Deletion concept
HRinstruments processes personal data on behalf of its customers. According to Art. 5 para. 1c DSGVO (“data minimization”) and Art. 17 DSGVO (“right to be forgotten”), this data is deleted according to certain rules. The following document specifies how HRinstruments GmbH implements this for the various types of data processed.
Regardless of the following rules, the following applies:
Upon completion of the contractually agreed work or earlier upon request by the customer – at the latest upon termination of the service agreement – HRinstruments GmbH shall hand over to the customer all documents, created processing and usage results as well as data files related to the contractual relationship that have come into its possession or, after prior consent, destroy them in accordance with data protection law, unless there is an obligation to store the personal data according to Union law or the law of the member states (cf. Art. 28 para. 3 lit. DSGVO).
Deletion rules
If the employment relationship between the person concerned (employee) and the customer ends, …
- … the master data of the data subject(s) are deleted immediately
- … the personal data of the data subject(s) in template-based surveys are anonymized or deleted.
- … the personal data of the data subject(s) are anonymized in Instant Feedback.
- … the personal data of the data subject(s) are anonymized in application logs.
Deletion requests
If a data subject wishes to have his/her data deleted, he/she must contact the data controller, i.e. the customer. If HRinstruments GmbH receives a request for deletion directly, it will first forward it to the customer’s authorized parties to initiate the “Notification for correction, restriction or deletion” process:
- An authorized representative of the customer accepts the deletion request and forwards it to HRinstruments GmbH.
- The deletion request is forwarded to the relevant KAM (Key Account Manager).
- The KAM then orders the deletion from the IT department of HRinstruments GmbH.
- The IT department identifies the data concerned, deletes it and reports completion to the KAM.
- The KAM then confirms the execution to the authorized parties.
Each process step is logged and the deletion request is archived.
In accordance with Art. 12 para. 3 DSGVO, the data is deleted immediately or at the latest within one month of receiving the request.
Deletion classes
Depending on the type of data, various deletion types and times are provided for personal data. These are divided into the following classes:
- Immediate
- Log files
- Protocols relevant to data protection
- Backups
The information provided here on the deletion concept is intended only as basic information and does not provide a basis for legal claims.
Actual implementation may vary from case to case. For more information, contact HRinstruments Support.
Pseudonymization and anonymization
To ensure the privacy of survey participants, HRinstruments “pseudonymizes” or “anonymizes” the answers of all survey participants. By this, depending on the configuration, it is not traceable for the customer and also HRinstruments, which answers were given by which user.
In order to guarantee anonymity also on report level, HRinstruments works with evaluation sublimits.
Pseudonymization
According to EU GDPR Art. 4, “pseudonymization” means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the addition of further information.
In other words, “pseudonymization” is the replacement of identification features such as the name or an e-mail address with a unique identifier, the pseudonym. The objective of “pseudonymization” is to reduce the risk of identification for the data subject.
| Data handling | Pseudonymization (HRinstruments recommendation) |
|---|---|
| Explanation | User assignment remains, but is not visible for the customer Confidentiality of data is contractually guaranteed between HRinstruments and the customer |
| Impact on administrators | Administrators can see who has been invited Administrators cannot see who has already participated Only the response rate in percent per organizational unit is visible Administrators can resend individual participants their invitation link if needed |
| Effects on possibilities for action (HRinstruments) | Individual participants can be subsequently assigned to a different organizational unit Reminder e-mails can contain the recipient’s personal participation link Invitation emails can be resent if, for example, a participant has lost their invitation or not received it due to technical problems Participation via the dashboard in the system is possible |
Anonymization
According to Section 3 (6) of the German Federal Data Protection Act (BDSG), anonymization is “the alteration of personal data in such a way that the individual details of personal or factual circumstances can no longer be attributed to a specific or identifiable natural person, or can only be attributed to such a person with a disproportionate expenditure of time, cost and manpower”.
| Data handling | Anonymization at the start of the survey | Anonymization after report generation |
|---|---|---|
| Explanation | User assignment of participation is deleted as soon as the invitation email has been sent out | Benutzer-Zuordnung der Teilnahme wird gelöscht, sobald die Berichte erzeugt wurden |
| Impact on administrators | Administrators cannot see – who has been invited – who has already participated Only the response rate in percent per organizational unit is visible | Administrators cannot see – who has been invited – who has already participated Only the response rate in percent per organizational unit is visible |
| Effects on possibilities for action (HRinstruments) | HRinstruments can no longer assign the survey data to individual users once the procedure has been started. This results in the following implications: Individual participants cannot be assigned to any other organizational unit after the fact Reminder e-mails can only be sent to all participants and can no longer contain the recipient’s personal participation link Invitation e-mails cannot be resent if, for example, a participant has lost his invitation or has not received it due to technical problems Participation via the dashboard in the system is not possible | Also, HRinstruments cannot assign survey data to individual users after reports have been generated. This results in the following implications: Individual participants cannot be assigned to any other organizational unit after reports are generated Reminder emails can include the recipient’s personal participation link Invitation emails can be resent if, for example, a participant lost their invitation or did not receive it due to technical issues Participation via the dashboard in the system is possible |
The information provided here on anonymization and pseudonymization is intended only as basic information and does not provide a basis for legal claims.
Actual implementation may vary from case to case. For more information, contact HRinstruments Support.