Which data-protection laws apply to Vantage Point?
Vantage Point Limited is a Jersey company, so the Data Protection (Jersey) Law 2018 applies to us, supervised by the Jersey Office of the Information Commissioner. Jersey holds an EU adequacy decision and is recognised as adequate by the UK. Where our customers are in the UK or the EU, or process the data of people there, the UK GDPR and the EU GDPR apply to that processing and we contract to meet them.
Is Vantage Point a controller or a processor?
Both, for different data. For this website, our marketing and our contact with you, we are the controller. For everything a customer and its users put into the service (obligations, risks, controls, monitoring records, registers, actions and the people named on them) the customer is the controller and we are the processor, acting only on the customer’s documented instructions.
Is there a data processing agreement?
Yes. A standard data processing agreement covering Article 28 terms (instructions, confidentiality, security, sub-processors, assistance with rights and breaches, deletion or return at the end, audit) is available on request and forms part of the customer contract. It carries the standard contractual clauses and the UK addendum where a transfer needs them.
Where is customer data stored?
In the customer’s own region, and only there: UK data in the UK, EU data in the EU, US data in the US. Transfers outside that region require a documented basis and the customer’s approval.
Which sub-processors do you use, and how are changes handled?
The list is maintained and provided under NDA, and changes are notified in advance so a customer can object. Each sub-processor is bound by written terms that flow our obligations down, and transfer impact assessments are completed where a sub-processor sits outside Jersey, the UK or the EU.
How does the platform help a customer meet data-subject rights?
Access and portability: every register and report exports to Excel in one click, and the audit trail exports too, so a subject-access request can be answered from the customer’s own data without a support ticket.
Rectification and erasure: records are edited and archived by the customer’s own users, with the change attributed and timestamped. Where a customer needs our help to locate or delete data, we assist within the DPA’s timescales.
How long is data kept?
For the life of the contract, and then exported to the customer on request and deleted on the schedule set in the contract. Backups age out on their retention window. Server logs are kept for a limited security retention period.
What happens if there is a personal-data breach?
We notify the affected customer without undue delay after becoming aware, with what we know about the nature of the breach, the data and people affected, the likely consequences and the measures taken, and we keep them updated so they can meet their own 72-hour obligation to the supervisory authority.
What is the lawful basis for what Vantage Point itself collects?
Contact and demo requests: legitimate interest and steps taken at your request before a contract. Providing the service to a customer’s users: performance of the contract. Security and abuse prevention: legitimate interest and legal obligation. Website analytics: your consent, through cookies you can withdraw at any time. We do not sell personal data.
Who do I contact?
privacy@vantagepointgrc.com for data-protection questions and requests; we respond within one month. You may also complain to the Jersey Office of the Information Commissioner, or to your own supervisory authority in the UK or the EU.
Questions: security@vantagepointgrc.com for security,privacy@vantagepointgrc.com for data protection.