Introduction and ScopeThis document is provided as a template to assist the privacy officer and legal counsel in generating a privacy notice to users and data subjects about the use and processing of their personal data. It is recommended that a thorough review of all privacy and other legal requirements are considered when drafting the formal privacy notice and publishing it for data subjects to review before the collection of their personal information.
Data Controller and Data ProcessorLansare Corporation’s business customers are the data controllers for most of the information that is entered into custom web applications hosted by Lansare Corporation. Lansare employees may access this data periodically in order to deliver support or services. This positions Lansare Corporation as the data processor for most information stored and processed by Lansare Corporation. There are some pieces of information that are collected directly by Lansare Corporation to facilitate security, logging, and application performance. These items include IP address and behavior within Lansare’s virtual data center environment. For these pieces of information, Lansare Corporation acts as the data controller and processor. Additionally, Lansare Corporation employs a variety of technologies and partners that periodically act as sub-processors (detailed list below). If users have any questions or concerns about the processing and handling of their personal information, they may reach out to Lansare Corporation directly by email at email@example.com.
Mode, Place, and Methods of Processing the DataLansare Corporation takes appropriate security measures to prevent unauthorized access, disclosure, modification, or data destruction. Data is processed using computers or tech-enabled tools, following organizational policies and procedures strictly related to the purposes indicated. In some cases, data may be accessible to Lansare Corporation employees involved with the Lansare Corporation website’s operation, the Lansare Corporation web application (platform), and supporting applications. Data may also be accessible to external parties appointed, if necessary, as data processors or sub-processors by Lansare Corporation. External parties may include third-party technical service providers, hosting providers, and IT companies.
Legal Basis of ProcessingLansare Corporation may process personal data relating to users if one of the following applies:
- Users have given their consent for one or more specific purposes.
- Provision of data is necessary for the performance of an agreement with the user.
- Processing is necessary for compliance with a legal obligation.
- Processing is necessary for the legitimate interests pursued by the controller or by a third party.
PlaceThe data is processed at Lansare Corporation’s operating offices, hosting facilities, and, for some data, third-party sub-processors. The majority of data is stored and processed within Canada. In some cases data may be stored within the US or EU via third-party sub-processors. Depending on the user’s location, data transfers may involve transferring the user’s data to a country other than their own. To find out more about the processing of such transferred data, users can consult the section containing details about the processing of personal data. Users are entitled to learn about cross-border data transfers. If any such transfer occurs, users can find out more by checking the relevant sections of this document or inquiring directly with Lansare Corporation.
Retention TimePersonal data is processed and stored for as long as required to fulfill the purpose for which it is collected. Therefore:
- Personal data collected for the performance of a contract between Lansare Corporation and a business customer is retained until such contract has been entirely performed or the business customer asks for the data to be deleted.
- Personal data collected for Lansare Corporation’s legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding Lansare Corporation’s legitimate interests within the relevant sections of this document or by contacting Lansare Corporation.
The Purposes of ProcessingThe data concerning the user is collected to allow Lansare Corporation to provide its services, as well as for the following purposes: analytics, user database management, managing contacts and sending messages, handling payments, interaction with external social networks and platforms, remarketing and behavioral targeting, contacting the user, displaying content from external platforms, hosting and backend infrastructure, interaction with live chat platforms, and spam protection. Users can find further detailed information about such purposes of processing and the specific personal data used for each purpose in the respective sections of this document.
Detailed Information on the Processing of Personal DataPersonal data is collected for the following purposes and using the following services and third parties:
AnalyticsThe services contained in this section enable Lansare Corporation to monitor and analyze web traffic and can be used to keep track of user behavior.
Contacting the User
Mailing List or Newsletter (The Lansare Corporation Web Application)By registering on the mailing list or for the newsletter, the user’s email address will be added to the contact list of those who may receive email messages containing information of commercial or promotional nature concerning the Lansare Corporation web application. The user’s email address may also be added to this list due to signing up via the Lansare Corporation website or the Lansare Corporation web application, or after making a purchase. Personal data collected: address, city, company name, cookies, country, email address, first name, last name, phone number, job role, province, state, usage data, and ZIP/Postal code.
Phone Contact (The Lansare Corporation Web Application)Users that provide their phone number might be contacted for commercial or promotional purposes related to the Lansare Corporation web application or for fulfilling support requests. Personal Data collected: phone number.
Contact Form (The Lansare Corporation Web Application)By filling in the contact form with their data, users authorize the Lansare Corporation web application to use these details to reply to requests for information, quotes, or any other kind of request as indicated by the form’s header. Personal data collected: address, city, company name, country, email address, first name, last name, phone number, job role, province, state, and ZIP/Postal code.
Displaying Content from External PlatformsThis type of service allows users to view content hosted on external platforms directly from the pages of the Lansare Corporation web application and interact with them. This type of service might still collect web traffic data for the pages where the service is installed, even when users do not use it.
Hosting and Back-End InfrastructureThis type of service has the purpose of hosting data and files that enable the Lansare Corporation website and the Lansare Corporation web application to run and be distributed. Additionally, these services provide the infrastructure to run specific features or parts of the application. Some of these services work through geographically distributed servers, making it difficult to determine the actual location where the personal data is stored.
Managing Contacts and Sending MessagesThis type of service makes it possible to manage a database of email contacts, phone contacts, or any other contact information to communicate with the user. These services may also collect data concerning the date and time when the message was viewed by the user and when the user interacted with it, such as by clicking on links included in the message. These services are only used by Lansare Corporation in conjunction with client implementations
Spam ProtectionThis type of service analyzes the traffic of the Lansare Corporation website and the Lansare Corporation application, potentially containing users’ personal data, with the purpose of filtering it from parts of traffic, messages, and content that are recognized as spam.
Further Information about Personal Data
The Rights of UsersUsers may exercise certain rights regarding their data processed by Lansare Corporation within the context of it’s client implementations. Requests need to be initiated with the customer. In particular, users have the right to do the following:
Withdraw their consent at any time.
Users have the right to withdraw consent after they have previously given their consent to the processing of their personal data.
Object to processing of their data.
Users have the right to object to the processing of their data if the processing is carried out on a legal basis other than consent. Further details are provided in the dedicated section below.
Access their data.
Users have the right to learn if Lansare Corporation is processing their data, obtain disclosure regarding certain aspects of the processing, and obtain a copy of the data undergoing processing.
Verify and seek rectification.
Users have the right to verify their data accuracy and ask for it to be updated or corrected.
Restrict the processing of their data.
Users have the right, under certain circumstances, to restrict the processing of their data. In this case, Lansare Corporation will not process their data for any purpose other than storing it.
Have their personal data deleted or otherwise removed.
Users have the right, under certain circumstances, to obtain the erasure of their data from Lansare Corporation.
Receive their data and have it transferred to another controller.
Users have the right to receive their data in a structured, commonly used, machine-readable format, and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the data is processed by automated means and that the processing is based on the user’s consent, on a contract that the user is part of, or on precontractual obligations.
Lodge a complaint.
Users have the right to bring a claim before their competent data protection authority.