Shufti GDPR Compliance Guide

Scenarios where Shufti acts as a data processor

As a data processor, Shufti processes personal data on behalf of its clients, who are the data controllers. In this role, Shufti follows the instructions of the data controller and does not make decisions regarding the processing of personal data.

Example of Data Subject Interaction with Shufti as a Processor

All the above steps involve gathering user data from the data subject on behalf of the controller, which is then processed by Shufti as the processor. Under GDPR guidelines, Shufti only acts on instructions from the data controller regarding the processing and handling of this data.

User data handling

Shufti processes user data on industry-secured servers located in the EEA zone. The storage and handling of data are subject to GDPR requirements, and Shufti’s responsibilities vary depending on whether it is acting as a processor or a controller.

Automated decision-making

Shufti uses personal data for automated decision-making solely for verifying identity and document authenticity. The process involves checking the information provided by the data subject against identity documents and determining verification outcomes. When Shufti acts as a processor, all automated decision-making is carried out under the instruction of the data controller. When acting as a controller, Shufti determines the decision-making processes independently.

Data access and user rights requests as a processor

As a data processor, Shufti does not independently handle requests from data subjects regarding their personal data. Any request from a data subject regarding their personal data, including but not limited to access, rectification or deletion should be made directly to the data controller. The controller will then instruct Shufti, as the processor, on how to proceed with the request in accordance with GDPR.

Scenarios where Shufti acts as a data controller

In certain situations, Shufti may act as a data controller. This occurs when Shufti determines the purposes and means of processing personal data independently, rather than on behalf of another entity.

Example of Shufti as a Controller

When Shufti collects personal data directly from individuals for any lawful purpose, it acts as a data controller because it independently determines the objectives and methods of processing.

Handling Data Access and User Rights Requests as a Controller

As a data controller, Shufti is directly responsible for handling requests from data subjects regarding their personal data. Data subjects can contact Shufti directly at [email protected] for access, correction, deletion, or other actions concerning their data. Shufti will respond to these requests in compliance with GDPR requirements.

Data subject rights

Access Rights

Under GDPR, data subjects have the right to access their personal data. When Shufti acts as a data processor, these requests should be directed to the data controller. Shufti will provide complete assistance to the data controller, who will then instruct Shufti on how to handle the request. In situations where Shufti acts as a data controller, it is directly responsible for responding to data subject requests for access to their data. Shufti will process these requests promptly and in accordance with GDPR regulations.

Deletion Rights

Data subjects have the right to request the deletion of their personal data. As a data processor, Shufti will handle deletion requests based on instructions from the data controller. When Shufti is the data controller, it will directly process requests for data deletion, ensuring they are fulfilled in compliance with GDPR.
In many cases, the right to deletion is not absolute, and can depend on the context of the request, so it does not always apply.

Modification Rights

Data subjects also have the right to ask for modifications or corrections to their personal data. As a processor, Shufti will follow the data controller’s instructions on making any necessary changes. If acting as a controller, Shufti will manage such requests directly and ensure any required modifications are made promptly in line with GDPR standards.
Shufti is committed to upholding the rights of data subjects and maintaining GDPR compliance in all of its operations, whether acting as a data processor or a data controller.