On this page (8)
- What personal data TraxSystem processes
- How long the system keeps data: retention and anonymisation
- Who can see the data: permissions, visibility scope and audit
- Is there a data processor and a data processing agreement?
- Where the data is physically stored
- Driver consent and the privacy notice
- Frequently asked questions about personal data
- Related
TraxSystem is not “GDPR compliant” on its own, and nobody can promise that on the data controller’s behalf. Compliance depends on how the system is configured and on the retention periods the controller sets. We provide the mechanisms needed for compliance: retention, anonymisation, audit and restricted visibility.
What personal data TraxSystem processes
By the nature of what it does, TraxSystem processes data about the people who drive or walk onto the site: drivers, visitors, employees and contractor staff. This covers first name and surname, date of birth, ID document number, phone number, company name and the scanned image of a document, and, where time and attendance is used, attendance data as well. On top of that there are photos and short video clips from the cameras, saved at entry, at exit and at passages through access control points; they show the vehicle, the number plate and often a person too.
In a data protection impact assessment, an employee’s attendance data carries a different weight from a vehicle registration number. In TraxSystem it is subject to the same retention mechanisms as the rest of the data.
How long the system keeps data: retention and anonymisation
Retention rules in TraxSystem are set by the data controller, separately for each category of data, including separate periods for photos and for camera clips (60 days each by default). The retention job runs once a day and removes data whose period has expired.
Anonymisation is irreversible. It replaces personal data with values that do not allow anyone to be identified, and it deletes phone numbers rather than replacing them. We point this out before deployment, because anonymised data cannot be restored.
Document scans and attachments have their own retention settings, independent of the text records, because the image of a delivery document and the entry record do not need the same retention period.
Retention does not purge backups, because backup is a separate procedure. The policy for backup archives is set by the controller.
Who can see the data: permissions, visibility scope and audit
Access to data in TraxSystem is governed by two layers: permissions and visibility scope.
Permissions determine what a user can do. There are 217 of them, in 24 groups, and they are assigned to roles. They are deliberately fine-grained, so an operator gets exactly what the job requires.
Visibility scope determines which data a user sees: which target sites and which entry types. Access is denied by default: a user with no role assigned has no access to data. The scope also applies to reports and exports, so downloading a file does not get round it.
The audit trail records every change together with the user account and the time. It answers the auditor’s question “who changed this value?” and the data protection officer’s question “who viewed this data?”.
Is there a data processor and a data processing agreement?
The answer depends on which TraxSystem deployment variant you choose. The software is identical in both; what differs is the legal roles.
| On your server | In our cloud | |
|---|---|---|
| Data controller | You | You |
| Data processor | none | us |
| Data processing agreement | not needed | required before go-live, template ready |
| Data location | your server room | Poland, no transfer outside the European Economic Area |
| Sub-processing | not applicable | depends on the choice of infrastructure, see below |
| Breach notification | You | we notify you, you notify the supervisory authority |
With a deployment on your server, drivers’ personal data does not leave your infrastructure, and there is neither a data processor nor any transfer to a third country. For some organisations this is a hard requirement, and then the choice is easy.
With a cloud deployment we host the system, so EROW acts as the data processor. We sign a data processing agreement, and you remain the data controller.
Whether there is a sub-processor depends on the choice of infrastructure. On our own infrastructure there is none. On an external provider’s infrastructure there is a sub-processor, which we name in the data processing agreement. Settle this before filling in the paperwork, because in that case the same product has two different compliance profiles.
Where the data is physically stored
With a cloud deployment of TraxSystem, the data is stored in Poland. There is no transfer outside the European Economic Area or to third countries, so there is no need to rely on standard contractual clauses.
With a deployment on your server, the data is wherever your server is.
Driver consent and the privacy notice
The TraxSystem kiosk does not ask drivers for consent to data processing. The legal basis for processing and the content of the privacy notice are decided by the data controller, in other words the plant. If the plant wants drivers to confirm that they have read the notice, it can prepare it as a template in the Declarations module and have it signed at the kiosk or on the terminal, with translations into the drivers’ languages.
Frequently asked questions about personal data
Can one person’s data be deleted on request?
Yes, by anonymising that person’s records. The operation is irreversible and leaves a trace in the audit trail.
Can an employee see their own attendance data?
That is up to the system administrator, who decides through roles who sees what. Requests from data subjects are handled by the data controller.
Who is responsible for the data in a logistics park with tenants?
That depends on the agreements between the park manager and the tenants. TraxSystem provides mechanisms for separating tenants’ data, and the legal roles are set out in the contracts.
Will we get documentation for the data protection impact assessment?
Yes. We provide a description of the data categories, mechanisms and data flows, and for the cloud variant a template data processing agreement as well.
Can we move the deployment from the cloud to our own server?
Yes, in either direction, with the price agreed individually.
Related
Architecture and deployment modelsReports and visibility scopeLicence and supportPricingPrivacy policy
Further reading: Driver data at the gatehouse: retention · Entry log and GDPR: who sees driver data · Permissions vs visibility scope