Introduction GDPR

Personal data in the service

Visma.net AutoReport (“the service”) stores and processes data of a customers and their employees. This is done based on the agreement done by Visma and the client organization, and the service operates under the terms of services (TOS) agreed by customer contact person. The service processes and stores the following information that can be classified as a private data.

Electronic tax and payroll reports sent from another Visma system (EPR or Payroll) - data is transferred to tax authorities or pension companies based on the requests done by the client.

User email address - used only for security purposes and informing users if report submission fails, not used for marketing or user classification.

Name, phone number and email address of a person sending an electronic report behalf of an organization. This is done only when it is requested by a report receiver as tax authority or a pension company.

Personal identifiers given by user to authenticate a report to Norwegian tax authority. That is NorskId (social security number) for Altinn. These are saved only temporarily.

Data deletion

The service user can delete company settings by themselves in AutoReport / Settings web site. The service user cannot delete any other company or customer data. User cannot either delete his name or email address from report processing history (“report metadata”). That is, the service will store information who sent a report to tax authorities at least as long as reports of a company.

The service will store by default all client organization data up to 7 years. Visma cannot delete reporting data partially, for example remove private data of employee from processed payroll reports. Visma and the client organization need to follow accounting and taxation laws and save reports as they are for number of years. That is, the service do not support data deletion request of on a person level. Furthermore, a client who has terminated contract with Visma can request data deletion from AutoReport and in this case their data is deleted.