What is GDPR?
The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union.
Who is involved with GDPR?
There are three main parties to the GDPR when collecting information on Treadstone 71:
- First, the individual would provide their personal identifying information (hereafter referred to as 'DataSubject').
- Second is Treadstone 71 (aka the Consulting Company).
As Treadstone 71 collects student data for the use of setting up classes to manage registration for our training, we determine what data is collected, how it is used, how long it is retained, and what access to the data the registrant is allowed.
Does GDPR really affect me?
Treadstone 71 does not provide legal advice as to whether or not the data you control on Treadstone 71 falls under the purview of GDPR (ie, "in-scope"). However, we provide the following information to assist you in determining if your data collection is in-scope.
First, GDPR does not use wording concerning 'citizen' or 'resident' when referencing a Data Subject. Depending on the situation, GDPR can apply to *any* person as a Data Subject.
Three significant points to consider if GDPR applies for a given Data Subject are:
- (a) establishment of the Data Controller inside the EU
- (b) establishment of the Data Processor inside the EU
- (c) establishment of the Data Subject inside the EU
Treadstone 71 is entirely US-based. We use a US-based Data Controller to collect and process data. Marketing events to individuals in the US (or anywhere outside the EU) generally results in data not being GDPR in-scope.
The right to be informed
The Data Subject must have readily transparent access to information describing how their personal data is used, stored, and retained.
Treadstone 71 provides a written Privacy Policy and Terms.
The right of access
The Data Subject has the right to receive all personal data held concerning them within 30 days of request.
The right to rectification
The Data Subject has the right to have their personal data updated. Treadstone 71 provides the tools, through training registration partners PlanetReg and Teachable, to update Data Subject data via the 'edit' button on online confirmation headers or via Registrant Review.
The right to be forgotten
The Data Subject has the right to have their personal data deleted. Treadstone 71 allows for the full update of all Standard and Custom Questions where personally identifying information might be stored. These fields can be cleared to reflect no data, effectively deleting the Data Subject's information.
The right to restrict processing
The Data Subject has the right to halt the processing of their personal data. As the only post-registration processing on Treadstone 71 is for email purposes, updating the Data Subject email address to prevent contact suffices.
The right to data portability
The Data Subject has the right to access their data in a format readily usable for other purposes. You can download all data on a registrant via a CSV file. For assistance, contact us at
The right to object
The Data Subject has the right to stop data processing for direct marketing. Treadstone 71 supports the 'opt-out of processing' option via our partner services.
Other Considerations
Aside from these defined 'rights', there are additional aspects to GDPR that affect the data you collect on Treadstone 71. Concerning the consent to process data, GDPR Article 6 (1) provides six legal grounds for processing:
- (a) The data subject has given consent to the processing of their personal data for one or more specific purposes;
- (b) Processing is necessary for the performance of a contract;
- (c) Processing is necessary for compliance with a legal obligation;
- (d) Processing is necessary to protect vital interests;
- (e) Processing is necessary for the public interest;
- (f) Processing is necessary for legitimate interests pursued by a controller.
The vast majority of Data Subject personal information input on Treadstone 71 is covered by (a) and (b), as the Data Subject provides personal data specifically for event registration. In the Treadstone 71 privacy policy, the Data Subject agrees that the data offered is processed for this specific purpose.
Consent for marketing
Processing Data Subject data for marketing requires explicit consent if GDPR is in scope. GDPR requires consent to be a ‘freely given, specific, informed and unambiguous indication of the data subject’s wishes’.
Emails sent to registrants via the built-in partner system (confirmation, reminder, follow-up survey) fall under Article 6(1)(a/b) as necessary for the event registration process.
Treadstone 71 operates a secure data collection and storage system. All data is collected on TLS-secured pages hosted on a dedicated, physically located server in the USA.
