Data Protection & GDPR Compliance

Marketing & Communications

• Sending newsletters or promotional emails to individuals who are not existing clients or employees.

• Collecting contact information through online forms for future marketing follow-ups.

• Sharing personal data (e.g., names, emails) with third-party partners or sponsors after an event.

• Using contact information collected for one purpose (e.g., webinar registration) to market unrelated services.

Events & Image Use

• Taking and publishing photos or videos of individuals at corporate or public events (especially when used on websites, social media, or promotional materials).

• Livestreaming an event where individuals might be clearly identifiable.

• Using images of employees or clients in case studies, success stories, or employer branding materials.

• Event registered participants follow-up (depends on the given consent at the registration).

Human Resources & Internal Communication

• Collecting and storing special categories of data (e.g., health data for accommodation requests or dietary restrictions).

• Sharing employee information (e.g., name, role, photo) on external channels, such as the company website or LinkedIn.

• Publishing internal newsletters featuring personal stories, achievements, or interviews, if not strictly job-related.

Digital Platforms & Tools

• Using tracking technologies or cookies that collect personal data for analytics or advertising.

• Collecting feedback, testimonials, or recordings during online sessions, webinars, or training, if they include personal data.

HR & Employee Activities

• • Internal training registration forms (employees only).

    • • Legal basis: Performance of employment contract or legitimate interest of the company.

      • Consent is not needed because the activity supports employee development within the scope of the employment relationship.

  • Processing payroll and benefits data

    • • Legal basis: Legal obligation under labor or tax laws.

  • Employee performance evaluations or appraisals

    • • Legal basis: Contractual necessity or legitimate interest

  • Emergency contact collection

    • • Legal basis: Vital interests or legal obligation

  • Monitoring access to company facilities or equipment usage (with prior notice and justification)

    • • Legal basis: Legitimate interest for security and operational continuity

Business Operations & Communications

• • Sending operational emails to employees (e.g., policy updates, IT maintenance notices)

    • • Legal basis: Legitimate interest or contractual necessity

  • Client contact data collection as part of a service contract

    • • Legal basis: Contractual necessity

      • As long as the data is used strictly for delivering the contracted service.

  • Data processing for audit, compliance, or regulatory reporting

    • • Legal basis: Legal obligation

Internal Surveys

• • Anonymous employee engagement surveys

    • • No personal data = GDPR does not apply

      • If not anonymous and personal opinions are collected, another legal basis may apply (e.g., legitimate interest with safeguards).