Personal data and GDPR

AssetTrove stores the personal data needed to manage assets and licences: people's names, work email addresses, job titles, departments and the devices and licences assigned to them.

Erasing a person

When someone asks to be forgotten under the GDPR, an owner can erase them from the person's page on People.

• Erasing replaces the person's details with a pseudonym. Their name and email are removed.
• The history stays intact: which device they had, which licences were allocated, and when. That history is often needed for licence audits and finance, and it no longer identifies the person.
• Erasing is permanent. To confirm, you type ERASE followed by the person's email address.

The audit log is built for this. Personal fields are stored in a hashed form, and names and IP addresses are kept outside the tamper-evident chain, so they can be removed without breaking it.

Legal hold

If someone is involved in a legal matter, you can put them on legal hold from their page on People, with a reason.

• AssetTrove never proposes reclaiming the licences of someone on legal hold.
• The hold and its reason are recorded in the audit log.

Exports

Exports of assets, licence positions and the audit log can contain personal data. Exporting is itself recorded in the audit log as a sensitive action, and limited to 10 exports per hour per organisation.