Controller vs. Processor

GDPR splits organizations into two main roles: Controller and Processor. Understanding which one you are — and which one MMV is — matters because each role has different obligations.

Controller

The Controller decides what personal data is collected and why. Under MMV's contract structure, our Customer (the management company or payroll provider) is the Controller for personal data uploaded into the MMV service.

Controllers are responsible for:

• Establishing the lawful basis for processing (consent, contract, legal obligation, etc.).
• Informing data subjects about what data is collected and how it's used.
• Responding to data subject rights requests (access, deletion, portability, etc.).
• Notifying the relevant supervisory authority and affected individuals in the event of a personal-data breach.

Processor

The Processor acts on behalf of the Controller, following the Controller's documented instructions. Under the Data Processing Addendum, MMV is a Processor for Customer Personal Data.

Processors are responsible for:

• Processing personal data only as instructed by the Controller.
• Implementing appropriate technical and organizational security measures.
• Notifying the Controller of any personal-data breach involving Controller data, without undue delay and within 72 hours.
• Assisting the Controller with data subject rights requests.
• Maintaining records of processing.

Sub-processors

MMV may engage sub-processors — third parties that process personal data on our behalf. MMV publishes the current sub-processor list in Appendix 1 of the DPA. Customers are notified before any change to the sub-processor list.