What Is the GDPR?

The General Data Protection Regulation (GDPR) is one of the biggest legislative changes made since 1975. To be effective from May 25, 2018, the primary goal of these changes is protection of personal data and rights of EU residents.

Our Commitment toward GDPR

We are fully committed to upholding the privacy and rights of our customers and their customers. The essence of the GDPR is in direct alignment with our core values of customer trust and data privacy. With that in mind, we are actively working toward defining our roadmap for GDPR to overhaul our systems and processes in accordance with the standards. We are committed to achieving GDPR compliance well before the May 25, 2018 deadline.

How Are We Preparing for GDPR?

Over the last couple of months, we have made steady progress toward understanding and analyzing how GDPR will impact our customers. This was made possible with the help of a focused group comprising of experts on Corporate Security and Compliance, and members from our senior leadership. Here’s a glimpse of our analysis and the steps we are undertaking to ensure compliance:

Establishing the Governance Structure

  1. Start the GDPR compliance initiative with a dedicated focus group. - Completed
  2. Create a comprehensive Privacy Management Framework that incorporates 130+ best practices and organizational measures, divided into 13 data privacy management categories. - Completed
  3. Appoint a Data Protection Officer/Official (DPO) in an independent role. - In Progress
  4. Conduct an assessment on product and business impact. - In Progress
  5. Initiate the internal Privacy and Security Awareness program. - In Progress
  6. Conduct Data Protection Impact Assessment (DPIA) (Internal). - Completed
  7. Conduct Data Protection Impact Assessment (External). - In Progress

Implementing Policies and Procedures

  1. Data Protection Policy - Completed
  2. Change Privacy Policy - Completed, to be published soon
  3. Information Security and Governance Policy - In Progress
  4. Data Breach and Incident Response Plan - In Progress
  5. Risk management framework to assess and manage threats across the organization and real-time personal data - Planned
  6. Embedding of personal data protection requirements within contracts and agreements with third-party service providers - Planned

Embedding and Implementing Data Privacy into Operations

  1. Prepare a detailed inventory of data and data-flows within our systems - Completed
  2. Establish procedures and policies to restrict processing of personal data - In Progress
  3. Set up mechanisms to automatically track flow of all data within and outside our systems - Planned

Product Features Geared toward GDPR Compliance

While we are constantly working toward understanding the GDPR further, our product already provides the following capabilities geared toward protecting personal data and privacy:

  1. Anonymize IP address: By default, PushCrew never captures the full IP address of any of the visitors on your website. The last octet of the IP addresses is deleted to ensure that these are rendered completely anonymous.
  2. Consent: Web Push Notifications already require website visitors to give explicit consent by turning on the browser-level permission.
  3. Subscriber data: After accepting to receive notifications, the push notification service of the browser creates a randomly generated ID for the subscriber. This ID cannot be used to identify a particular individual.
New additions:
  1. Privacy settings: We have added a new privacy settings page inside every PushCrew account which gives you full control over your account access. Read more about it here.

Features soon to go live:

  1. Granular control over the subscriber data collected.
  2. Enable subscribers to opt-out of data tracking.
  3. Enable subscribers to exercise their rights with regards to their personal information stored by you on PushCrew servers:
    1. Right to access personal information
    2. Right to get (any) personal information deleted
    3. Right to withdraw consent

We will update this page soon with a roadmap of our changes and how you can leverage these to become GDPR-compliant.


When is the GDPR coming into effect?

The GDPR was approved and adopted by the EU Parliament in April 2016. The regulation will take effect after a two-year transition period and, unlike a Directive, it does not require any enabling legislation to be passed by the government; meaning it will be effective from May 25, 2018.

Whom does the GDPR affect?

The GDPR applies not only to organizations located within the EU but also to organizations located outside of the EU if they offer goods or services to, or monitor the behavior of EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the location of the companies.

What is the difference between a data processor and a data controller?

A controller is an entity that determines the purposes, conditions, and means of the processing of personal data, while a processor is an entity that processes personal data on behalf of the controller.

Where can I know more about the GDPR?

You can refer to the following links for more information on the GDPR and how you can prepare for it.

Last updated: Jan 3, 2018