Privacy Center
Welcome to Lobyco’s Privacy Center – your resource for understanding how we protect and manage personal data. The Privacy Center provides transparency into our data protection practices, policies, and the measures we have implemented to safeguard personal data throughout its lifecycle. We process personal data on behalf of our clients in accordance with the Data Processing Agreement and thus in compliance with applicable data protection regulations, including the EU General Data Protection Regulation (GDPR).
Privacy Principles
We recognise that trust is earned through transparency and accountability. As a data processor, we take our responsibilities seriously and have built our operations around the following core privacy principles:
Security by design: We integrate robust security measures into every aspect of our data processing activities, from initial system design through to ongoing operations.
Compliance: We maintain continuous compliance with applicable data protection regulation and regularly review our practices to ensure alignment with evolving regulatory standards.
Transparency: We provide clear information about our data processing practices, sub-processors, and security measures to enable informed decisions by our clients.
Accountability: We document our processing activities and conduct regular audits to demonstrate our commitment to data protection.
Instructions & DPA
We comply with procedures and controls which ensure that instructions regarding the processing of personal data are followed in accordance with the concluded Data Processing Agreement:
Written procedures ensure processing only occurs when instructions are in place.
Annual review of procedures is conducted as a minimum.
Processing is limited to what is set out in the agreed Data Processing Agreement.
Notifications to the data controller if instructions breach GDPR requirements.
Read the full and most up-to-date version of the DPA here: Updated DPA.
Technical Security Measures
We comply with procedures and controls which ensure that we have implemented technical measures to ensure relevant processing security:
Risk-based technical security measures implemented.
System monitoring and alerts in place.
Encryption for transmission of confidential and sensitive data.
Regular vulnerability scans and penetration tests.
Organisational Security Measures
We comply with procedures and controls which ensure that we have implemented organisational measures to ensure relevant processing security:
Management-approved information security policy in place.
Employee vetting conducted upon recruitment.
Confidentiality agreements and security training upon employment.
Ongoing awareness training on IT security and data processing.
Deletion and Return of Data
We comply with procedures and controls which ensure that personal data can be deleted or returned should an agreement to that effect be concluded with the client:
Written procedures for storage and deletion in accordance with agreements.
Compliance with agreed retention periods and deletion routines.
Data returned or deleted upon termination of processing.
Storage
We comply with procedures and controls which ensure that we only store personal data in accordance with the agreement with the data controller:
Written procedures ensure storage complies with data controller agreements.
Processing and storage limited to approved locations, countries, or geographical areas.
Sub-processors
We comply with procedures and controls which ensure that only approved sub-processors are used, and that we ensure adequate processing security through follow-up on their technical and organisational measures to protect the rights of data subjects.
Written procedures for use of sub-processors.
Only approved sub-processors are used.
Timely notification of changes to generally approved sub-processors.
Regular follow-up through meetings, inspections, or audit reviews.
Read the full list of sub-processors here: List of sub-processors.
Transfer to Third Countries
We comply with procedures and controls which ensure that we only transfer personal data to third countries or international organisations in accordance with the agreement with the data controller, based on a valid transfer mechanism:
Written procedures requiring valid transfer mechanisms.
Transfers only occur following data controller instructions.
Valid transfer mechanisms assessed and documented.
Assistance with Data Subject Rights
We comply with procedures and controls which ensure that we can assist the data controller with disclosure, rectification, deletion, or restriction of information about the processing of personal data to the data subject:
Written procedures for assisting the data controller with data subject rights.
Established procedures enable timely assistance with disclosure, rectification, deletion, restriction, and information provision.
Valid transfer mechanisms assessed and documented.
Handling of Security Breaches
We comply with procedures and controls which ensure that any security breaches can be handled in accordance with the concluded Data Processing Agreement:
Written procedures for notifying data controllers of personal data breaches.
Controls established for identifying breaches (employee awareness, network monitoring, access logging).
Notification to the data controller without undue delay.
Procedures in place for assisting with notifications to the Data Protection Authority.
:format(webp))