GDPR and Data Processing Summary
Our roles and responsibilities under UK data protection law
Crayon Digital is committed to upholding the principles of the General Data Protection Regulation (GDPR) and ensuring the lawful and transparent processing of personal data.
Roles under GDPR
Under the GDPR, there is a distinction between a "data controller" and a "data processor".
- You, the Client (Data Controller): When you use our platform, you are the data controller. You control which data is uploaded to the system, determine the legal basis for processing that data, and decide how it is used. You are responsible for ensuring that you have the necessary consents and notices in place to lawfully collect and process personal data.
- Crayon Digital (Data Processor): We act as the data processor. We process the data you provide on your behalf and according to your instructions. We will never use the personal data you upload for our own purposes.
Data Processing Agreement (DPA)
We provide a comprehensive Data Processing Agreement (DPA) that outlines our respective roles, responsibilities, and obligations under GDPR. This legal agreement details the technical and organisational measures we take to protect personal data and ensures that we process data in a compliant manner.
Data subject rights
The platform is equipped to handle data subject access requests, including the right to access, rectify, or erase personal data. As a data controller, you are responsible for responding to these requests, and our platform provides the tools to help you fulfil your obligations.