Dataprotection - GDPR

The following applies when using INNOMATE HR via cloud.

Data Processing Agreement

By accepting the Subscription Terms for the use of INNOMATE HR, you also agree to a Data Processing Agreement, 01.07.2024, in accordance with the provisions of the EU's General Data Protection Regulation and the corresponding Danish legislation. The Data Processing Agreement follows the Data Protection Authority's Standard Contractual Clauses.

INNOMATE's compliance with the Data Processing Agreement is subject to independent auditor review. The result of the most recent audit, which took place on 22.12.2023, can be found here: IT audit declaration, signed, IT audit declaration, original.

INNOMATE is working towards ISO 27001 certification.

IT security with us as your Data Processor

The management of INNOMATE is ultimately responsible for IT security and for continually establishing the necessary policies, procedures, and tools to support it.

The INNOMATE GDPR-group is operationally responsible for the ongoing updating, control, and documentation for compliance with IT security.

For example, IT security includes the following elements:

Instructions

All access to personal data occurs according to instructions from the data controller (section 9.3). We practice this as follows:

1. The instruction is general concerning the performance of tasks agreed with each customer regarding the delivery and operation of the HR-solution, including what is described in the underlying subscription agreement, and thus also includes regular system maintenance, which ensures consistency and operational reliability.
2. Resolution of ordered tasks. As a general rule, ordering must be made and/or confirmed by the data controller via support@innomate.com.
3. Support of data controllers generally only occurs after inquiry via support@innomate.com.

Access and Logging

1. Access to customer databases is only possible with a personal login, which only authorized personnel possess.
2. A log is kept of all access to and processing of personal data.

Security

1. All access to and transfer of personal data between the customer and INNOMATE takes place in a way that prevents unauthorized access to personal data. I.e., via a secure and encrypted connection.
2. Data is physically secured on INNOMATE's servers and never on mobile devices.
3. Personal data is routinely backed up.
4. Access to the customer's personal data is limited to employees in INNOMATE who are approved by the management of INNOMATE A/S and who have signed a confidentiality agreement.

Sub-processors

According to section 7 of the Data Processing Agreement, INNOMATE is entitled to use sub-processors but is obligated to inform the data controller about the identity of these sub-processors.

INNOMATE A/S uses and has entered into data processing agreements with the following sub-processors:

According to INNOMATE's Data Processing Agreement, sub-processors are subject to the same data protection obligations and contractual conditions as INNOMATE, including that personal data is stored within the EU/EEA.

Security at the Customer as Data Controller

INNOMATE HR is designed to support the EU's General Data Protection Regulation. The solution meets the requirement for data protection by design and by default, which means that access to personal data is protected so that only those who need it are granted rights to access specific data.

Access to Personal Data

Access to personal data is controlled by so-called permission rules, which follow the relations between users. Access can be defined down to the field level. The permissions are set up according to the customer's instructions.

Transparency

It is a fundamental principle in the EU's General Data Protection Regulation that it must be clear, for example, to an employee, what data a company stores about the individual. INNOMATE HR is designed so employees can access all data about themselves.

Deletion of Data

As soon as personal data are no longer relevant to the company, such data must be deleted. INNOMATE HR ensures through automated workflows when data is deleted. For example,

• all information on an applicant is deleted no later than half a year after the receipt of the application,
• parts of an employee's data are deleted when the individual has left the company - and the rest after 5 years.

The rules for deletion are set up according to the data controller's instructions.

Contact Us

For questions, please feel free to contact us at privacy@innomate.com.