Online DPA (UK)

Data Processing Agreement (EU and United Kingdom)

between

– Controller –

and

wespond UG (haftungsbeschränkt) (Jamie), Alte Kölner Straße 25a, 51503 Rösrath, Germany

– Processor –

1. General remarks

(1) The Processor will process personal data on behalf of the Controller in the meaning of Article 4 (8) and Article 28 of Regulation (EU) 2016/679 (“EU GDPR”) and, where applicable, Article 4(8) and Article 28 of the UK General Data Protection Regulation, as defined in section 3(10) and supplemented by section 205(4) of the Data Protection Act 2018 (“UK GDPR”). This Data Processing Agreement governs the rights and obligations of the parties in connection with the processing of personal data.

(2) Insofar as the term "data processing" or "processing" (of data) is used in this Agreement, it is taken as that defined in Article 4 (2) EU GDPR and, where applicable, Article 4 (2) of the UK GDPR.

(3) For the purpose of this Agreement, "Applicable Data Protection Law" means, as applicable to the relevant processing, the EU GDPR, the UK GDPR, the Data Protection Act 2018, and any other applicable data protection legislation implementing, supplementing, amending or replacing them, in each case only to the extent applicable to the relevant Processing in accordance with its material and territorial scope.

2. Subject matter of the Agreement

The subject matter, nature and purpose of the processing, the nature of personal data and the categories of data subjects are set out in Annex 1 to this Agreement.

3. Rights and duties of the Controller

(1) The Controller is the responsible body within the meaning of Article 4 (7) EU GDPR and, where applicable, Article 4 (7) UK GDPR, as supplemented by section 6 of the Data Protection Act 2018, for the processing of data on behalf of the Controller. Pursuant to section 3 (5) of this Agreement, the Processor has the right to inform the Controller if the Processor is of the opinion that the data processing is in breach of Applicable Data Protection Law or this Agreement and/or an instruction.

(2) The Controller shall be the person responsible for safeguarding the data subject's rights. The Processor shall promptly inform the Controller if data subjects claim their data subject's rights against the Processor.

(3) The Controller shall be entitled to issue supplementary instructions concerning the nature, scope and procedure of data processing to the Processor at any time. Instructions must be given in text form (e.g. email).

(4) Additional expenses incurred by the Processor as a result of supplementary instructions from the Controller that go beyond the scope of the contractually agreed services shall be reimbursed by the Controller on a reasonable basis. Such reimbursement requires the Controller’s prior written approval and shall be based on documented proof and standard market rates.

(5) The Controller shall promptly inform the Processor if he finds errors or irregularities in connection with the processing of personal data by the Processor.

(6) In the event of the obligation to provide information to Third Parties pursuant to Articles 33 and 34 EU GDPR, Articles 33 and 34 UK GDPR, as applicable, or any other statutory reporting obligation applicable to the Controller, the Controller shall be responsible for the fulfillment of those obligations.

4. General obligations of the Processor

(1) The Processor shall process personal data only within the framework of this Agreement and/or in compliance with possible additional instructions given by the Controller. Excluded from this are legal provisions, which potentially oblige the Processor to a different processing of data. In such a case, the Processor shall inform the Controller of these legal requirements before the processing, unless the law in question prohibits such notification on account of an important public interest. Purpose, nature and scope of data processing shall be governed exclusively by this Agreement and/or the documented instructions of the Controller. Data processing deviating from this Agreement shall be forbidden, unless the Controller has given its written consent.

(2) The Processor shall generally carry out the data processing on behalf of the Controller in member states of the European Union (EU) or the European Economic Area (EEA). The Processor is also permitted to process data outside the EU or EEA if appropriate subprocessors are used in the third country in compliance with the requirements of Section 10 and the requirements of Art. 44-48 EU GDPR are met or an exception within the meaning of Art. 49 EU GDPR exists. Where the UK GDPR applies, the Processor shall not make a restricted transfer unless the transfer is covered by applicable UK adequacy regulations, appropriate safeguards or an applicable exception under UK Data Protection Law. Where the Processor relies on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, the Processor shall ensure that the relevant instrument is validly entered into.

(3) The Processor shall inform the Controller if the Processor is of the opinion that a Controller's instruction is in breach of Applicable Data Protection Law. The Processor shall be entitled to suspend the implementation of the relevant instruction until it has been confirmed or amended by the Controller. Insofar as the Processor can demonstrate that processing according to the instructions of the Controller can lead to liability of the Processor according to Article 82 EU GDPR, or, where applicable, Article 82 UK GDPR, the Processor is free to suspend further processing in this respect until the liability between the parties has been clarified.

(4) The Processor shall not use Personal Data for the purpose of training, retraining, fine-tuning, or otherwise improving any machine learning or artificial intelligence models.

5. Data Protection Officer of the Processor

The Processor confirms that it has appointed a data protection officer in accordance with Art. 37 EU GDPR and, where applicable, Article 37 UK GDPR. The Processor shall ensure that the data protection officer has the necessary qualifications and expertise.

6. Notification obligations of the Processor

(1) The Processor shall inform the Controller immediately of each breach of Applicable Data Protection Law or contractual agreements and/or the Controller's instructions which has occurred during the processing of the data by him or other persons involved in processing the data. The same shall apply to any violation of the protection of personal data which the Processor processes on behalf of the Controller.

(2) Furthermore, the Processor shall inform the Controller immediately if a data protection authority pursuant to Art. 58 EU GDPR or, where applicable, Article 58 UK GDPR, including the UK Information Commissioner's Office ("ICO") is operating against the Processor and this operation may also affect controlling of the processing which the Processor makes on behalf of the Controller.

(3) The Processor is aware that the Controller may be subject to a notification obligation pursuant to Articles 33 – 34 EU GDPR or, where applicable, Articles 33 - 34 UK GDPR and other Applicable Data Protection Law, which may require that notification must be made to the supervisory authority without undue delay and, where applicable, within 72 hours after detection. The Processor shall assist the Controller in implementing the notification obligations. The Processor shall notify the Controller, in particular, of any unauthorized access to personal data processed on behalf of the Controller, without undue delay, but at the latest within 48 hours of knowledge of such access. In particular, the notification of the Processor to the Controller shall include the following information:

• a description of the nature of the breach of the protection of personal data, indicating, as far as possible, the categories and approximate number of data subjects concerned, the categories concerned and the approximate number of personal data sets concerned;

• a description of the measures taken or proposed by the Processor to remedy the breach of the protection of personal data and, where appropriate, to mitigate its potential adverse effects.

7. Processor's obligation of cooperation

(1) The Processor shall assist the Controller in fulfilling his duty to respond to requests for the exercise of rights of the data subjects in accordance with Art. 12-23 EU GDPR and, where applicable, Articles 12-23 UK GDPR. The provisions of section 12 of this Agreement shall apply.

(2) The Processor assists the Controller in compiling the lists of processing activities. The Processor must provide the Controller with the required particulars by suitable means.

(3) Taking into account the type of processing and the information available to him, the Processor shall assist the Controller in complying with the obligations set out in Articles 32-36 EU GDPR and, where applicable, Articles 32–36 UK GDPR, including, where applicable, obligations relating to security of processing, notification of personal data breaches, data protection impact assessments and consultation with the ICO or other competent supervisory authority.

8. Regulation on mobile workstation

(1) The Processor may allow its employees who are commissioned to process personal data for the Controller to process personal data at mobile workstations outside the Processor’s business premises.

(2) The Processor shall ensure that compliance with the contractually agreed technical and organizational measures is also guaranteed when using mobile workstations of the Processor’s employees. Deviations from individual contractually agreed technical and organizational measures must be agreed with the Controller in advance and approved by the Controller in text form.

(3) In particular, the Processor shall ensure that when processing personal data at mobile workstations, the storage locations are configured in such a way that local storage of data on IT systems is excluded. If this is not possible, the Processor shall ensure that local storage is exclusively encrypted and that other persons at the location of the respective mobile workstation do not have access to this data.

(4) The Processor is obliged to ensure that effective control of the processing of personal data on behalf of the Controller at mobile workstations is possible.

(5) If employees are also to be deployed at mobile workstations by subprocessors, the provisions of paragraphs 1 to 4 shall apply accordingly.

9. Supervisory powers

(1) The Controller has the right to monitor compliance with Applicable Data Protection Laws and/or compliance of the regulations agreed between the Parties and/or compliance with the instructions of the Controller by the Processor at any time to the extent necessary.

(2) The Processor shall be obliged to provide the Controller with information to the extent necessary to carry out an inspection in the meaning of paragraph 1.

(3) The Controller may carry out the inspection within the meaning of paragraph 1 at the Processor’s business premises during normal business hours after prior notification with reasonable notice. The Controller shall ensure that the inspections are only carried out to the extent necessary in order not to disproportionately disrupt the Processor’s business operations as a result of the inspections. The parties assume that an inspection is required no more than once a year. Further inspections must be justified by the Controller, stating the reason. In the event of on-site inspections, the Controller shall reimburse the Processor for the expenses incurred, including the personnel costs for the supervision and support of the inspectors on site to an appropriate extent. The basis of the cost calculation shall be communicated to the Controller by the Processor before the inspection is carried out.

(4) As evidence of compliance with the technical and organizational measures set forth in Annex 3, the Controller may, at its discretion, accept suitable, current certificates, reports, or extracts from independent bodies (e.g., auditors, internal audit, data protection officer, IT security department, data protection auditors or quality auditors) or appropriate certifications. If such documentation is not deemed sufficient by the Controller, the Controller shall be entitled to carry out an on-site inspection, or have one carried out by an appointed auditor. The Controller acknowledges that on-site inspections of data centers may not be possible, or only in exceptional and justified cases.

(5) The Processor shall be obliged to provide necessary information to the Controller in case of measures of a supervisory body against the Controller according to Art. 58 EU GDPR or, where applicable, Article 58 UK GDPR, or other Applicable Data Protection Law, especially regarding obligations of information and monitoring and to grant the competent supervisory body on-site inspections. The Processor shall inform the Controller about such relevant intended measures.

(6) The Parties agree that the control measures for the processing of personal data at mobile workplaces to protect the personal rights of other persons at these mobile workplaces shall primarily be carried out by monitoring the measures to be taken by the Processor in accordance with Section 9 (2) and (3). The Controller must also be given the opportunity to monitor the mobile workplaces of employees by the Processor on an ad hoc basis.

10. Subprocessing

(1) The Processor shall be entitled to use the subprocessors specified in Annex 2 to this Agreement for the processing of data on behalf of the Controller. The change of subprocessors or the commissioning of further subprocessors is permitted under the conditions specified in paragraph 2.

(2) The Processor shall carefully select the subprocessors and check before commissioning that the subprocessor can comply with the agreements made between the Controller and the Processor. In particular, the Processor shall check in advance and regularly during the term of the contract that the subprocessor has taken the technical and organizational measures required under Art. 32 EU GDPR and, where applicable, Art. 32 UK GDPR to protect personal data. In the event of a planned change of subprocessors or the planned commissioning of a new subprocessor, the Processor shall inform the Controller in text form in good time, but no later than 4 weeks before the change or new commissioning ("Information"). The Controller shall have the right to object to the change or new assignment of the subprocessor in text form within 2 weeks of receipt of the "Information", stating the reasons. The objection may be withdrawn by the Controller in text form at any time. In the event of an objection, the Processor may terminate the contractual relationship with the Controller with a notice period of at least 14 days to the end of a calendar month. The Processor shall give reasonable consideration to the interests of the Controller in the notice period. If no objection is made by the Controller within three weeks of receipt of the "Information", this shall be deemed to constitute the Controller’s consent to the change or reassignment of the subprocessor concerned.

(4) The Processor shall ensure that the provisions agreed in this contract and any supplementary instructions of the Controller also apply to the subprocessor, including, where applicable, obligations required under the UK GDPR.

(5) The Processor shall conclude a data processing agreement with the subprocessor that meets the requirements of Art. 28 EU GDPR and, where applicable Art. 28 UK GDPR. In addition, the Processor shall impose the same obligations on the subprocessor to protect personal data as are stipulated between the Controller and the Processor. The Controller shall be provided with a copy of the data processing agreement upon request.

(6) In particular, the Processor shall be obliged to ensure by means of contractual provisions that the supervisory powers (Section 9 of this contract) of the Controller and supervisory authorities, including the ICO, where applicable, also apply to the subprocessor and that corresponding supervisory rights of the Controller and supervisory authorities are agreed. It must also be contractually stipulated that the subprocessor must tolerate these control measures and any on-site inspections.

(7) Services which the Processor uses from third parties as a purely ancillary service in order to carry out the business activity are not to be regarded as subprocessing relationships within the meaning of paragraphs 1 to 6. These include, for example, cleaning services, pure telecommunication services with no specific connection to services that the Processor provides for the Controller, postal and courier services, transportation services, security services. The Processor is nevertheless obliged to ensure that appropriate precautions and technical and organizational measures have been taken to ensure the protection of personal data, even in the case of ancillary services provided by third parties. The maintenance and servicing of IT systems or applications constitutes a subprocessing relationship requiring consent and processing within the meaning of Art. 28 EU GDPR if the maintenance and testing concerns IT systems that are also used in connection with the provision of services for the Controller and personal data processed on behalf of the Controller can be accessed during maintenance.

11. Obligation of confidentiality

(1) When processing data on behalf of the Controller, the Processor shall be obliged to maintain confidentiality of data which he receives or obtains in connection with the data processing agreement.

(2) The Processor also warrants that the employees working on the data have been made known to applicable regulations of data protection and that they are bound to maintain data confidentiality.

(3) Proof for such an obligation for the employees pursuant to paragraph 2 must be presented to the Controller on request.

12. Protection of Data Subjects' rights

(1) The Controller is solely responsible for safeguarding data subjects' rights. The Processor is obliged to support the Controller in his duty to process requests from data subjects in accordance with Articles 12-23 EU GDPR and, where applicable, Articles 12-23 UK GDPR. The Processor shall in particular ensure that the information required in this respect is provided to the Controller without delay so that the Controller is able to fulfil his obligations under Article 12 (3) EU GDPR in particular and, where applicable, Article 12 (3) UK GDPR.

(2) As far as a participation of the Processor for the protection of data subjects' rights by the Controller is necessary – especially regarding access, rectification, blocking or deleting –, the Processor will undertake the necessary measures on instruction by the Controller. Where possible, the Processor shall assist the Controller with appropriate technical and organizational measures to fulfil his obligation to respond to requests for the exercise of the data subjects' rights.

(3) Provisions concerning remuneration of additional expenses incurred through participation of the Processor in connection with assertion of data subjects' rights against the Controller remain unaffected.

13. Confidentiality obligations

(1) Both Parties hereby undertake to treat all information received in connection with the processing of this Agreement indefinitely confidential and to use the information only for carrying out the Agreement. No Party has the right to use the information in part or as a whole for other than those mentioned purposes or to make this information available to Third Parties.

(2) The foregoing obligation shall not apply for information that one Party received demonstrably from Third Parties, without being bound by secrecy or which are publicly known.

14. Remuneration

The Processor's remuneration is provided for by way of a separate agreement.

15. Technical and organizational measures for data security

(1) The Processor shall pledge against the Controller to comply with all technical and organizational measures that are required for compliance with applicable data protection regulations. This includes, in particular the dispositions in Art. 32 EU GDPR and, where applicable, Article 32 UK GDPR and the applicable provisions of the Data Protection Act 2018.

(2) The technical and organizational measures as of the time at which this Agreement is made are attached as Annex 3 to this contract. The Parties agree that changes to technical and organizational measures may be required to adapt to technical and legal requirements. The Processor will inform the Controller in advance and within a reasonable period of any material changes affecting the integrity, confidentiality or availability of personal data. The Processor may implement without consulting with the Controller measures that entail only slight technical or organizational changes and that do not negatively affect the integrity, confidentiality or availability of the personal data. The Controller may at any time request an up-to-date version of the technical and organizational measures taken by the Processor.

16. Term of the Agreement

(1) The Agreement shall commence upon signature and shall run for the duration of the main contract existing between the Parties for the use of the Processor’s services by the Controller.

(2) The Controller may terminate the Agreement at any time without notice if the Processor has committed a serious violation of the Applicable Data Protection Law or a breach of duties under this Agreement; the Processor is unable or unwilling to carry out an instruction of the Controller or denies access to the Controller or the competent supervisory authority in breach of the Agreement.

17. Termination

(1) After the Agreement has ended, the Processor shall, at the Controller’s discretion, return to the Controller all documents and data in its possession that relate to the contractual relationship, or shall delete them. The deletion shall be documented in a suitable manner.

(2) The Processor may store personal data that has been processed in connection with the processing relationship beyond the termination of the Agreement if and to the extent that the Processor has a legal obligation to store it. In these cases, the data may only be processed for the purpose of implementing the respective legal storage obligations. After the storage obligation has expired, the data must be deleted immediately.

18. Final Provisions

(1) Should the property of the Controller be at risk at the Processor through measures of Third Parties (especially confiscation or seizure of property), by insolvency proceedings or other events, the Processor must inform the Controller immediately. The Processor will inform creditors immediately about the fact that the data are processed on behalf of the Controller.

(2) Written form is compulsory for ancillary agreements.

(3) Should individual parts of this Agreement be invalid, the validity of the Agreement’s other provisions will not be affected thereby.

Annex 1 – Subject matter of the Agreement

1. Subject matter, purpose and duration of the processing

The subject matter of the processing is mainly set out in the Agreement.

Jamie is an AI-based meeting assistant that records, transcribes and summarises both offline and online meetings. The aim of the processing is to efficiently document meetings and support participants with structured summaries. The processing takes place in several steps: First, during meetings the audio is captured and streamed in real time to the transcription provider (Soniox) for conversion into text form (transcripts) using AI-supported speech processing. The transcripts are then analysed by the AI to identify important points and create comprehensible and structured summaries.

No audio recordings are created or retained. If the Controller activates the optional ‘Speaker Memory’ function, the Processor creates and stores voiceprints (biometric data for speaker recognition) for the purpose of identifying participants in future meetings; otherwise, no such profiles are stored.

No persistent audio recordings are created or retained. If the Controller activates the optional 'Speaker Clips' feature, short audio snippets (approximately 1-3 seconds) are stored temporarily for the sole purpose of enabling the user to identify and assign speakers after the meeting. Speaker Clips can be deactivated at workspace level by the Controller. When deactivated, no audio data of any kind is stored.

In addition, meeting metadata (e.g. time and date), names and email addresses of participants (if available), IP addresses and device information are processed. Sensitive data may be incidentally collected if it is discussed in meetings, but it is not specifically processed. The data subjects are primarily meeting participants, including employees, customers and external end users. Jamie uses AI to automatically create the transcriptions and accurately summarise content. The technology used is based on machine learning (NLP technologies), which recognises important points from the transcripts and generates summaries. In addition, ‘voice embeddings’ are used to automatically identify and assign speakers.

The data processing takes place in several steps: First, the user starts a meeting in Jamie, and during the meeting the audio is streamed in real time directly to the transcription provider, where a text version is created without any audio being stored. Using AI systems, the transcripts are analysed to extract important content and create a structured summary. The transcripts and the summaries are then stored in an EU region-managed database (Planetscale). The user can access the created transcripts and summaries later.

2. Type(s) of personal data

The following data types are the subject of this order:

• Personal master data (surname, first name, position in the company)

• Communication data (email address, IP address)

• Usage data (logins, browser type, access times, meeting metadata, events in the product)

• Technical data (device information, error logs, API calls, server logs)

• Support and service data (support tickets, correspondence, information on problem solving)

• Audio data (streamed in real time to the transcription provider, not stored)

• Speaker Clips (short audio snippets of approximately 1-3 seconds per speaker, stored only if the Controller activates the 'Speaker Clips' feature; used solely for post-meeting speaker identification and deletable at any time)

• Transcriptions and meeting summaries

• Voiceprints for speaker recognition (biometric data within the meaning of Art. 9(1) EU GDPR and, where applicable, Article 9 UK GDPR; processed only if the customer activates the 'Speaker Memory' function). Speaker Clips (as described above) are distinct from Speaker Memory and do not constitute biometric data, as they are not used for unique identification across meetings.

Special categories of personal data (e.g. health data, data on racial/ethnic origin) may be processed as part of the data processing agreement if they are part of the audio captured during a meeting. Where the UK GDPR applies, this includes special categories of personal data as defined under Article 9 UK GDPR.

3. Categories of data subjects

The following groups of data subjects are subject to the processing:

• Employees of the client/controller

• Customers of the client/controller

• Suppliers of the client/controller

• Shareholders of the client/controller

Annex 2 – Subprocessors

For the processing of data on behalf of the Controller, the Processor uses the services of Third Parties who process data on behalf of the Processor ("subprocessors").

These companies are:

Annex 3 – Technical and organizational measures

The Processor shall undertake the following technical and organizational measures for data security in accordance with Art. 32 EU GDPR and, where applicable, Article 32 UK GDPR.

1. Confidentiality

1.1. Physical Access Control

This category covers measures to prevent unauthorized physical access to areas where sensitive data is stored or processed.

Technical measures

• Access Control System

• Manual Secure Locking system

• Blocking external interfaces such as USB

• Chip card/transponder locking system

Organizational measures

• Information security policy

• Maintenance personnel mandated to be committed to data privacy

• Key control system

• Careful selection of cleaning personnel

1.2. Logical Access Control

This category involves measures that restrict unauthorized access to digital systems and data, ensuring that only authorized individuals can access sensitive information and resources.

Technical measures

• Authentication via directory services (Single sign-on)

• Multi-Factor Authentication (MFA) mandatory for critical systems

• Automatic logoff procedures

• Disk Encryption for all devices

• Encryption of databases

• Authentication with username and password

Organizational measures

• Password Management System

• Password policies enforcing minimum length and complexity requirements

• Mobile Device Management Policy

• User Permission Management / Privileged Access Management systems

• Separate user account for each employee (with individual user IDs)

• Documented regulations for when employees leave

• Creation of user profiles

1.3. Authorization Control

This category focuses on ensuring that those authorized to use a data processing system can only access the data subject to their access authorization, with controls in place to manage and limit access rights, prevent unauthorized use and securely handle sensitive data.

Technical measures

• Secure deletion of data carriers

• Automatic account blocking after multiple wrong inputs of a password

• Logging of application access

Organizational measures

• Assignment of administrator rights to a minimum number of persons

• Implementation of a role and authorization concept

• Issuing written instructions on the processing of personal data

• Obligation of employees to comply with the requirements of the EU GDPR and, where applicable, the UK GDPR

1.4. Separation Control

This category ensures that data and systems are kept isolated from one another where necessary, minimizing the risk of data leaks.

Technical measures

• Separation of production and test system

• Physical separation of databases and systems

• Network segmentation

Organizational measures

• Data Protection Policy

• Secure Coding Practices

• Logical user separation

• Database access rights

• Internal policy to anonymize / pseudonymize data if possible

1.5. Pseudonymization

This category involves the process of replacing identifiable information with pseudonyms, ensuring that personal data cannot be attributed to a specific individual without additional information. Pseudonymization enhances data privacy by reducing the risk of exposure while still allowing data to be processed and analyzed.

Technical measures

• Pseudonymization of data during further processing or transmission

Organizational measures

• Anonymization of data when identification is no longer necessary

2. Integrity

2.1. Transfer Control

This category focuses on ensuring the integrity and security of data during transmission. It includes measures that protect data from unauthorized access, modification, or loss while being transferred between systems or parties, ensuring that data remains unchanged throughout the process.

Technical measures

• Content-encrypted data transmission

• Encryption of internet traffic

• Encryption for e-mail transmission

2.2. Input Control

This category ensures the accuracy and integrity of data during input, modification, and access. It includes measures to track and log all data entries and changes, secure the data from unauthorized modifications, and allow corrections when necessary. These measures are necessary to keep the data accurate and consistent throughout its lifecycle while providing transparency and accountability.

Technical measures

• Certificate-based authentication of data source

• Logging (of data access, entry, change, deletion, transmission, failed access attempts, etc.)

• Automated evaluation of log data

• Firewall packet filter

• Application layer firewall

• E-mail gateway with a filter function

• Manual or automated reviews of logs

Organizational measures

• Documentation on existing IT infrastructure

• Documentation of the security measures taken

• Documentation on programs and applications used

• Documentation of binding deletion periods

• Documentation of contract and subcontract relationships

• Documentation of the nature, scope, circumstances, and the purposes of the processing

• Documented records of processing activities

3. Availability and Resilience

3.1. Availability Control

This category focuses on ensuring that data and systems are consistently accessible and operational when needed, preventing downtime and protecting against data loss or system failures.

Technical measures

• Automatic notification system in case of failure

• Redundant IT systems

• Automatic scaling of virtual systems

• Load balancing of the network components / servers / services

Organizational measures

• Documented contingency (emergency) plan

3.2. Recoverability Control

This category ensures that data and systems can be quickly restored to full functionality after an incident.

Technical measures

• Automated creation of data backups

• Backup monitoring

Organizational measures

• Backup concept and disaster recovery plan

• Defined responsibilities for data backup

• Regular testing of data recovery

• Storage of data backups in another secure compartment outside the server room

4. Procedures for regular Review

4.1. Data Protection Management

This category includes procedures and documentation necessary to ensure ongoing compliance with data protection regulations and allow data protection to remain integrated into the company’s operations, risk management, and decision-making processes.

Technical measures

• Data Protection documentation is centralized and available to all employees

Organizational measures

• Data Protection Impact Assessment

• Regular audits of the data scope

• Regular Security certifications review

• Regular TOMs review

• Data Protection Officer appointed

• Regular data privacy and awareness staff training

• Documented processes regarding information obligations

• Formalized processes for information requests from data subjects

4.2. Incident Response Management

This category involves the ongoing evaluation and improvement of the processes and protocols in place to respond to data breaches and security incidents.

Technical measures

• Automated update processes for operating systems, applications, and services

• Intrusion Prevention System

Organizational measures

• Documented post-incident review procedure

• Documented processes for security incident reporting

• Documented incident response procedure

• Documented Data Breach Notification procedure

4.3. Data Protection by Design and Default

This category ensures that data protection is integrated into the design and operation of systems and processes from the outset.

Technical measures

• Using enhanced privacy and security settings by default in software

Organizational measures

• Regular perimeter analysis for web applications

• Regular Development Security Checks

4.4. Third-Party Management and Data Processing Control

This category covers the monitoring and management of external parties involved in data processing. It includes measures that ensure that outsourcing arrangements maintain the necessary levels of data protection and security.

Technical measures

• Monitoring of subcontractors and external parties’ remote accesses

Organizational measures

• Data Processing Agreements