The General Data Protection Regulation (GDPR) came into effect on 25 May, 2018, replacing the 1995 EU Data Protection Directive. It's a new pan-European regulation. GDPR expands the privacy rights granted to individuals and places greater obligations on organisations who handle personal data of those individuals (data controllers and processors).

The purpose of the GDPR is to provide a set of standardised data protection laws across EU member countries which citizens greater control over their personal data. For example, giving you greater transparency into how your data is being used and ensuring that the organisations you entrust with your data are taking care of it.

Time etc is compliant with GDPR and has been since it's introduction in 2018.

We've put together this brief guide to highlight some of the most important aspects of GDPR as regards your relationship with us. We've spent a lot of thinking about and reacting to GDPR. But the application of GDPR is highly specific to your own unique circumstances. Also, guidance is still being issued by regulators regarding how it is to be implemented. So, this guide is provided for informational purposes only ,as a general guide to some of the issues GDPR may present for your business. It should not be relied upon as legal advice, or to definitively determine how GDPR might apply to you and your organisation. We'd encourage you to understand your own GDPR responsibilities and requirements, and that might include you talking to a legal or privacy professional about how GDPR affects your business and what to do about it

We have updated our Privacy Policy and Terms and Conditions to be fully compliant with the requirements of GDPR. In addition we have introduced a Cookies Policy and Data Processing Terms. We have also conducted a full audit of the information we hold and have made a number of changes to our business, processes and systems to accommodate GDPR. Many of these changes, security measures and GDPR requirements are listed in this document and in our privacy policy.

As a client, you are a data subject and Time etc is a controller responsible for the processing of personal data about you. We collect, store and use your personal data principally in order to meet our contractual obligations, contact you, provide a Virtual Assistant service to you, provide access to your account and provide help and support. We may share your data with third parties, some of which may be outside of the EEA, but only for the purposes of servicing your account. You have certain rights around this data. More detail on our use of personal data about you is provided in this document and in our privacy policy.

Where personal data is contained in any materials you provide to us or your freelance Virtual Assistant, then depending the nature of your business, and the tasks that your freelance Virtual Assistant carries out for you, you are highly likely to be a data controller under the scope of the GDPR. If you use our tools to store and process that data, then we will be your 'data processor', and as such will be responsible for it being processed in accordance with your instructions and GDPR. Where you send materials direct to your freelance Virtual Assistant, and we do not view or receive it, your freelance Virtual Assistant will be your 'data processor' and as such directly responsible to you for the processing of the data.

Being a data controller means that you have serious obligations under GDPR - for example you must inform any data subjects that you collect data from that you pass that data to third parties for sub-processing. These are detailed elsewhere in this document.

Any business that processes personal data belonging to data subjects in the UK or Europe must be fully compliant with GDPR. We can't advise you on this. For official guidance on how to ensure that your business is GDPR compliant please talk to your lawyer; for a summary of the requirements, visit the ICO's guide for small businesses here.

One of your most important responsibilities under GDPR is that you must inform your data subjects if you intend to share their personal data with your Virtual Assistant and, if applicable, Time etc Limited. You must also gain explicit consent from your data subjects, where required.

We take our obligations under GDPR very seriously and have made extensive improvements to our platform and legal documentation to comply with the requirements of GDPR.

Active security measures:

• Firewalls at network and server level
• Attack detection with automated blocking
• Encryption of data at rest
• Encryption of data during transit
• Data minimisation - all pages modified to display least viable amount of data
• Checksums to ensure the integrity of data records
• Intrusion detection monitoring
• Regular software updates
• Pin code access required to access data by staff
• Access to data restricted to only required personnel
• Access to data password protected
• Physical security including alarm systems, physical barriers and access control
• Third party vulnerability scans
• Database access restricted to management persons only
• Database access restricted to corporate IP addresses only

Backups and recovery:

• Data is backed up to multiple replica servers on a live/live basis
• Data is backed up on alternate days at 5am UK time
• Data is backed up over secure encrypted tunnels
• Data is also backed up to Amazon S3 cloud storage service

Our development team have made extensive changes to our platform and infrastructure to minimise the processing and storage of personal data where possible. In addition our development team have adopted a new GDPR compliant development policy that puts the need for privacy at the heart of all new systems and projects.

We collect a range of data from you, as specified in our Privacy Policy.

Our secure servers are all located within the EEA, however on some occasions we may share your data with companies based outside of the EEA. All of the suppliers that we use who are located outside of the EEA either comply with the EU-US Privacy Shield scheme or have modified their contracts to be GDPR compliant. For more information on who we share data with, please see our Privacy Policy.

Time etc does not store data about you for longer than is strictly required for practical, commercial and law enforcement reasons. Time etc has introduced a number of data retention policies and associated systems in order to allow our compliance with GDPR. In short these automated systems help to ensure that data is not kept for longer than is strictly required to provide services to you. For more information please see our Privacy Policy,

We have rolled out a package of ongoing training for our team on the safe handling of data and compliance with your rights under the GDPR. In addition we have introduced a number of further security measures such as advanced identity verification when you call us.

You have the right to ask us to delete, modify or provide a copy of your data, and a number of other rights in respect of personal data we process about you. For more details see our Privacy Policy. To exercise your right please email gdpr@timeetc.com and we will respond to confirm next steps. We will respond to your request within 48 hours.

We have released fully GDPR compliant Privacy Policy, Terms and Conditions, Cookies Policy and Data Processing Terms.

Time etc has conducted a full information audit including data mapping and Privacy Impact Assessment. We conduct due diligence on the third parties that we share data with, ensuring they are GDPR compliant, and keep a record of our assessments. We keep up to date records detailing the data that we process as both a controller and processor. We also conduct regular reviews of our data controller and processing arrangements.

We routinely share your personal information as a data controller with a range of third party service providers who help us provide, analyse and promote the Time Etc services and engage with freelancers. Some of those third party recipients may be based outside the European Economic Area.

We will share relevant information about you from your Time etc client account (including your name, email address, profile, biography) and the nature of your brief with a freelancer we think is suitable for your brief.

We will share personal information with law enforcement or other authorities if required by applicable law.