1. EU-based people and their data

GDPR applies to any personal data about people based in the EU. This includes any individuals you collect personal data on, such as customers/clients, suppliers and employees.

Personal data includes names, contact details, bank account or credit/debit card details, and medical information.

2. The right to know

For some years, individuals have had the right to ask businesses what information is held on them. This continues under GDPR and is tightened up to the extent that businesses must respond to requests within a month.

Supporting Synergist features
You can search for individuals by name from either the client or supplier contact list. Once located, you can export the data you hold on that person to a .csv file using the 'Export option'. The 'Export' facility creates a .csv file of the data stored in Synergist for that contact, showing both the standard and any user-specific fields you created for that contact. Synergist allows you to restrict which of the users of your system have access to the 'export' facility.

3. The right to erase

Customers can ask a business to delete all personal data stored about them unless the information is needed for legal reasons, such as under tax regulations.

Supporting Synergist features
From the client (including prospects and leads) and supplier contact list, there is a facility to delete one or more selected contacts. If the records can't be deleted because they are linked to other records (e.g. the person involved was the contact on a job) then their personal data can be overwritten with 'XXXXXX').

4. Collecting personal data

Under GDPR, you can only collect personal data if your reason is legal, for example, to satisfy a contractual obligation. Even then, you must make it clear what the data is for, and you have to restrict your use of it for that purpose.

Supporting Synergist features
Although Synergist will not be the primary system where people are giving permission for you to process their data (this is likely to be your website content management system or mailshotting / inbound marketing system) for many of our customers, Synergist is their master contact database. For this reason, we have added features to enable you to store their opt-in and communication preferences and dates permission was given, the permission source, along with an automatic history of any changes made and by whom.

5. Data retention

GDPR states that personal data shall be kept for no longer than is necessary for the purposes for which it is being processed. You will, therefore, need to decide how long you hold personal information for in different scenarios (e.g. an enquiry that does not become an active prospect) and have a mechanism for removing older personal records.

Supporting Synergist features
Synergist includes a powerful contact filtering tool to identify such records and a clear-down facility to remove the key data fields likely to hold personal data. This allows these records to be identified en masse and removed as a periodic batch process by a user.

6. Data portability

Individuals can ask for a digital copy of their personal data for any reason, even if it is to help them move to a new supplier.

Supporting Synergist features
You can search for individuals by name from either the client or supplier contact list. Once located, you can export the data you hold on that person to a .csv file using the 'Export option'. The 'Export' facility creates a .csv file of the data stored in Synergist for that contact, showing both the standard and any user-specific fields you created for that contact. Synergist allows you to restrict which of the users of your system have access to the 'export' facility.

7. Data breaches

If certain types of breaches do occur, you are obliged to report them to the appropriate supervisory authority.

8. Data protection and data security

You need to ensure that personal data is processed in a manner that ensures appropriate technical and organisational security. To achieve this, you should keep the data you process secure and ensure appropriate information security policies and procedures are in place. This applies to electronic and paper records as well as physical security.

For on-premise Synergist customers
You need to ensure that your Synergist server, the computers from which you access it, and your network are suitably secure. If necessary, check with your IT support.

For Synergist Cloud customers
The security of your data is of the utmost importance to us, and our reputation as a provider of cloud-based business management systems depends on us maintaining this. Your Synergist cloud instance is managed by ourselves and hosted in the AWS (Amazon Web Services) cloud.  Your data never leaves the AWS environment in our processing of it. AWS was selected as the platform for the Synergist Cloud based on its commitment to Security by Design. If you wish to read more about SbD and the AWS cloud GDPR click here. For security reasons, we do not publish the details of the Synergist Cloud security measures, but we are happy to discuss these with clients if you have specific questions or requirements. Although we manage the security of the Synergist Cloud and enforce only encrypted communication with the Synergist Cloud from users machines, you still need to ensure that the devices from which you access your Synergist Cloud system and user credentials are kept secure, so if necessary check with your IT support.