In connection with the introduction of the new Personal Protection Act, various adjustments have been made to Onlet. The new data protection act is based on the GDPR, which is a regulation from the EU that gives EU and EEA citizens the same rights. For companies, this particularly applies to clarifying what responsibility you have in relation to the handling of personal data. You can find more information on the websites of Datatilsynet.
Intershare naturally wants to be in line with these regulations. In this connection, we have published our Personvernerklæring on our websites, as well as drawn up a Data Processor Agreement that regulates how personal data in our customer/supplier relationship must be handled. Let us know if you have not received the Data Processing Agreement from us.
Each individual rental company must have a relationship with how long personal data will remain in Onlet. This means that you cannot leave terminated personal relationships/information in the system just because it is "nice to have". In the routine description for GDPR (privacy declaration) for the individual rental company, there should be something about how long you take care of personal data and justify the duration.
It is up to each rental company to judge how long to keep personal data, and it is Intershare's task to make adjustments in Onlet that make it possible to delete/anonymize personal data.
For Onlet, this is about:
- Option to delete/anonymize customers
- Option to delete/anonymize contact persons
Circumstances in Onlet that enable personal data to be stored longer than your standard described retention period ref. your privacy statement:
- Personal data in accounting documents (invoice/credit note) must be kept for a minimum of 5 years.
- Persons who have consented to their personal data being stored longer than the standard retention period.
When you have to "clean up" personal data that there is no reason to keep, this can be done in 2 ways:
- Delete/anonymize customers and contact persons directly from the contact/contact person picture
- Bulk delete/anonymize customers, contact persons, Onlet users and invoices from the new Privacy screen located under Contacts/Privacy.
** There is a separate access rule in Onlet that must be activated for a user to gain access to the anonymisation system.
Deletion versus anonymization:
- Private customers and contact persons who have never been linked to a contractual relationship will have their entire customer card deleted!
- Private customers and contact persons who have been linked to an offer/order will be anonymised! Anonymisation means that the customer card is preserved, but all data that can identify the customer/contact person is given the value "Anonymised". This is only done for the field intended for personal data. If you enter personal data in another field, for example a comment field, this will not be anonymised.
DELETION/ANONYMISATION
You will be able to handle the deletion/anonymization of a customer/contact person directly from the contact picture, or perform bulk deletion/anonymization from a new Privacy picture. The last method is a separate routine designed to be able to delete/anonymize customers and contact persons who have not had an active contractual relationship with you for X number of months. X is set by the individual landlord.
When anonymizing, all data in fields intended for personal data is deleted, and certain required fields only receive the value "Anonymized..."
General information about deletion/anonymization:
- Deletion or anonymisation of a customer/contact person is not reversible!
- Anonymisation of a private customer/contact person will result in complete deletion if the customer or contact person has never been connected to a contractual relationship. If the customer/contact person has been linked to a contractual relationship, the customer/contact person will only be anonymised.
- When a customer is anonymised, all associated contact persons will also be anonymised.
- When a customer is anonymised, the corresponding invoice will not be anonymised.
- Anonymisation of invoices complies with the Accounting Act and is handled separately from the new Privacy screen.
- If consent has been ticked (new check box for private customers and contact persons) to the storage of personal data on the customer or on the contact person, these will not appear in the bulk anonymisation routine in Onlet. When anonymizing directly from the customer image, this consent box will not be taken into account.
- It is not possible to anonymize customers/contact persons who are connected to active orders/offers.
- The order must be fully invoiced, closed and the invoice must be transferred to accounting (for those who export to accounting). In addition, the last rental date (not payable date) must also have passed.
- Offer: The status of the offer is not taken into account. It is the offer's validity date that governs the activity check.
- The anonymisation check takes into account the role the contact person has on an order. What we mean is that if a contact person is the invoice contact for an order, then you will not be able to anonymize this until the invoice has been transferred to accounts. Order contact persons can be anonymised when the order is marked as "Completed".
- It is possible to credit an invoice where the customer is anonymised, because the credit note must contain the same customer/personal information as the associated invoice. However, when crediting, you must not be allowed to note that the order must be invoiced again.
- You cannot anonymize a customer who has an order with a credited invoice that has been cut off so that it can be invoiced again. If, when crediting, you choose not to be invoiced again, you will be able to anonymise. Then you will not be activated for new invoicing.
- All files stored in Onlet's document archive must be reviewed manually to see if any of them contain personal data.
- Anonymization of Onlet users is done from the Bulk anonymization screen.
- Since anonymization can only be done when all associated invoices have been exported to accounts, anonymized data will not be transferred, via our export routines, to the accounts.
Contact window:
- It is possible to anonymize both private and business customers. This is so that you can more effectively anonymize the associated contact persons of a company that has many of them. You then avoid taking one contact person after another.
- Separate anonymisation button for customer and contact person
- Customers with offers that have passed the offer deadline can be anonymised immediately.
- Anonymized customers do not appear in the customer search, except in the Contact picture when you have ticked the box to also search among inactive customers. Anonymised customers will appear when searching for orders/invoices.
- Since it is not possible to check suppliers, with contact persons, against activity (offers/orders), these must be anonymized manually.
New window: Privacy (under Contact menu)
Settings button: All customers who have not been active for the number of months set here will be deleted/anonymized. The values are determined by the landlord.
Bulk anonymization will take a long time! Let the program run until the process is complete! Only 1,000 lines are displayed in the search result, so if you anonymize the 1,000 that are listed, you must run the search again to bring up the next 1,000 customers.
Private customers and contact persons:
- It is only possible to anonymize private customers (not business customers) from this image
- Contact persons from both private customers and business customers are listed
- In the case of bulk anonymisation of customers/contact persons, the selection is based on the number of months since the last activity. Activity is based on:
- For orders with rental lines: Last rental date (not payable date) and invoice date (if applicable, export to accounting must have been run)
- For orders with services and sales: Delivery date and invoice date (if applicable, export to accounting must have been run)
- For offers (regardless of status): The offer's validity date
Users:
- Here, users appear who have been set inactive and who have not been checked for Employee or User
Invoices:
- According to the Bookkeeping Act, all accounting documents (invoices/credit notes) must be kept for 5 years. Under the Settings button, you can enter a threshold value that means that all invoices older than x number of financial years must be anonymised. The system then calculates x number of years back from 1 January, the current year.
- Anonymization of an invoice is not reversible!
- No account is taken of the last activity or deviation for consent, when anonymizing the invoice. The routine deals with all invoices that are old enough, regardless of customer, activity and/or other circumstances.
- No distinction is made between business customers and private customers when invoices are anonymised.
- Only personal/customer data on the invoice is anonymised. The invoice lines do not change.
- Anonymizing an invoice does not mean that the associated customer is anonymized. Anonymizing the customer and the invoice are 2 different routines that do not affect each other.
Bulk anonymization will take a long time! Let the program run until the process is complete!
STORAGE OF CUSTOMER DATA BASED ON CONSENT
It is possible to tick on private customers and per contact person that the person consents to the storage of personal data. This means that the person consents to his/her personal data being stored for longer than your standard described retention period ref. your privacy policy. How long you can then take care of the customer information is up to each individual rental company to define and justify.
As of today, there is no functionality in Onlet for obtaining consent from registered customers. The individual Onlet customer must establish a routine for this.
Disclosure of data
As of today, no separate functions have been created for retrieving all customer history from Onlet. However, Intershare assists with collection if this becomes relevant. There is a 30-day notification period for such a collection.