Data controller and processor
The organisation using Passhield is the data controller for its employees' personal data. [Company name] ([Company address]) is the data processor for that data, and the data controller for its own customer and billing records.
Personal data processed
Identity and contact (name, e-mail), customer transaction (role, status, session and access records), transaction security (IP address, device and browser details, sign-in attempts). Because vault contents are encrypted on the client, we do not know or process their contents.
Purposes
- Providing the service and performing the contract.
- Information security; preventing and detecting unauthorised access.
- Running the organisation's access and offboarding processes (access records, exposure, audit log).
- Meeting legal obligations.
About employee monitoring
The product records which account an employee reached, when and for what purpose. The organisation must inform its employees of this; the product says so plainly on the invitation screen and offers the organisation a sample notice.
Transfers
Data is processed in Türkiye. As the service requires, only the minimum data needed (recipient address, notification type) is passed to e-mail delivery and mobile push providers; the transfer is limited to what the service requires.
Collection and legal basis
Data is collected electronically through the web app, the browser extension and the mobile app. Legal bases: forming and performing the contract, legal obligation, and the controller's legitimate interest (information security).
Your rights
To exercise your rights under Article 11 of the Law, contact your organisation's administrator or [email protected].