GDPR and UK GDPR
When we serve a client established in the European Union or the United Kingdom, we apply the European framework in addition to the Colombian one.
Our role
In most cases we act as processor: the client decides what data is processed and for what purpose, and we process it on their documented instructions.
We are controller only in respect of data relating to our own commercial contacts, website users and staff.
Data processing agreement
We sign a data processing agreement (GDPR Article 28) setting out the subject matter, duration, nature and purpose of processing, the categories of data and data subjects, and both parties' obligations.
You can request the template by writing to info@adnvortex.com.
Data subject rights
If you are a data subject and your data sits in a client's space, approach that client, who is the controller. If you approach us, we will forward the request and let you know.
We respond to data subject requests within the one-month period the GDPR provides, extendable by two months in complex cases.
International transfers
Our operation is in Colombia. For transfers from the European Economic Area or the United Kingdom we use the standard contractual clauses approved by the European Commission and, where applicable, the UK addendum, together with a transfer impact assessment.
Security breaches
We notify the client of any personal data breach without undue delay after becoming aware of it, with the information they need to meet their own 72-hour notification obligation to the authority.
Contact
Data protection matters: info@adnvortex.com.
If your organisation requires a formal contact point for privacy matters, we designate one in the processing agreement.