Typically there is a privacy page on the website, a retention policy borrowed from a template and, with luck, a processing register in Excel. Yet paperwork and servers rarely agree. On paper, records disappear after twenty-four months; in reality, quotes with client contacts from ten years back are still sitting on a shared drive. Should personal data leak, the Information Commissioner usually expects to hear within 72 hours what was exposed, how many individuals are involved and for how long. When no one can say what the inboxes, file shares and sector software actually contain, three days vanish fast. We are engineers, not lawyers, and we never issue legal advice; that stays with your counsel. Our task is to make the technology do what your policies promise, and to leave evidence that it does.
Responsibilities divide neatly. You and your counsel or DPO settle the legal questions: the grounds for processing, retention periods, what notices and consent forms should say. Whatever needs switching on or adjusting on a laptop, in Microsoft 365 or Google Workspace, or on a server is ours to check and carry out.
We search Minimax, Pantheon or Metakocka, the CRM, Outlook and Gmail mailboxes, shared folders, web forms, the online shop admin, the courier integration and the payroll spreadsheets sent to your accountant. What we find feeds your record of processing activities, and quite often corrects it.
Your lawyer writes the words; we place them correctly. That means a link to the privacy notice beside contact and sign-up forms, a separate unticked box for marketing consent, and a cookie banner that genuinely holds back analytics until the visitor agrees, as ZEKom-2 requires. Each consent is stored with its timestamp and the text version shown, ready for export.
Everyone handling data on your behalf goes on a list: the bookkeeping firm, payroll software, the hosting company, the newsletter tool, your e-invoice exchange provider, couriers and Apply itself. Against each we note which data it touches and in which country it is stored. Your lawyer can then see which data processing agreements need checking and where a third-country transfer comes into play.
The periods in your policy become rules inside the systems: retention tags on mailboxes, automatic deletion of old job applications, expired versions pruned from backups, and a reminder plus a minutes template for scheduled clean-ups. Records that tax rules oblige you to keep are not deleted but locked down. Which period applies is for your lawyer and accountant to settle.
MFA on every account, laptops encrypted through Intune, role-based rights in Entra ID in place of one shared “admin” login, sensitivity labels and DLP policies in Microsoft 365, and access logs held for as long as your policy says. Apply follows ISO 27001 principles and claims no certificate it does not have.
A flow showing who alerts whom, with what facts, once something goes wrong, so the decision on notifying the Information Commissioner is taken well inside the 72 hours. We also build a technical route for locating one person's data across every system, exporting it or erasing it, so access and erasure requests are answered on time.
No drawn-out audit spanning months. Cheap, urgent fixes come first: shutting a former employee's still-active account often achieves more than buying a new tool. After each stage you receive a short note on what is finished and what comes next.
A video call with whoever looks after data protection, plus read-only rights to Microsoft 365 or Google Workspace, servers and devices. Nothing gets changed at this point; we only observe.
Where each kind of data lives, who processes it for you and what is missing, every item ranked and given an effort estimate in hours. Your lawyer or DPO can lift whole sections straight into the record of processing.
MFA, orphaned accounts and public sharing links are dealt with in the first days. Encryption, labels, DLP and deletion rules follow on fixed dates, out of hours in case a service blinks briefly.
New software, a new processor or the departure of someone with wide privileges is a reason to update the record, on top of the yearly review. A one-hour online awareness session for staff can be added here. Screenshots of settings are filed as evidence.
Imagine a Celje online shop for baby and children's gear, selling on its own site and through Ceneje.si. To untangle a parcel mix-up last spring, a spreadsheet of orders, complete with customers' names, home addresses and mobile numbers, was put on Google Drive with public link access and never tidied away. Our scan flags it on the first morning; switching the link off is a five-minute job. The audit trail reveals every account that viewed the file. You, as controller, then decide with legal counsel whether the Information Commissioner needs to be told, and you decide from evidence instead of hunches.
No. The lawful basis you rely on, the content of your privacy notice and whether an incident must be reported are legal matters, and Apply is a technical firm. We do work hand in hand with your lawyer or DPO: we map what actually exists, answer the technical questions and implement the decisions in your systems. Whether you need to appoint a DPO at all depends on the type and scale of processing, and your lawyer is the one to say.
GDPR requires one from controllers and processors, and the carve-out for smaller organisations is narrow and conditional. Whether it covers you is a legal call. In practice almost every company that regularly handles staff and customer data keeps one. Either way, our inventory supplies the technical inputs: data categories, systems, recipients, storage locations and safeguards.
We do. Administering your IT from afar inevitably exposes us to personal data, which usually makes Apply a processor in GDPR terms. Either party's template can serve as the starting point; it sets out what we may access, which sub-processors are involved, the safeguards and the deadline for telling you about an incident. Apply LLP is incorporated outside the EU, so the document also has to cover the transfer to a third country, standard contractual clauses being one option. Which route to take is up to your counsel.
A DPIA is called for when processing is likely to pose a high risk to people, such as large-scale handling of health data at a private clinic or systematic monitoring. ZVOP-2 adds rules on certain areas, video surveillance among them. The controller decides, with legal advice, whether an assessment is required. Apply prepares its technical part: a description of systems and data flows, the safeguards already in place and proposals for reducing the risk.
Write to support@apply.si straight away, or to helpme@apply.si if you are under contract. In Microsoft 365 we can attempt a message recall, revoke sharing links, lock the account if needed and pull from the logs who opened what and when. Notifying the Information Commissioner and the people affected is the controller's decision together with its lawyer, but now with the facts at hand. The 72 hours start from the moment you become aware of the breach.
With a procedure written before the request ever arrives: where to look (ERP, CRM, mail, the web shop, the newsletter tool, backups), who carries it out and how it is logged. Invoices and other records you must keep under tax law are not erased but restricted. Your lawyer and accountant agree the detail. Apply writes the procedure and rehearses it end to end with a made-up request.
Hardly ever at the outset. Microsoft 365 Business Premium already contains Intune, conditional access, sensitivity labels and DLP, and many firms pay for them without switching them on. We carry out the review at €50 per hour plus VAT with the scope fixed beforehand, or as part of a Start, Business or Premium plan. If a purchase really is warranted, we back it with a concrete finding.
Tell us what data you process, in which programs and who handles the topic today. We will send a review proposal and a list of questions worth clearing with your lawyer first.
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
No town by that name here. Check the letters, or settle for the nearest larger place. Our engineers work only over the internet, so Kočevje and Koper get precisely the same treatment.
