Privacy Policy

Our WFM software (from version 7 on) includes functionalities that allow our customers to fulfil their obligation to facilitate the exercise of data subjects’ rights to access, correct and/or erase personal data pertaining to them. Please refer to the document “GDPR SISQUAL WFM” for more details and also for information about any situations that the customer depends on us to facilitate the exercise of data subjects’ rights.

We don’t treat any personal data stored by the customer or its end users in the WFM database for any purpose not included in the cloud service contract, unless the customer gives us instructions to do so. We also don’t use that personal data for the purposes of marketing and advertising.

We will notify the service customer, in accordance with any procedure and time periods agreed in the contract, of any legally binding request for disclosure of personal data by a law enforcement authority, unless such notification is otherwise prohibited (e.g. to preserve the confidentiality of a law enforcement investigation).

We will consult the service customer where legally permissible before making any personal data disclosure and accept any contractually agreed requests for personal data disclosures that are authorized by the service customer.

We will record all disclosures of personal data to third parties such as those arising from lawful investigations or external audits, including what data has been disclosed, to whom, at what time, and the source of the authority to make the disclosure.

We will promptly notify the customer in the event of any unauthorized access to personal data or unauthorized access to processing equipment or facilities resulting in loss, disclosure or alteration of personal data, and we will provide the information necessary for customer to fulfil his obligation to notify relevant authorities. This notification obligation does not extend to a data breach caused by the customer or by a data subject or within system components for which they are responsible.

In the event that a data breach involving personal has occurred, we will maintain a detailed record of the incident including a description of the data compromised, if known, and of any notifications performed according to applicable laws and regulations.

In case of termination of the contract, after receiving and satisfying a request to return the personal data to the customer, transfer it to another cloud provider or to another personal data controller (e.g. as a result of a merger), we will assure the secure deletion of all data  (by us and any of our authorized sub-contractors) from wherever they are stored, including for the purposes of backup and business continuity, as soon as they are no longer necessary for the specific purposes of the customer.

Our use of sub-contractors participating in personal data treatments is stated in the contract with the customer. We will inform the customer in a timely fashion of any intended changes in this regard so that the customer has the ability to object to such changes or to terminate the contract. We will inform the customer about the names of our relevant sub-contractors, the countries in which they may process data and the means by which those sub-contractors are obliged to meet or exceed our own obligations.

We will also inform our customers about the countries where personal data might possibly be stored, arising from the use of sub-contractors. Any intended changes in this regard will be informed to the customer in a timely fashion so that the customer has the ability to object to such changes or to terminate the contract.

SISQUAL has implemented and continually improves technical and organizational measures aligned with the guidance and requirements of ISO/IEC 27001, 27002 and 27018 international standards, to ensure that the contracted security arrangements are in place and that personal data is not processed for any purpose independent of the instructions of the customer, and also to guarantee compliance with relevant information security and personal data protection obligations imposed by applicable laws and regulations like GDPR. We are finalizing the certification process according to ISO/IEC 27001 and 27018, but also according to ISO/IEC 20000-1 and ISO 9001.

All our staff is made aware of the possible negative consequences on data subject’s, on our customers, on SISQUAL and on the staff member her/himself, of breaching privacy or security rules and procedures, especially those addressing the handling of personal data and related assets.

Our WFM cloud software is provided in a Software as a Service (SaaS) model, so the customer is responsible for all aspects of access management for the users under its control, by providing administrative rights to manage or terminate access.

We recommend all our customers to implement procedures for user registration and de-registration to avoid situations where user access control is compromised, such as the corruption or compromise of passwords or other user registration data (e.g. as a result of inadvertent disclosure), aligned with the guidance and requirements of ISO/IEC 27001 and 27002 international standards.

To enhance the protection of personal data we use HTTPS encryption.

We assure backup and restore of all data residing in the cloud provider.

We undertake independent internal audits and we are audited by an accredited certification body every year. These audits verify that information security and privacy is implemented and operated in accordance with our policies and procedures.