GDPR

The EU’s General Data Protection Regulations (GDPR), effective May 25, 2018, promotes protection of data privacy laws across Europe. Haystack is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. Our preparation and objectives for GDPR compliance have been summarized in this statement.

Privacy Policy

We routinely make updates to our privacy policy to ensure it accurately reflects changes in how your data is processed and to outline your rights and access to your personal data. For more information about our Privacy Policy and the practices it governs, please visit our website. If you have any questions regarding Haystack’s Privacy Policy, you can reach out to us at privacy@haystackteam.com.

Information Auditing Mapping

We conducted a comprehensive information audit aimed at identifying and evaluating all personal data collected. As a result of this audit, we have meticulously reviewed and removed any data collection practices deemed non-essential to the provision and marketing of our services. This ensures that only necessary data is retained, enhancing both the efficiency and integrity of our service delivery and marketing strategies.

Data Erasure

An enterprise user has the right to request that we delete all of their personal data, with cooperation of their account administrator. We have dedicated removal policies in place to meet this obligation. Users can reach out to us at any time at hello@haystackteam.com.

Data Subject Rights

An enterprise user has the right to request removal of personal data (where applicable) or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us to be informed about any automated decision-making that we use. Users can request access to a copy of personal data that we have collected by contacting us at hello@haystackteam.com.

Subject Access Request

We have revised our Subject Access Requests (“SAR”) procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate.

Data Protection Agreement (DPA)

We have created a Data Protection Agreement (“DPA”) that can be executed by our customers. If you have questions regarding Haystack’s GDPR readiness, please contact security@haystackteam.com.