Answers.Body: <p>CiviCRM is not a company that processes data or store data so I am not sure what you are talking about? I am not sure what you mean by 'your OWN data' in t that respect? I am a CiviCRM community member not an employee of CiviCRM.</p>
  
  <p>CiviCRM itself is NOT a 'cloud' application. The communiy provides source code in a software package. You can install that on any server of your choice and THAT is where your data resides. CiviCRM itself does not process any data from customers. </p>
  
  <p>The global CiviCRM community does have its own website where data of participants at CiviCons and CiviCamps, and active community members is stored. That is community based and maintained, there is not one organization specifically responsible for that data. I assume the data of that community site resides in the USA (and GDPR does not apply).</p>
  
  <p>CiviCRM is not a supplier in the sense that it is an organisation that delivers you services at an agreed price. You as an organization download the codebase of CiviCRM.</p>
  
  <p>If you want to know the license agreement that you agree to when you download CiviCRM you can find it here: <a href="https://civicrm.org/license" rel="nofollow noreferrer">https://civicrm.org/license</a>.</p>
  
  <p>If this does not answer your questions then please explain what you are looking for in more detail?</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-02T19:42:55.570Z
Answers.Text: I think Erik is likely right in terms of answering what Lisa is asking. But there is a possible side to the question that may be valid, and that is if Lisa's organsiation has signed up as a member on civicrm.org - probably a question for Josh - will ping him on chat.
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-03T06:55:10.590Z
Answers.Text: That might indeed be the case @petednz, but then AFAIK the data resides in the US and as CiviCRM is US-based GDPR (which is a European "law") does not apply.
Answers.UserDisplayName: ErikH - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-03T10:09:13.640Z
Answers.Text: GDPR does apply in the US, because it applies to user data stored in Europe AND to data from EU citizens. Any US company that processes personal data from EU citizens is affected.
Answers.UserDisplayName: Djizeus
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-03T19:31:08.347Z
Answers.Text: Yep my understanding too is that GDPR relates to the 'contact' being a EU resident, not whether the organisation/company that is storing the data is based in EU
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-04T12:57:06.143Z
Answers.Text: Thanks, I did not know that. How does that apply to a community rather than a company then?
Answers.UserDisplayName: ErikH - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-02T12:21:52.103Z
Answers.LastActivityDate: 2018-05-02T12:21:52.103Z
Answers.UserDisplayName: ErikH - CiviCooP
Answers.Body: <p>I think its important to provide some general information about your setup before we can fully understand what you need to take into account. As Erik has highlighted, you may be using CiviCRM with your own or website hosting or you may have subscribed to an online service which provides you with a running copy of CiviCRM.</p>
  
  <p>The reason its important to understand the distinction is because the agreements which need to be in place will differ in both situations.</p>
  
  <p>If your organisation has arranged the hosting and is technically looking after your CiviCRM installation then your organisation is the data processor. You'll also need to check the hosting agreement to be sure if the data crosses boundaries, what the hosting provider does with the data, any sharing or selling etc.</p>
  
  <p>If you've entered into an agreement for a software as a service implementation of CiviCRM, where you do not have a contract with the hosting provider, you should seek an agreement with the service provider to clarify all of the GDPR specific issues. Pretty much as above, you need to be clear with your supporters what is or isn't happening with their data and how you'll be using it.</p>
  
  <p>The agreement differ because you probably have less control over how your data is shared in a software as a service platform, for instance they may be using services for address cleansing or servers in the USA without your knowledge.</p>
  
  <p>You'll be best served thinking of GDPR in two distinct areas</p>
  
  <ul>
  <li>Data, where its held, how its handled</li>
  <li>Communications and marketing with your contacts including permission to hold their data and agree to your data/privacy policy</li>
  </ul>
  
  <p>If you split up your compliance into these components it becomes much easier to see where your missing information and what agreements you'll need to have put in place.</p>
  
  <p>Hope that makes some sense!</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-04T20:10:31.273Z
Answers.LastActivityDate: 2018-05-04T20:10:31.273Z
Answers.UserDisplayName: Parvez Saleh
Body: <p>We note that you have added an extension to enable users to ensure we are GDPR compliant</p>
  
  <p>What i am wondering is do you have anything about your OWN data compliance, i.e. a data processing agreement and information about how you use or store the data, where is this processed? In the EEA? Or outside of the EEA?</p>
  
  <p>Anything else you think that is pertinent that will help us satisfy the requirements we have to meet as users that we use GDPR compliant tools/resources/suppliers.</p>
  
  <p>Many thanks</p>
  
  <p>Lisa</p>
  
Tags: <gdpr>
Title: gdpr compliance
ThreadText: # gdpr compliance
  
  (Asked by: username_0 on 2018-05-02)
  
  We note that you have added an extension to enable users to ensure we are GDPR compliant
  
  What i am wondering is do you have anything about your OWN data compliance, i.e. a data processing agreement and information about how you use or store the data, where is this processed? In the EEA? Or outside of the EEA?
  
  Anything else you think that is pertinent that will help us satisfy the requirements we have to meet as users that we use GDPR compliant tools/resources/suppliers.
  
  Many thanks
  
  username_0
  
  **Tags:** gdpr
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2018-05-02. Score: 3
  
  CiviCRM is not a company that processes data or store data so I am not sure what you are talking about? I am not sure what you mean by 'your OWN data' in t that respect? I am a CiviCRM community member not an employee of CiviCRM.
  
  CiviCRM itself is NOT a 'cloud' application. The communiy provides source code in a software package. You can install that on any server of your choice and THAT is where your data resides. CiviCRM itself does not process any data from customers.
  
  The global CiviCRM community does have its own website where data of participants at CiviCons and CiviCamps, and active community members is stored. That is community based and maintained, there is not one organization specifically responsible for that data. I assume the data of that community site resides in the USA (and GDPR does not apply).
  
  CiviCRM is not a supplier in the sense that it is an organisation that delivers you services at an agreed price. You as an organization download the codebase of CiviCRM.
  
  If you want to know the license agreement that you agree to when you download CiviCRM you can find it here: <https://civicrm.org/license>.
  
  If this does not answer your questions then please explain what you are looking for in more detail?
  
  > **Comments:**
  > **username_2**: I think Erik is likely right in terms of answering what username_0 is asking. But there is a possible side to the question that may be valid, and that is if username_0's organsiation has signed up as a member on civicrm.org - probably a question for Josh - will ping him on chat.  
  > **username_1**: That might indeed be the case @petednz, but then AFAIK the data resides in the US and as CiviCRM is US-based GDPR (which is a European "law") does not apply.  
  > **username_3**: GDPR does apply in the US, because it applies to user data stored in Europe AND to data from EU citizens. Any US company that processes personal data from EU citizens is affected.  
  > **username_2**: Yep my understanding too is that GDPR relates to the 'contact' being a EU resident, not whether the organisation/company that is storing the data is based in EU  
  > **username_1**: Thanks, I did not know that. How does that apply to a community rather than a company then?  
  
  ---
  
  ### Answer by username_4 on 2018-05-04. Score: 1
  
  I think its important to provide some general information about your setup before we can fully understand what you need to take into account. As Erik has highlighted, you may be using CiviCRM with your own or website hosting or you may have subscribed to an online service which provides you with a running copy of CiviCRM.
  
  The reason its important to understand the distinction is because the agreements which need to be in place will differ in both situations.
  
  If your organisation has arranged the hosting and is technically looking after your CiviCRM installation then your organisation is the data processor. You'll also need to check the hosting agreement to be sure if the data crosses boundaries, what the hosting provider does with the data, any sharing or selling etc.
  
  If you've entered into an agreement for a software as a service implementation of CiviCRM, where you do not have a contract with the hosting provider, you should seek an agreement with the service provider to clarify all of the GDPR specific issues. Pretty much as above, you need to be clear with your supporters what is or isn't happening with their data and how you'll be using it.
  
  The agreement differ because you probably have less control over how your data is shared in a software as a service platform, for instance they may be using services for address cleansing or servers in the USA without your knowledge.
  
  You'll be best served thinking of GDPR in two distinct areas
  
  * Data, where its held, how its handled
  * Communications and marketing with your contacts including permission to hold their data and agree to your data/privacy policy
  
  If you split up your compliance into these components it becomes much easier to see where your missing information and what agreements you'll need to have put in place.
  
  Hope that makes some sense!
  
  
  ---
  
  