General Data Protection Regulation


I. Name and address of the data controller

The data controller in the sense of the General Data Protection Regulation and other national data protection laws of the Member States as well as other data protection regulations is:

BoostSolutions Inc.
23555 Golden Spring DR K-1, Diamond Bar, CA 91765, USA
Phone: +1 877-683-5192
E-mail: sales@boostsolutions.com
Website: www.boostsolutions.com

II. Name and address of the data protection officer

The data protection officer of the data controller is:

Sam Yang
23555 Golden Spring DR K-1, Diamond Bar, CA 91765, USA
Email: samyang@boostsolutions.com
Phone: +1 877-683-5192

III. General information on the data processing

1. Scope of the processing of personal data

We generally only collect and use personal data of our users as far as this is necessary to provide a functional website as well as our contents and services. Personal data of our users are generally only collected and used after having obtained the user’s consent. An exception applies in cases in which it is not possible to obtain a consent in advance for factual reasons and in which the processing of the data is permitted by legal regulations.

2. Legal basis for the processing of personal data

If we obtain the consent of the data subject for the processing of personal data, section 6 subsection 1 letter a of the EU General Data Protection Regulation (GDPR) serves as legal basis for the processing of personal data.

In the processing of personal data which is necessary for the performance of a contract to which the data subject is a contractual party, article 6 subsection 1 letter b GDPR serves as legal basis. This also applies to any processing that is necessary for the completion of pre-contractual measures.

If the processing of personal data is necessary for the satisfaction of a legal obligation applicable to our company, article 6 subsection 1 letter c GDPR serves as legal basis.

In case vital interests of the data subject or any other natural person require the processing of personal data, article 6 subsection 1 letter d GDPR serves as legal basis.

If the processing is necessary to keep a justified interest of our company or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not outweigh the interest mentioned first, article 6 subsection 1 letter f GDPR serves as legal basis for the processing.

3. Data deletion and storage duration

The personal data of the data subject are deleted or blocked as soon as the purpose of the storage ceases to exist. The data may moreover also be stored if this has been provided for by the European or national legislator in orders, laws or other regulations of the Union applicable to the data controller. The data will also be blocked or deleted if a retention period specified by the standards above expires, unless it is necessary to continue storing the data for the conclusion or performance of a contract.

IV. Provisioning of the website and debug log files

1. Description and scope of the data processing

We don’t collect and store any personal data except the following data:

(1) User’s business contact information like email, address, telephone etc.

(2) User’s basic SharePoint information like SharePoint version, farm id etc. for licensing & support purpose

(3) SharePoint log files sometimes for debugging.

The data above (1) and (2) are stored in our system for tracking, debugging and license renewal.

2. Legal basis for the data processing

The legal basis for the preliminary storage of the data and the log files is article 6 subsection 1 letter of GDPR.

3. Purpose of the data processing

The user’s business contact information like email, address, telephone etc. are for contact and sales purpose.

The user’s basic SharePoint information like SharePoint version, farm id etc. are for licensing & support purpose.

The SharePoint log files are deleted immediately after the issue or bug is resolved.

These purposes also constitute our justified interest in the data processing according to article 6 subsection 1 letter f GDPR.

4. Storage duration

The data are deleted as soon as they are no longer necessary to achieve the purpose of their collection.

5. Right of objection and removal

The recording of the data for the provisioning of the website and the debug of log files are imperatively necessary. Consequently, the user does not have any right of objection.

V. Use of cookies

1. Description and scope of the data processing

Our website uses cookies. Cookies are text files which are stored in the Internet browser and/or by the Internet browser on the user’s computer system. If a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic character string which allows for a clear identification of the browser when the website is accessed again.

2. Legal basis for the data processing

The legal basis for the processing of personal data by using cookies is article 6 . subsection 1 letter f GDPR.

3. Purpose of the data processing

The purpose of the use of technically necessary cookies is to simplify the use of websites for the users. Without the use of cookies, some functions of our Internet pages may not be offered. For these functions it is necessary that the browser will also be recognized after a page change.

The user data collected by technically necessary cookies are not used for the creation of user profiles.

These purposes also constitute our justified interest in the processing of personal data according to article 6 subsection 1 letter f GDPR.

4. Storage duration, right of objection and removal

Cookies are stored on the user’s computer and transmitted to our page from the latter. Consequently, you as the user have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or limit the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all website functions to their full extent.

VI. Newsletter

1. Description and scope of the data processing

The newsletter is sent based on the user’s subscription on the website

You have the possibility to subscribe to a free newsletter on our Internet page. When doing so, the data from the input mask will be transmitted to us at the time of subscription to the newsletter.

In this connection, the following data are stored:
– Email address

Apart from that, the following data are collected in the subscription:

(1) Date and time of the subscription

For the processing of the data, your consent is obtained and reference is made to this Data Privacy Statement within the scope of the subscription process.

The data are not forwarded to any third parties in connection with the data processing for sending newsletters. The data are exclusively used to send the newsletter.

2. Legal basis for the data processing

The legal basis for the processing of the data after subscription to the newsletter by the user is article 6 subsection 1 letter a GDPR, in case the user’s consent is available.

3. Purpose of the data processing

The user’s email address is collected in order to send the newsletter.

Other personal data are collected within the scope of the subscription process in order to prevent the misuse of the services or the email address used.

4. Storage duration

The data are deleted as soon as they are no longer necessary to achieve the purpose of their collection. This means that the user’s email address will be stored as long as the newsletter subscription is active.

The other personal data collected within the scope of the subscription process will usually be deleted after a period of seven days.

5. Right of objection and removal

The newsletter subscription can be terminated by the user concerned at any time. For this purpose, every newsletter contains a corresponding link.

This also allows for the revocation of the consent to store the personal data collected during the subscription process.

VII. Rights of the data subject

If personal data about you are processed, you are a data subject in the sense of the GDPR and you have the following rights vis-à-vis the data controller:

1. Right to information

You can request a confirmation from the data controller whether we process personal data about you.

If there is such processing, you can request information from the data controller regarding the following aspects:

(1) the purposes for which the personal data are being processed;

(2) the categories of personal data that are being processed;

(3) the recipients and/or categories of recipients to which the persona data about you have been or will be disclosed;

(4) the planned storage period for your personal data or, if no concrete information can be provided in this matter, criteria for the determination of the storage period;

(5) the existence of a right to correction or deletion of your personal data, a right to limitation of the processing by the data controller or a right to object to this processing;

(6) the existence of a right to complain with a supervisory authority;

(7) any and all available information regarding the origin of the data if the personal data have not been collected from the data subject;

(8) the existence of automated decision-making including profiling according to article 22 subsections 1 and 4 GDPR and – at least in these cases – meaningful information regarding the logics involved as well as the scope and the intended effects of such processing for the data subject.

You are entitled to request information regarding the question whether your personal data are transmitted to a third country or to an international organization. In this connection, you may request information regarding the suitable guarantees according to article 46 GDPR in connection with the transmission.

2. Right to correction

You are entitled to correction and/or completion vis-à-vis the data controller if the processed personal data about you are incorrect or incomplete. The data controller must make the correction immediately.

3. Right to limit the processing

You can request the limitation of the processing of the personal data about you under the following prerequisites:

(1) If you contest the correctness of the personal data about you for a duration allowing the data controller to verify the correctness of the personal data;

(2) If the processing is illegal and you reject deletion of the personal data and request limitation of the use of the personal data instead;

(3) If the data controller no longer needs the personal data for the purposes of the processing, but you need them to assert, exercise or defend legal claims or

(4) If you have filed an objection to the processing according to article 21 subsection 1 GDPR and it has not been determined yet whether the justified reasons of the data controller outweigh your reasons.

If the processing of the personal data about you was limited, these data may – apart from their storage – only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for an important public interest of the Union or a Member State.

If the processing has been limited according to the prerequisites specified above, you will be informed by the data controller before the limitation will be lifted.

4. Right to deletion

a) Deletion obligation

You can ask the data controller to immediately delete personal data about you and the data controller is obliged to immediately delete these data if one of the following reasons applies:

(1) The personal data about you are no longer necessary for the purposes for which they have been collected or processed in any other way.

(2) You revoke your consent on which the processing according to article 6 subsection 1 letter a or article 9 subsection 2 letter a GDPR was based and there is no other legal basis for the processing.

(3) You file an objection to the processing according to article 21 subsection 1 GDPR and there are no overriding justified reasons for the processing or you file an objection to the processing according to article 21 subsection 2 GDPR.

(4) The personal data about you were processed unlawfully.

(5) The deletion of the personal data about you is necessary to comply with a legal obligation according to the law of the Union or the law of the Member States, which is applicable to the data controller.

(6) The personal data about you were collected with regard to the offered services of the information society according to article 1 subsection 1 GDPR.

b) . Information to third parties

If the data controller disclosed the personal data about you and if they are – according to article 17 subsection 1 GDPR – obliged to delete them, they shall take suitable measures, also technical ones, considering the available technology and the implementation costs in order to inform those responsible for the data processing and processing the personal data about the fact that you as data subject have requested them to delete all links to these personal data or copies or replications of these data.

c) Exceptions

There is no right to deletion if the processing is necessary

(1) to exercise the right to freedom of expression and information;

(2) to meet a legal obligation which requires the processing according to the law of the Union or the Member States applicable to the data controller or for the performance of a task in the public interest or exercising public authority assigned to the data controller;

(3) for reasons of public interest in the area of public health according to article 9 subsection 2 letters h and i as well as article 9 subsection 3 GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes according to article 89 subsection 1 GDPR if the right specified under paragraph a) will presumably make the realization of the goals of this processing impossible or seriously impair them, or

(5) to assert, exercise or defend legal claims.

5. Right to information

If you have asserted the right to correction, deletion or limitation of the processing vis-à-vis the data controller, the latter is obliged to forward this correction or deletion of the data or the limitation of the processing to all recipients to which they disclosed the personal data about you unless it turns out to be impossible or related to disproportionate expenses.

You are entitled vis-à-vis the data controller to being informed about these recipients.

6. Right to data transferability

You are entitled to receive the personal data about you that you have made available to the data controller in a structured, common and machine-readable format. You are moreover entitled to transmit these data to another data controller without interference by the data controller to which the personal data were made available if

(1) the processing is based on a consent according to article 6 subsection 1 letter a GDPR or article 9 subsection 2 letter a GDPR or on a contract according to article 6 subsection 1 letter b GDPR and

(2) the data are processed by means of automatic processes.

You are moreover entitled in exercising this right to effect the transmission of the personal data about you directly from one data controller to another data controller, if this is technically feasible. This must not impair freedoms and rights of other persons.

The right to data transferability does not apply to the processing of personal data which is necessary to perform a task in the public interest or exercising public authority assigned to the data controller.

7. Right of objection

You are entitled to object to the processing of the personal data about you carried out on the basis of article 6 subsection 1 letter e or f GDPR at any time for reasons resulting from your particular situation; this is also true for any profiling based on these provisions.

The data controller will not process the personal data about you any longer unless they can prove imperative reasons for the processing which are worthy of protection and which outweigh your interests, rights and freedoms or the processing serves the assertion, exercising or defense of legal claims.

If personal data about you are being processed for direct advertisement purposes, you are entitled to file an objection to the processing of the personal data about you for the purposes of such advertisement at any time; this also applies to the profiling as far as it is connected to such direct advertisement.

If you object to the processing for purposes of direct advertisement, the personal data about you will no longer be processed for these purposes.

In connection with the use of services of the information society you have – irrespective of Directive 2002/58/EC – the possibility to exercise your right of objection by means of automated process in which technical specifications are used.

8. Right to revoke the declaration of consent in respect of data protection

You are entitled to revoke your declaration of consent in respect of data protection at any time. The revocation of the consent does not affect the legitimacy of the processing made on the basis of the consent until its revocation.

9. Automated decision in the individual case including profiling

With regard to decisions having legal effects on you or significantly affecting you in a similar way, you are entitled to these decisions not being exclusively based on automated processing – including profiling. This does not apply if the decision

(1) is necessary for the conclusion or the performance of a contract between you and the data controller,

(2) is admissible on the basis of regulations of the Union or the Member States applicable to the data controller and these regulations contain reasonable measures for the protection of your rights and freedoms as well as your justified interests or

(3) is made with your explicit consent.

These decisions must, however, not be based on special categories of personal data according to article 9 subsection 1 GDPR unless article 9 subsection 2 letter a or g applies and reasonable measures for the protection of the rights and freedoms as well as of your justified interests have been made.

With regard to the cases specified in (1) and (3), the data controller will take reasonable measures in order to protect the rights and freedoms as well as your justified interests, which at least comprises the right to bring about the intervention of a person on the part of the data controller, to present one owns view and to appeal against the decision.

10. Right to complain with a supervisory authority

Irrespective of any other appeal under administrative law or provided by a court, you are entitled to complain with a supervisory authority, particularly in the Member State of your place of residence, your place of work or the place of the suspected violation if you are of the opinion that the processing of the personal data about you violates the GDPR.

The supervisory authority with which the complaint was filed will inform the complainant about the status and the results of the complaint including the possibility of a legal appeal according to article 78 GDPR.