Paredeflats GDPR compliance statement
Introduction
The EU General Data Protection Regulation (“GDPR”) comes into force across the European Union on 25th May 2018 and brings with it the most significant changes to data protection law in two decades. Based on privacy by design and taking a risk-based approach, the GDPR has been designed to meet the requirements of the digital age.
The 21st Century brings with it broader use of technology, new definitions of what constitutes personal data, and a vast increase in cross-border processing. The new Regulation aims to standardise data protection laws and processing across the EU; affording individuals stronger, more consistent rights to access and control their personal information.
You can read our Terms & Conditions here.
Our Commitment
Paredeflats (‘we’ or ‘us’ or ‘our’) is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place which complies with existing law and abides by the data protection principles. However, we recognise our obligations in updating and expanding this program to meet the demands of the GDPR.
Paredeflats is dedicated to safeguarding the personal information under our remit and in developing a data protection regime that is effective, fit for purpose and demonstrates an understanding of the new Regulation. Our preparation and objectives for GDPR compliance have been summarised in this statement and include the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.
How have we prepared for GDPR
Paredeflats have always had a clear focus on data protection and security across our organisation. In preparing for GDPR we have put in place:
Information Audit
We will regularly carry out a company-wide information audit to identify and assess what personal information we hold, where it comes from, how and why it is processed and if and to whom it is disclosed. Data Protection Impact Assessments (DPIA) will help us develop stringent procedures and assessment templates for carrying out impact assessments that comply fully with the GDPR’s Article 35[1] requirements. We have implemented documentation processes that record each assessment, allow us to rate the risk posed by the processing activity and put in place mitigating measures to reduce the risk posed to the data subject(s).
Policies and procedures
Revising data protection policies / procedures to meet GDPR requirements and standards including data protection, IT security, data retention and erasure, data breaches and third party transfers and disclosures.
Subject Access Request / Right to Be Forgotten
We have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate. If you wish for your data to be erased from our records, please contact us via
Breach Notification
We have a notification process in place for any breach. For further information on this, please contact the Data Protection Officer via +351218076464.
Data Transfer Statement
We have revised our consent mechanisms for obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information. Paredeflats will at times, on an anonymised basis, use personal information to demonstrate the impact of our services. Any case study information shared will always be on an anonymised basis unless we have further explicit consent from individuals.
Paredeflats may use data for specific purposes of statistical analysis and the promotion of our work nationally as well as any reporting requirements for funders who support the network on a national level. Paredeflats will share personal information with law enforcement or other authorities if required by applicable law (including, in line with our Safeguarding and Promoting the Welfare of Children/Safeguarding Adults at risks policies, where there are concerns about the safety or wellbeing of a child or adult at risk and it is considered necessary for their welfare and protection).
Paredeflats will not share your personal information with any other third party without first obtaining your explicit consent.
Direct Marketing/Fundraising
We have revised the wording and processes for direct marketing, including clear opt-in mechanisms for marketing subscriptions, a clear notice and method for opting out and by providing unsubscribe features on all subsequent marketing materials.
Data Subject Rights
In addition to the policies and procedures mentioned above that ensure individuals can enforce their data protection rights, we provide easy to access information of an individual’s right to access any personal information that Paredeflats processes about them and to request information about: -
What personal data we hold about them
The purposes of the processing
The categories of personal data concerned
The recipients to whom the personal data has/will be disclosed
How long we intend to store your personal data for
If we did not collect the data directly from them, information about the source
Right to have incomplete/inaccurate data corrected/completed and the process for requesting this
The right to request erasure of personal data (where applicable) or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use
The right to lodge a complaint or seek judicial remedy and who to contact in such instances
Processor Agreements & 3rd parties
Where we use any third-party to process personal information on our behalf we drafted procedures for ensuring they (as well as we) meet and understand GDPR obligations. Paredeflats gains explicit consent from organisations we work with, suppliers and partner organisations to demonstrate that they too are compliant with GDPR legislation. We hold copies of these statements and for further information on our policy on this, please contact the Data Protection Officer.
Special Categories Data
Where we obtain special category information, we do so in compliance with the Article 9 requirements and have high-level encryptions and protections on all such data. Where we rely on consent for processing, this is explicit and is verified by a signature, with the right to modify or remove consent being clearly signposted.
Legal Basis for Processing - we are reviewing all processing activities to identify the legal basis for processing and ensuring that each basis is appropriate for the activity it relates to. Where applicable, we also maintain records of our processing activities, ensuring that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Bill are met.
GDPR Roles and Employees
Paredeflats have designated Jorge Tome as our Data Protection Officer and we have prompted awareness of the GDPR across the organisation, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures and measures.
Paredeflats understands that continuous employee awareness and understanding is vital to the continued compliance of the GDPR and have involved our employees in our preparation plans, induction and annual training program. All staff are trained and updated on GDPR every two years (or sooner if there is a major change in legislation).
Lodging a complaint
If you have any questions about our preparation for the GDPR, please contact our Data Protection Officer Jorge Tome. Tel: +351218076464 Email: