Privacy of persons reporting

1. TrusTool is the brand name of a digital portal for confidential counsellors. Organizations that work with TrusTool allow persons reporting to approach their confidential counsellor trough a secured portal and enable them to report, either anonymously or under their own name, undesirable behavior and integrity violations. Confidential counsellors also use the portal for their case management.

2. A person reporting that uploads personal data in the portal agrees that the personal data is stored in the portal. The sole purpose of storing and registering the personal data is to be able to act and help in response to a report. The personal data will not be dispatched through the system to any other person or organization.

A non-anonymous person reporting has the right and ability to review, correct and/or delete its personal data in its file. In addition, at any time a non-anonymous person reporting has the right and ability to withdraw its consent to process personal data. In that case the confidential counsellor is obliged to remove the personal data from the portal. In that case the portal only shows that a report was made on a certain date and that the report related to undesirable behavior or an integrity violation.

3. Organizations that work with TrusTool do not have access to the secured part of the portal in which the reports of the persons reporting are stored. Only the confidential counsellor has access to the files and personal data. Secured access requires a 2-step authentication of confidential counsellors.

4. Personal data will be stored in the portal for a maximum period of two years after the file has been archived by the confidential counsellor. In accordance with the code of conduct of the association of professional confidential counsellors (Landelijke vereniging van Vertrouwenspersonen), the personal data is removed from the portal after the two-year period.

TrusTool B.V.

5. The TrusTool platform has been developed and is operated by TrusTool B.V., established in Bussum and registered with the trade register under number 89206320. TrusTool B.V. is responsible for the processing of personal data as described in this privacy statement.

Contactdetails of TrusTool B.V. are:
Gooilandseweg 14
1406 LL Bussum
tel: +31 85 400 14 06
info@trustool.nl
www.trustool.nl

6. Security and protection of privacy and personal data have the highest priority.

Security TrusTool Platform

7. The TrusTool platform is managed by One2Ten B.V., established in (1406 PE) Bussum at Herenstraat 24, registered in the trade register under number 61724963. TrusTool has entered into a processing agreement with One2Ten B.V..

ISO 27001 – NEN 7510
One2ten’s information security systems are ISO 27001 certified. In addition, One2Ten holds a NEN7510 certificate applicable to data processing in the healthcare sector.

One2ten’s implementation and execution of its processes also complies with the Baseline Information Security for Governments (BIO). As part of its integrated attention and care systems for information security, One2Ten comp[lies with the policy document ISMS – Information Security Management System supplemented with repeating awareness sessions for all its employees, a ‘code of conduct’, onboarding processes including information security aspects, active and regular review of users per system and analysis of incident registration reporting

Encryption and storage data
The encryption of data storage takes place within Amazon Web Server (AWS) environment where the regular storage of backups are also encrypted and accessible only to system administrators. One2Ten uses the AWS EBS encryption for encryption on AWS. This encryption uses a Data Key that follows the industry standard AES-256 algorithm. Furthermore, this encryption has been expanded with Trend Micro deep internet security at server level.

The storage and processing of data takes place per region. Data is collected and processed in the Netherlands and is stored within the EEA and therefore always remains in this EEA (European Economic Areas (EEA).

The transport of (personal) data from One2ten to an external organization takes place via a shared folder within the secure MS Sharepoint environment (Microsoft 365). Access to this directory is managed by One2Ten.

Collection of Personal Data by TrusTool

8. TrusTool collects personal data from organizations and confidential counsellors that work with TrusTool for its own business operations and/or the design of the secured portal.
This personal data may concern:

• organization details (address, branches, VAT number, bank account number);
• contact details (name, address, telephone, email, position)
• details of confidential counsellors (name, address, telephone, email, photo, position).

This data is stored within the EEA.

9. In the event a demo or further information is requested, TrusTool collects personal data via its website, newsletters and other marketing activities.

10. The right to inspect, correct and/or delete personal information also applies to personal data that is collected by TrusTool Any person can at all tims withdraw any permission previously given or request a transfer of personal data stored by TrusTool A request to this effect can be made to info@trustool.nl.

11. TrusTool does not use automated decision-making or profiling. TrusTool keeps records of statistics regarding the use of the platform and the number and nature of reports made. These records are anonymous and cannot be traceable to individuals. TrusTool does not sell personal data to third parties and only provides such information to the extent necessary for the execution of agreed actions.

12. TrusTool does not store personal data any longer than necessary for the purpose for which the data was collected.

13. TrusTool reserves the right to make changes to this privacy statement.

For further questions please contact us at: info@trustool.nl