GDPR & Data Protection
How responsibilities, privacy rights, documented instructions and transfer safeguards are addressed when the GDPR applies.
On this page
1. Applicability and accountability
The General Data Protection Regulation applies according to the processing activities, establishments and individuals concerned. A software subscription does not, by itself, make an organization compliant. MigiHub supports a customer’s data-protection program through contractual, technical and organizational measures appropriate to the agreed service.
InnuCloud generally acts as processor for customer-controlled workspace data and as controller for its own website, commercial relationships and administration. Each party remains accountable for its own obligations.
2. Processing terms and lawful instructions
The DPA documents the processing subject, duration, purposes, data categories, confidentiality, safeguards, subprocessors, assistance, audits and return/deletion arrangements. It must be incorporated into the customer agreement where required.
The customer establishes its lawful basis, transparency notices, authorized collection and user permissions. We process customer personal data on documented instructions and flag instructions that, in our opinion, infringe applicable data-protection law.
3. Protection by design
Relevant measures include data minimization, role-based access, SSO options, encryption, logging, backup and recovery procedures, secure development and vulnerability management. Availability and scope must be confirmed for the customer’s configuration.
Customers should restrict sensitive notes and attachments, review permissions, set appropriate retention instructions and assess optional location or integration features before activation.
4. Rights and assessments
We assist customers with applicable access, correction, erasure, restriction, portability and objection requests, taking account of the service and information available. Requests received directly are routed to the responsible controller where appropriate.
Where required, we assist with data-protection impact assessments and supervisory consultations. The customer remains responsible for deciding whether its processing requires an assessment and for implementing its own operational controls.
5. Transfers and service providers
A transfer to Canada is assessed against the scope of the applicable adequacy decision, including whether the recipient falls within the relevant Canadian commercial-organization coverage. Transfers outside that scope require another valid mechanism; SCCs and supplementary measures may be appropriate. UK and Swiss rules require their own assessment.
Subprocessor engagements and changes follow the DPA. A vendor’s certification does not certify MigiHub. See International Transfers & DPF for the distinction.
6. Incidents, retention and governance
As processor, we notify the customer without undue delay after becoming aware of a personal-data breach and provide available information under the DPA. The controller determines whether the GDPR’s supervisory notification and individual-notification requirements apply to the event; a processor’s notice is not the same as the controller’s regulatory filing.
We maintain relevant records and assistance processes. Customer data is retained, returned or deleted under the agreement and documented instructions. For processing outside the EEA or UK, representation obligations are assessed where applicable; no representative is designated by this page alone. Contact info@innucloud.com for the applicable contractual contacts and documentation.