GDPR compliant

Hello Erik,

We're working towards it and you can find more information about this in our data security policy framework : Security

Cheers!

I'm also interested in knowing more about what is planned.

We will also need details specific on archiving options if we need to remove a customer. 

We also need details on how we can extract customer data and how it's been used if a customer ask. And of course how will
Freshdesk act on the GDPR rule 'Right to be forgotten'

 We really need to know the answer to this too, is there any update?

Is there any update on this as we need to understand our options on this as we're about to expand our support team and need to know if Freshdesk is still an option for us going forwards.

We also need an answer on this, and soon. Otherwise we will move away from Freshdesk. 

Hi,

We've a dedicated resources section for GDPR . Please visit https://www.freshworks.com/privacy/gdpr/ to know more.

Cheers!

Personally, I would say there is about the same or less content on Zendesks site specifically about GDPR, It seems they have just added a section in their Legal page that simply says they will be ready when GDPR comes into force.

Also, did you notice the links at the top of the Freshworks page titled

Overview
What you need to know
How to begin your journey
GDPR at Freshworks
FAQ's

Hello everyone,

Preparing for GDPR compliance is a company wide initiative and Freshdesk will be compliant before the GDPR ​deadline of​ May 25, 2018. GDPR readiness at Freshworks focuses on changes related to product, processes, documentation and vendors. We have a dedicated cross-functional team ​that has undergone training on GDPR, reviewed company-wide readiness and recommended changes. These changes involve changes to the product, as well as process and documentation changes.

Bengt, to answer your question - if a customer exercises their Right to be Forgotten, Freshdesk will provide the​ ability​ to permanently delete the customer and her data.

Alison - all functionalities we build to help you be GDPR compliant will be available on all our plans. EU freshdesk accounts are not hosted on EU servers by default; GDPR does not mandate data to be hosted within EU. In accordance with the letter and spirit of the law, Freshworks takes extensive measures to ensure privacy and security of data.

For all other questions, please see https://www.freshworks.com/privacy/gdpr/. We will update the page as we have more information to share.

Thank you,

Aparna

Hi -

I've been drawn to this item because I've been looking into GDPR compliance.

One area you haven't answered is whether you will have 2fa implemented by the deadline.  As you say on the page that you reference, security is one of the central requirements of GDPR, and I'd argue that without 2fa its hard to claim that you are keeping "pace with technology, and enhance protection against unwarranted use of personal data".  If an organisation is breached and plain passwords are being used, it will be hard to argue that sufficient measures have been taken to ensure the security of user data. So, are there any plans to implement this as part of your general GDPR changes?

Thanks,

Daniel

"...if a customer exercises their Right to be Forgotten, Freshdesk will provide the​ ability​ to permanently delete the customer and her data."

Can you be specific about how this will work? Our account rep has not responded to direct questions about this and our compliance team want some assurances that either one of our own admins can remove data directly from Freshdesk, or that there is a dedicated pipeline for them to request that action with Freshdesk directly.

Hi Josh,

I can provide more detail on what we're building to help you permanently delete user data. This is how the functionality would work:

1. Today, the admin navigates to the specific customer's profile and 'deletes' the contact - this first step is a soft delete. (This is available today)

2. The admin would then navigate to the deleted contact's profile and uses the 'Delete forever' option (This is being built and will be available by the end of this month). This action permanently deletes the customer's data - tickets, forums, calls & profile.

3. Additionally, permanent deletion would be available via API

Hi there, 

I've been reading through various forums and checked out your links to GDPR - suppose I have a question that I cannot find answerable anywhere, hopefully someone or you can help?!

We are a B2B company that provides online resource management tool for project management / agency / scheduling etc.   We use Freshdesk for our support desk requirements.   With GDPR - our question lies around the content that would have been created within those tickets raised with agents.  So for example, in one years time a customer wishes to delete their account/ask to be forgotten.  We will need to delete their data PII and have no problem doing that - however.  There would be some content in the conversations that we would need to hold onto as a resource for future reference.  How would we go about this?  

I do note on you FAQ that "If the deleted contact has been an agent with the account, we permanently delete their PII(Personally Identifiable Information) such that the individual is not identified or identifiable thereafter. For business continuity, their contributions to the business viz. ticket responses,notes,knowledge base articles, forum topics/comments, support calls, surveys, automation rules, ticket templates, contacts, companies, tags, etc. will be retained (This is being built and will be available soon.)t"  - would the same apply for our customers content?  

Would be great to hear your thoughts and answers to the above?  

Thanks 

Helen 

Hey, all -- it's now May 25th in the EU, and there's still nothing on the site confirming GDPR compliance. What's up??

We're looking to subscribe to your product, but need to be able to execute a DPA with Freshdesk for our own GDPR compliance.  Assuming Freshdesk is now GDPR compliant, how do we manage this prior to placing a subscription order??

For the GDPR there needs to be a (signed) Data Processing Agreement between controller and the processor.

Do you have one that I can use/sign or should I sent ours?