GDPR and data protection

The honest position first

Pertavo is not certified as GDPR compliant, and no page here will tell you it is. There is no such certificate to hold, and no audit of this product has been carried out that would let us imply one.

What follows is more useful than a badge: where responsibility actually sits, and which parts of the product help you discharge yours.

Who is responsible for what

Under the GDPR, the firm that decides what client data to collect and why is the controller. That is you. The software that holds it on your instructions is a processor.

This matters because the obligations that attract fines — lawful basis, telling people what you hold, answering their requests, reporting a breach — sit with the controller. No software can take them off you, and any vendor who implies otherwise is selling you a comfortable misunderstanding.

What the product gives you to work with

• Access is narrowed, not merely hidden. One client cannot reach another’s documents, and one firm cannot reach another’s. See Data encryption and security.
• A record of who touched what. Uploads, views, downloads and edits are recorded per document, which is where you look if you have to reconstruct what happened. See Activity history.
• Access you can withdraw. Sharing can be removed and accounts deactivated, so “this person should no longer have access” is a thing you can actually do.
• Invitations that expire. A link to your firm’s portal does not sit in an inbox indefinitely.

Requests from a data subject

If a client asks what you hold about them, or asks for it to be deleted, that request comes to your firm, not to us. The portal is where you look to answer it: their documents, their messages, their account.

There is no one-press export of everything about a person, so a subject access request means gathering it by hand. Plan for that before you receive one rather than after.

Where the data lives

Ask support about the hosting region and the sub-processors in use before you sign a client whose contract specifies either. These are deployment facts, not product facts, and the accurate answer depends on your installation.