Question 1

Is Malcolm! GDPR compliant?

Accepted Answer

What is GDPR?

"GDPR" refers to The General Data Protection Regulation 2016/679. This is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the export of personal data outside the EU and EEA areas.

How does it apply to Malcolm?

Malcolm! collects, stores and processes data about our own customers - people signing up to Malcolm! and creating and managing instances.

When talking about GDPR it is important to understand the concept of the Data Controller and the Data Processor.

The Data Controller determines the purposes for which and the means by which personal data is processed
The Data Processor processes personal data only on behalf of the controller.

Is Malcolm! the Data Controller or the Data Processor?

In the context of information about our own customers, eg people who sign up for Malcolm! accounts and manage Instances we are the Data Controller.

In the context of information about your customers, eg information that is collected on your behalf via Workflows you create in Malcolm! we are the Data Processor only. You - as the Data Controller - have the obligation to ensure you are acting lawfully in accordance with the GDPR legislation.

What does all this mean?

When you sign up to Malcolm! you agree to our Terms of Service and our Privacy Policy which detail how we handle your data. By agreeing you give us your consent.

It is important that when you collect, store, process and potentially transfer (via Integrations or Exports) data from your own customers via a Malcolm! Workflow you have your customers consent to do this. Most companies handle this via provisions in their Privacy Policy and/or Terms and Conditions around data processing which their customers agree to. It is therefore good practice to include a check box in your Workflows that reminds customers of your Privacy Policy and their continuing agreement of it and/or confirms their consent for you to collect and process their information

Further Questions

If you have further questions about GDPR or wish to contact our Data Protection Officer you can contact us here.

You can find out more about GDPR here.

Question 2

Can I restrict some or all of my Team members from seeing and/or exporting submitted Workflow data?

Accepted Answer

Sometimes you may wish to use Workflows but restrict other Team members on your instance from having access to the data that is submitted by your end users.

Here is how to do this

Access is managed via the "Team" section of MyMalcolm.
In that section if you click on a Team Member then select "privileges" you can configure whether a user can see and/or export submitted Workflow data. You can even remove all their access to the Workflow section.
Depending on their settings the Instance Owner and some Team Members may also receive submitted data via email alerts. See more about managing email alerts here.
Regardless of their own preferences Team Members won't receive email alerts relating to Workflow completion if they don't have access to Workflow submitted values and exports.

Some related things to be aware of

Remember that on a Workflow level further email recipients can be added in the "email answers" part of the configure section of the individual Workflow - it may make sense to review this recipient list at the same time you review who on your team has access to end user submitted data.
Be aware that if you are pushing some or all of the submitted data to third party systems via Integrations or Web Hooks then submitted data will potentially be viewable by users in those systems.

We recommend that you review this article to read about GDPR and how it applies to Malcolm! and your users.

Question 3

How is the removal of Company Personal Data handled?

Accepted Answer

What is personal data?

Personal data only includes information relating to natural persons who:

can be identified or who are identifiable, directly from the information in question; or
who can be indirectly identified from that information in combination with other information.

What is Company Personal Data?

When you use Malcolm! to collect information from your customers, suppliers, staff or others that information may include personal data. In this context, Malcolm! acts as your data processor and the personal data we may process on your behalf is referred to as Company Personal Data. You can read more about this here.

Removal of Company Personal Data

There are two tiers of data removal. The first is a recoverable delete, known also as a soft delete. The second is a permanent delete or purge. Malcolm! supports both types of data deletion.

Soft deletion

Soft deletion means data is deleted enough to make it no longer visible or discoverable but not quite enough should it need to be recovered.

For example if you delete a Malcolm! Workflow in MyMalcolm then the Workflow and everything related to that Workflow is soft deleted. This means it'll all disappear from MyMalcolm and our APIs but should you realise the deletion was a mistake it could still be fully recovered (on request).

Purging

Purging is a permanent or secure delete. This could be either a physical delete (e.g. uploaded files on disk) or a nullification of stored values in a database. Once data has been purged it is no longer recoverable.

Rest assured, Malcolm! will never purge your data whilst your Instance is active!

What happens after my trial finishes?

After your 14 day trial period comes to an end your Instance will be disabled. From that point you'll have 30 days to subscribe to one of the plans. If no subscription is in place by then your Instance data will be soft deleted and after 120 days all Company Personal Data will be purged in accordance with our Data Processing Addendum.

What happens if my subscription lapses?

Subscriptions could lapse for a number of reasons but the most likely cause is an expired credit card. We'll keep you Instance active for 14 days to give you time to fix the problem.

If the problem is not fixed your Instance will be disabled but you'll still have a further 30 days to subscribe to a new plan should you wish to. If no subscription is in place by then your Instance data will be soft deleted and after 120 days all Company Personal Data will be purged in accordance with our Data Processing Addendum.

What happens after I delete my Instance?

You can request to have your Instance deleted and purged in Settings > Instance > Delete Instance. After 30 minutes of requesting the deletion your Instance data will be soft deleted and after 120 days all Company Personal Data will be purged in accordance with our Data Processing Addendum.

Can I request just a Workflow data delete and purge?

Yes you can! Within MyMalcolm you can create a Workflow data deletion request. The Workflow data will be first be soft deleted and then 30 days later it will be purged.

See How do I delete data submitted to a Workflow? for more information.

For more information...

For more information please read the Data Processing Addendum.

Is Malcolm! GDPR compliant?

Can I restrict some or all of my Team members from seeing and/or exporting submitted Workflow data?

How is the removal of Company Personal Data handled?

Upgrade your content

Hey there!