GDPR and Data Retention Policies

Overview #

The GDPR and Data Retention Module allows organizations to manage user consent, privacy policies, and data retention settings in compliance with GDPR and other privacy regulations. The system provides opt-in consent management, configurable Terms and Conditions, and data retention policies to ensure proper handling of user information.

Administrators can configure these settings through the Admin Portal under:

📌 Organization → Compliance → Terms and Conditions
📌 Organization → Compliance → Retention Settings
📌 Organization → Compliance → User Information

User Consent and Privacy Settings #

Users must opt-in to Terms and Conditions and acknowledge the Privacy Policy before gaining access to the network. These settings can be customized in the Admin Portal, allowing businesses to define their own terms of service, privacy information, and data handling policies.

🔹 Configuring Terms and Conditions & Privacy Policy #

📌 Organization → Compliance → Terms and Conditions

• Organizations can choose between:
  • A single combined text box for both Terms and Conditions & Privacy Policy.
  • Two separate text sections, each with its own dedicated link on the Captive Portal.
• Administrators can write, modify, and update the privacy policies to comply with legal and corporate requirements.
• Changes are instantly reflected on the Captive Portal, ensuring that users always see the most recent version.

🔹 User Experience on the Captive Portal #

When a user connects to the network, they must:

1. Read the Terms and Conditions & Privacy Policy.
2. Accept the terms before proceeding.
3. Complete the login authentication process (e.g., email, SMS, SAML, etc.).

This ensures full transparency about how user data is collected and stored.

Data Retention Policies #

Organizations can configure data retention settings to automatically remove inactive records after a set period. This helps limit unnecessary data storage and ensures compliance with GDPR.

🔹 Configuring Data Retention Settings #

📌 Organization → Compliance → Retention Settings

• Administrators can define a retention period (e.g., 3 months, 6 months, or custom).
• Data is deleted automatically based on inactivity rules, including:
  • Self-Service Users (Email) – Considered active if they have an associated login.
  • Meeting Hosts – Active if a pending guest request is linked.
  • Radius Users – Active if a session is associated with their credentials.
  • SMS Users – Active if their phone number is linked to a login.
  • SAML Users – Active if their account has an active login.
  • Username/Password Users – Active if an associated login exists.
  • Conferences, whitelisted devices, and other data are included in the retention policies.

⚠️ Warning: Changing retention settings permanently deletes system data that meets the deletion criteria.

User Data Management & Opt-Out Process #

Users have the right to request access to their stored data or opt-out entirely from the system.

🔹 Searching & Exporting User Data #

📌 Organization → Compliance → User Information

• Search for user data by Email, MAC Address, or Phone Number.
• Generate reports of stored user data, including:
  • Login history (Meeting Host, Self-Provisioning, SAML, Conferences).
  • Associated whitelisted devices.
  • Personal devices linked to the account.

🔹 Performing a GDPR-Compliant Opt-Out #

📌 Organization → Compliance → User Information → Opt-Out

• Opting out removes all associated user data, including:
  • Active Meeting Host logins.
  • Self-Provisioning and SAML logins.
  • Associated conferences and events.
  • Whitelisted and personal devices linked to the user.
• Users cannot be restored after opt-out—this is a permanent action.

Security & Compliance Considerations #

✔ Legal Compliance – Fully supports GDPR, CCPA, and other privacy regulations.
✔ Automated Data Deletion – Ensures no excessive data retention.
✔ User Transparency – Users must opt-in and accept terms before using the network.
✔ Customizable Privacy Policies – Businesses can define their own privacy policies directly in the admin portal.
✔ GDPR-Compliant Data Removal – The opt-out process allows users to fully remove their stored data.

Benefits of GDPR-Compliant Data Retention #

✔ Reduces liability by ensuring personal data is not stored beyond necessary periods.
✔ Improves transparency with clear terms and conditions for users.
✔ Simplifies data management by allowing admins to automate deletion policies.
✔ Ensures legal compliance with GDPR and corporate data policies.