How Truesant meets its obligations under the General Data Protection Regulation.
Last updated: June 2026
The General Data Protection Regulation (GDPR — EU 2016/679) and its national equivalents set the standard for how personal data of individuals in the European Economic Area (and beyond) must be handled. Truesant is built with GDPR compliance as a first-class requirement — not an afterthought.
Our platform stores all data in the European Union. We apply privacy-by-design and privacy-by-default principles across the entire product lifecycle.
Truesant as Controller — for platform account data (e.g. names, email addresses, login credentials of tenant administrators and platform staff), Truesant is the Data Controller and determines the purposes and means of processing.
Truesant as Processor — for workforce data that tenant organisations manage through the platform (e.g. employees' personal details, payroll records), Truesant acts as a Data Processor on behalf of the tenant organisation, which is the Controller. Our Data Processing Agreement (DPA) governs this relationship.
All customers on a paid plan receive a Data Processing Agreement as part of their subscription contract. The DPA covers:
To request a copy or to negotiate custom DPA terms, email privacy@truesant.com.
Whether you are a platform user (account holder) or a service partner whose data is managed by a tenant organisation, you have rights under GDPR:
Right of access (Art. 15)
Request a copy of all personal data we hold about you.
Right to rectification (Art. 16)
Ask us to correct inaccurate or incomplete data.
Right to erasure (Art. 17)
Request deletion of data that is no longer necessary or where consent is withdrawn.
Right to restriction (Art. 18)
Ask us to limit processing while a dispute or correction is being resolved.
Right to portability (Art. 20)
Receive your data in a structured, machine-readable format.
Right to object (Art. 21)
Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent
Where processing is based on consent, you can withdraw it at any time.
Right not to be subject to automated decisions (Art. 22)
Request human review of any solely automated decision that significantly affects you.
To exercise any of these rights, email privacy@truesant.com. We will verify your identity and respond within 30 days (extendable by a further 60 days for complex requests, with notice).
Our primary data storage is located in the EU. If personal data is transferred outside the EU/EEA to sub-processors (for example, identity verification services in other jurisdictions), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or transfer to countries with an adequacy decision.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. For more detail see our Security Policy.
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals' rights and freedoms. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.
Our lead supervisory authority is the Swedish Authority for Privacy Protection (IMY — Integritetsskyddsmyndigheten), Box 8114, SE-104 20 Stockholm, imy.se. You have the right to lodge a complaint with IMY or the supervisory authority in your country of residence.
Data Protection enquiries: privacy@truesant.com. For our full privacy practices see the Privacy Policy.