Data and compliance
Meet the requirements of the revised FADP and the GDPR: data location, processing agreement, individuals’ rights and export.
ObjectiveBy the end of this lesson, you will be able to put together your organisation’s revised FADP and GDPR compliance file and organise how requests from individuals are answered.
Learnya is designed by WorkStreams Sàrl, in Geneva, so that compliance is not a separate project. Data and models stay in Switzerland. Users’ content is never used to train models. Your role as administrator is to document these guarantees and link them to your own obligations.
The legal framework
In Switzerland, the revised Federal Act on Data Protection, known as the revised FADP, applies. For people located in the European Union, the GDPR applies as well. Your organisation remains the controller and WorkStreams Sàrl acts on its behalf. The data processing agreement formalises this relationship.
Your compliance file
- The data processing agreement signed with WorkStreams Sàrl.
- The location of data and computing in Switzerland, including audio processing in Geneva.
- The commitment not to use content to train models.
- The retention period for deleted items: 24 hours in the Drive bin.
- The internal procedure for answering requests from individuals.
Individuals’ rights
Each user can export their own data from the app, under “Account” then “My data”. This covers most access and portability requests without the administrator having to step in. For a request for rectification or erasure, the administrator coordinates with the person concerned. When the contract ends, the organisation has 30 days to export its data before it is erased.
- Request the data processing agreement from WorkStreams Sàrl and have it signed.
- Enter Learnya in your record of processing activities.
- Test the self-service export from your own account.
- Write the internal procedure for answering requests from individuals.
- Inform users in your acceptable use policy.