any such GDPR related requests free of charge.
We are working with our Customers to answer any questions and address any concerns regarding how we protect their personal data in accordance with GDPR. If you have any questions, please don't hesitate to reach out at legal@ideanote.io.