GDPR compliance

What is the general data protection regulation (GDPR)?

The GDPR is a regulation designed to harmonize data privacy laws throughout the European Union (EU). This regulation offers individuals in the EU greater transparency and control over how their personal data is used and make companies handling personal data accountable for their choices.

Is Clustermarket a Controller or a Processor?

Clustermarket is considered a processor. We act on the instructions of the controller (you). Similar to controllers, processors are expected to comply with the GDPR.

As a customer of Clustermarket, you operate as the controller when using our products and services. You have the responsibility for ensuring that the personal data you are collecting is being processed lawfully and that you are using processors, such as Clustermarket, that provide sufficient guarantees to meet key requirements of the GDPR.

What personal data does Clustermarket process and how is it used?

We are committed to be transparent in how we handle and process personal data by  following the GDPR key principles:

  • Lawfulness, fairness and transparency
  • Purpose limitation
  • Data minimization
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality (security)
  • Accountability

We only process personal data we actually need for providing our products and services, namely: name, email, IP address and, when applicable, phone number.

We have conducted a detailed risk analysis of all applications that may process personal data. Based on the result of such analysis, we have put in place appropriate measures that allow us to comply with the GDPR.

How do we support you in dealing with data subject rights?

As part of the GDPR, EU data subjects have the following rights:

  • Right to rectification: Users have the right to modify personal information at any time.
  • Right to be forgotten: Users may request for the permanent deletion of their personal data.
  • Right to portability: Users may request that their personal data be exported and sent to another organization or competitor.
  • Right to object: Users may object to specific types of processing or uses of their personal data.
  • Right of access: Users have the right to be informed of any and all of their personal data that has been collected, as well as its intended use.

We have designed our platform with several self-service features that our customers can leverage to assist in reviewing the personal data stored on our platform.

When we, as a processor, receive directly a request from a data subject, we will engage the respective customer as soon as possible (within one month at most) to respond to the data subject request (unless otherwise required by law).