GDPR
How WinguSuite supports customers acting as controllers, and what we do as a processor of the personal data that flows through the platform.
Roles
When you use WinguSuite, your company is the controller of the personal data contained in your mail, contacts and communication records. Rightcom Telecoms Ltd acts as a processor, handling that data only on your documented instructions and for the purpose of providing the service.
What the platform processes
- Account data: user names, work email addresses, user rights and profile settings.
- Content data: mail items, attachments, contacts, chat messages, tags and folders created by your users.
- Usage data: the activity records behind WinguReports, such as read, reply, forward and print actions per mail item.
- Technical data: log records needed to operate, secure and support the platform.
How the platform helps you comply
- Access control. Multi-level user rights and profile management mean access to a mail item is granted, not assumed. Departmental mail is shared deliberately, per user.
- Auditability. User action indications per mail item give you a record of who read, replied to, forwarded or printed what.
- Data subject requests. Search across the full live history, by any attribute, makes locating an individual’s data a matter of seconds rather than an archive restoration project.
- Security. 2048-bit SSL encryption in transit, and fail-over redundancy on the infrastructure.
- Fleet coverage. WinguVessel extends the same controls to vessels, which is where fleet-wide compliance usually breaks down.
Sub-processors and transfers
We use a limited set of sub-processors for hosting and operating the platform. A current list is available on request, and we notify customers of intended changes so they can object. Where personal data is transferred outside the EEA, we rely on an appropriate transfer mechanism as required by Chapter V of the GDPR.
Data processing agreement
A Data Processing Agreement under Article 28 GDPR is available for every customer. It sets out the subject matter and duration of processing, the categories of data and data subjects, our security measures, the terms for engaging sub-processors, our assistance with data subject rights, and what happens to your data at the end of the contract.
Retention and deletion
Content data is retained for as long as your contract runs, or as long as you instruct. On termination, data is returned or deleted according to the terms of your agreement. Because WinguSuite keeps history live rather than archived, deletion is applied to the live store directly.
Breach notification
If we become aware of a personal data breach affecting your data, we notify you without undue delay and provide the information you need to meet your own 72-hour obligation to the supervisory authority.
Exercising your rights
If you are an individual whose data we process on a customer’s behalf, contact that customer — they are the controller. For anything relating to Rightcom Telecoms Ltd as a controller (for example, an enquiry you sent us through this website), write to [email protected]. You also have the right to lodge a complaint with your supervisory authority.
Contact
Rightcom Telecoms Ltd, Evagorou 31–33, Nicosia 1066, Cyprus · [email protected] · +30 21 0220 8942