Data Protection Readiness for SMBs              

Data Protection Readiness for SMBs is offered in 3 editions:  

Price example for the standard edition with 2 languages:

• 1 x one-time implementation = CHF 410.00
• 2 x licence per language = CHF 54.00
• 1 x hosting = CHF 190.00
• Total: CHF 410.00 one-off and CHF 244.00 annual hosting fees.

Detailed information about prices: fccDataPrivacy price list.

Data Protection Readiness for Clubs     

Data Protection Readiness for clubs is offered in 3 editions:

Price example for the standard edition with 2 languages:

• 1 x one-time implementation = CHF 260.00
• 2 x licence per language = CHF 54.00
• 1 x hosting = CHF 160.00
• Total: CHF 360.00 one-off and CHF 214.00 annual hosting fees.

Detailed information about prices: fccDataPrivacy price list.

Legal Documents  

Legal documents are (usually published on the website):

• Privacy Statement
  The privacy statement (GDPR Art. 13 and 14) describes how personal data is processed by an organisation, i.e. how this data is collected, used and whether it is disclosed to third parties. In addition, it often describes what measures an organisation takes to ensure the privacy of its customers or users.
• Cookie policy
  Based on the e-Privacy Directive (or Cookie Law), when using cookies, organisations are obliged not to process a user's personal data without their consent. The Cookie Policy must identify all cookies used that may collect personal data.
• Cookie banner
  The cookie banner is the legal implementation of the e-Privacy Directive and is displayed on the user's first visit (and, depending on the configuration, on subsequent visits) to a website and allows the user to allow or refuse the installation of cookies on their computer.

Processing Activities      

According to Article 30 GDPR (processing activities), each controller must maintain (and keep up to date) a processing register. This includes

• Name and contact details of the controller
• Purposes of processing
• Description of categories of data subjects and data
• Categories of recipients
• Third countries to which data are transferred
• Deletion periods for personal data
• technical and organisational measures to protect data.

For supported club administration software, the processing activities in fccDataPrivacy is already defined for clubs. These processing activities are based on the functional capabilities of the respective club administration software and not on the actual use in a club / association. If desired, the processing activities can be adapted to the actual use (project according to expenditure).

Consent      

Generally the processing of personal data of natural persons is prohibited (Art. 6 GDPR, lawfulness of processing), unless it is explicitly permitted by a number of recitals. One of these recital is consent. Consent is required for all newsletters or online orders, i.e. for all web forms that collect personal data. The website operator (responsible person) must be able to prove consent, i.e. all given consent must be stored.

fccDataPrivacy stores all consents in the background and makes them available in the admin portal. Consent includes:

• who provided the consent
• when and how consent was acquired from the individual user
• the consent collection form they were presented with at the time of the collection
• which conditions and legal documents were applicable at the time that the consent was acquired.

User Rights     

According to Art. 12 (Rights of the Data Subject) and 13- 22 (Information and access to personal data), GDPR provides the following rights for individuals (aka data subjects, users):

• The right to be informed
  Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR.
  
• The right of access
  Individuals have the right to access their personal data.
• The right of rectification
  The GDPR includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete.
• The right to erasure
  The GDPR introduces a right for individuals to have personal data erased. The right to erasure is also known as ‘the right to be forgotten’.
• The right to restrict processing
  Individuals have the right to request the restriction or suppression of their personal data. This is not an absolute right and only applies in certain circumstances.
• The right to data portability
  The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability. 
• The right to object
  The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances. Individuals have an absolute right to stop their data being used for direct marketing.
• Rights in relation to automate decision making and profiling
  The GDPR has provisions on automated individual decision-making (making a decision solely by automated means without any human involvement) and profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process. The GDPR applies to all automated individual decision-making and profiling. Article 22 of the GDPR has additional rules to protect individuals if you are carrying out solely automated decision-making that has legal or similarly significant effects on them.

fccDataPrivacy has implemented these rights and the related processes can be triggered within the Admin Portal.

Admin Portal      

The admin portal contains all the functions, documents and data required for ongoing operations, including auto trail (proof of change).

Both the website and the admin portal are state-of-the-art protected against cyber attacks and access to the admin portal is additionally secured with two-factor authentication.

Education        

As a registered customer, your defined users have access to a Learning Management System (Campus) which offers initial and ongoing learning lessons about GDPR and how to use GDPR in a Club. Each learning session is accompanied by a short examination (Quizz). When passing the quizz with 75% correct answers the user will receive a certificate and this education will be registered within your education evidence (which is a legal obligation to demonstrate the education proof).

Support            

Registered customers have access to a ticketing system in order to report problems.