Personal data & data protection (GDPR)

All about Odyssey´s role, how we work and how we comply with current legislation. As a local European actor, we are always extremely careful to comply with current legislation.

What is Odyssey's role?#

You as a customer are, in the GDPR's sense, the data controller and have both the responsibility for and control over the information that is saved in our system. Odyssey acts as a personal data sub-processor and in that role our task is to handle personal data in the way that you give instructions and the law requires. From a purely legal perspective, you can therefore consider Odyssey as one of your own systems.

Does Odyssey comply with GDPR?#

Yes, Odyssey services and operations meet all the requirements of the GDPR.

Should we sign a personal data processing agreement (DPA) with Odyssey?#

Yes, when you become a customer with us, you always sign a personal data assistant agreement (DPA) as an appendix to your basic agreement.

Sometimes we get questions about whether we can sign your DPA agreement instead of ours. It is doable, but often the typical DPA agreements need to be adapted to work for us as a provider of a cloud service. The agreement you have already signed with us already complies with the GDPR and therefore there is no particular need for an additional agreement. If you want special additions or changes, it is therefore easiest to do this with our standard agreement as a starting point.

Do you have questions about DPA agreements? You can always contact us if you want to get in touch with us on these issues!

Who owns the information in Odyssey services?#

Generally Odyssey own all research data in our services. Special agreement can be signed for you as a customer to own the research data. Specifically if we use your end customer in our research.

Where does Odyssey process data and personal information?#

Odyssey processes personal data (and all other data) on services within the EU.

Which personal data does Odyssey process?#

Depending on which services you are using from Odyssey, Odyssey normally processes the following data.

For normal users of our logged in services:

• Name
• E-mail address
• Company association
• IP-address is stored for all request to our system to maintain support services.

If you contact us through any of our public channels we may ask for and store:

• Phone number
• Company address

If you are a business contract contact we may also store some other contact information needed to maintain contract and business relationship.

Which sub-processor does Odyssey use?#

We have an updated list of which sub-processors Odyssey use.

As a customer, you do not have the option to explicitly approve or deny individual sub-processors. We choose our sub-processors with care and only cooperate with proven and serious actors.

How does Odyssey regard Schrems II?#

As a result of the Schrems II ruling, Odyssey has discontinued all forms of processing outside the EU/EEA. We have also ensured that we have updated subcontracts in place where the updated version of the Standard Contract Clauses appears in accordance with EDBP's recommendations.

For subcontractors with headquarters in third countries, a risk analysis, known as a Data Transfer Impact Assessment (TIA), has also been carried out.

What security measures does Odyssey take to protect personal data?#

You can read more about Odyssey's overall work with information security in our services on this page. There is also more information about the security of personal data in an appendix to your agreement.