CCQ Cloud Compliance and Quality/Justly Pay

Annex 1 – Data processing description

Nature and purposeThe Processor (Origo) hosts the system. In addition, the Processor may have access to personal data processed in the system in relation to technical assistance. 
Categories of data subjects and types of personal dataAll personal data which the Controller stores in the system will be processed. The types of personal data and categories of data subjects are first and foremost as follows, depending on which units and functionalities of the CCQ system/Justly Pay are used:
In relation to all units of the CCQ system/Justly Pay:
·        Name and username of the system‘s users
·        E-mail addresses of the system‘s users
·        Permissions and access controls of the system‘s users
·        Next supervisor and employer of the system‘s users
·        Selected settings by the system‘s users
In relation to the “Competency Management” unit in the CCQ system:
·        Employees/contractors’ CVs
·        Employees/contractors’ educational data
·        Employees/contractors’ training data
·        Employees/contractors’ data on drivers licenses etc.
In relation to the “Audit” unit in the CCQ system:  
·        Registrations of non-conformity with control/precision
In relation to the “Asset Management” unit in the CCQ system:
·        Data related to the Controller’s agreements
·        Data on assets, including IT-assets, as applicable registered to specific individuals
In relation to the “Incident and Complaints” unit in the CCQ system:
·        Contact information from an individual which submits a complaint/message, as applicable
Sub-Processors    Content of a complaint/message, such as accident and/or incident registration. It shall be noted that a complaint/message can include sensitive personal data depending on for what purposes the Controller uses the Incident and Complaints unit
In relation to Justly Pay:
·        Content of an equal pay tip
·        Audit’s content and/or non-conformity registrations
In addition to the information above the system also collects logs on users’ use of the system.
Transfer of data outside the EEA The UK (hosting by IBM Danmark ApS).
·        Please note that the UK is considered a adequate’ third country, no additional requirements are thus required.