English
Deutsch
Español
Français
Italiano
between
Client (as defined in the order form)
- hereinafter referred to as Client -
Luminovo Inc.
1111B S Governors Ave STE 28082 Dover DE 19904
- hereinafter referred to as "Processor" -
- each a "Party" and collectively the "Parties" -
This DPA is incorporated into and forms an integral part of the main agreement for services between the Parties (the "Agreement").
1. General
The Processor processes personal data on behalf of the Client. This processing is subject to Applicable Data Protection Laws, including where applicable Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR", in particular Art. 28), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and relevant provincial laws like Quebec Law 25. "Personal Data" as used herein shall encompass 'personal data' under GDPR, 'personal information' under CCPA/CPRA and PIPEDA, or similar terms under Applicable Data Protection Laws. This agreement ("DPA") regulates the rights and obligations of the parties in connection with the processing of Personal Data. It forms an integral part of the main agreement for services between the Parties (the "Agreement"). In case of conflict between the Agreement and this DPA regarding data protection matters, this DPA shall prevail.
The terms "data processing" and "processing" (of data) used in this agreement are based on the "processing” definition within the meaning of Art. 4 No. 2 GDPR, and shall be interpreted broadly to encompass similar activities regulated under other Applicable Data Protection Laws.
2. Subject matter of the contract
The subject matter of the processing, the nature and purpose of the processing, the duration of the processing, the types of personal data, and the categories of data subjects/consumers are set out in Annex 1 of this contract.
3. Rights and Obligations of the Client
The Client, acting as Controller or Business, is responsible for the lawfulness of the data processing on behalf of the Processor under Applicable Data Protection Laws, including having a valid legal basis and providing necessary notices. If the Processor is of the opinion that legally inadmissible data processing is the subject of the order and/or of an instruction from the Client, the Processor has the right and obligation to notify the Client about it pursuant to clause 4.5.
The Client is responsible for safeguarding the rights of the data subjects/consumers under Applicable Data Protection Laws. The Processor will promptly inform the Client if data subjects/consumers approach the Processor directly to assert their rights relating to the Personal Data processed under the Agreement. The notification enables the Client to act as the responsible party.
The Client has the right at any time to give the Processor additional instructions about the type, scope and process of the data processing. Instructions must be given in text form (e.g. e-mail).
Arrangements on any remuneration of additional work incurred by the Processor due to additional instructions given by the Client shall remain unaffected, unless such instructions are required to comply with Applicable Data Protection Laws or this DPA, in which case they do not represent any additional expense unless otherwise specified herein (e.g., in Sec. 6 or 7).
The Client may appoint persons authorised to issue instructions. Insofar as persons authorised to issue instructions are to be named, they shall be named in Annex 1. In the event that the persons authorised to issue instructions change at the Client, the Client shall inform the Processor of this in text form.
If the Client identifies mistakes or irregularities in regard to the personal data processing by the Processor, the Client informs the Processor without hesitation.
The Client is responsible for compliance with any statutory notification obligations towards supervisory authorities or data subjects/consumers regarding Security Incidents (e.g., pursuant to Art. 33, 34 GDPR or similar requirements under other Applicable Data Protection Laws). The Processor shall assist the Client pursuant to Section 5.3..
4. General obligations of the Processor
The Processor shall process Personal Data exclusively within the framework of the documented lawful instructions issued by the Client as set forth in the Agreement and this DPA (the "Business Purpose"), unless required to do otherwise by applicable law to which the Processor is subject. In such case, the Processor shall inform the Client of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
Processor certifies it understands and will comply with the following restrictions under CCPA/CPRA where applicable: Processor shall not (a) "sell" or "share" (as defined by CCPA/CPRA) the Personal Data; (b) retain, use, or disclose the Personal Data for any purpose other than the Business Purpose, including for any commercial purpose other than the Business Purpose, or as otherwise permitted by CCPA/CPRA; (c) retain, use, or disclose the Personal Data outside the direct business relationship between the Parties; (d) combine Personal Data received from the Client with Personal Data received from other sources, except as necessary to perform the Business Purpose or as permitted by CCPA/CPRA regulations.
The Processor undertakes to generally carry out the data processing primarily within the United States. Processing may also occur in member states of the European Union (EU) or the European Economic Area (EEA) by authorized Sub-processors (e.g., Luminovo GmbH in Germany, see Annex 2). The processing of Personal Data in any other non-member country (third country) is only permissible if the requirements for international data transfers under Applicable Data Protection Laws are met. Where GDPR applies, this requires compliance with Art. 44/49 GDPR, which the Parties agree to achieve through the use of Standard Contractual Clauses (SCCs) as incorporated by reference herein (Module Two or Three as applicable), unless another valid transfer mechanism applies. Processor remains accountable for data transferred to Sub-Processors under PIPEDA.
In the area of the processing of personal data in accordance to the order, the Processor assures the implementation of the technical and organizational measures agreed upon (see Section 13 and Annex 3).
The Processor shall organise its internal organization and operating procedures in such a way that they ensure the security and confidentiality of the Personal Data it processes on behalf of the Client, including protection against unauthorised access by third parties. The Processor shall coordinate significant changes in the organisation of the data processing which are likely to impact the security of the data with the Client reasonably in advance where feasible. Processor shall implement and maintain appropriate technical and organizational measures (TOMs) as detailed in Section 13 and Annex 3.
The Processor shall inform the Client without undue delay if, in its opinion, an instruction issued by the Client infringes Applicable Data Protection Laws. The Processor shall be entitled to suspend the implementation of the relevant instruction until it is confirmed or amended by the Client after consultation.
The Processor shall process the Personal Data which it processes on behalf of the Client logically separated from other data. Physical separation is not mandatory unless specified in Annex 3.
The Processor may designate to the Client the person(s) authorised to receive instructions from the Client. If persons authorised to receive instructions are to be named, they shall be named in Annex 1. In the event that the persons authorised to receive instructions change at the Processor, the Processor shall notify the Client thereof in text form.
5. Reporting obligations of the Processor
The Processor shall be obliged to immediately inform the Client without undue delay of any Security Incident involving Personal Data processed under this DPA, or any material violation of data protection regulations or the agreements made herein or the Client's instructions.
Furthermore, the Processor shall inform the Client without undue delay if a data protection supervisory authority takes action against the Processor regarding the processing performed under this DPA.
The Processor is aware that the Client may have a reporting obligation in the event of Security Incidents pursuant to Applicable Data Protection Laws (e.g., Art. 33, 34 GDPR). The Processor shall support the Client in implementing these reporting obligations by notifying the Client of any confirmed Security Incident involving Personal Data processed on behalf of the Client without undue delay, and at the latest within [e.g., 48] hours of becoming aware. The Processor's notification to the Client shall, as far as possible and available, include the following information:
a description of the nature of the Security Incident, including, where possible, the categories and approximate number of data subjects/consumers concerned, and the categories and approximate number of personal data records concerned;
a description of the likely consequences of the Security Incident;
a description of the measures taken or proposed to be taken by the Processor to address the Security Incident and, where appropriate, measures to mitigate its possible adverse effects.
contact point details where more information can be obtained.
6. Obligations of the Processor to cooperate
The Processor shall reasonably support the Client in its obligation to respond to requests for the exercise of data subject/consumer rights pursuant to Applicable Data Protection Laws (including but not limited to Art. 12-23 GDPR, CCPA/CPRA rights, PIPEDA access/correction rights). Support services that go beyond what is reasonable under the scope of the Agreement may be remunerated separately by the Client, subject to mutual agreement. The provisions of Section 10 of this contract regarding direct requests may also apply.
The Processor shall support the Client in complying with its obligations relating to data security, data protection impact assessments (DPIAs), risk assessments, and prior consultations with supervisory authorities as set out in Applicable Data Protection Laws (including but not limited to Art. 32-36 GDPR, CCPA/CPRA, PIPEDA, Quebec Law 25), taking into account the nature of processing and the information available to the Processor. Support services that go beyond what is reasonable shall be remunerated separately by the Client, subject to mutual agreement.
7. Powers of control
The Client accepts that proof of compliance with statutory and contractual obligations shall primarily be provided by submitting suitable, up-to-date attestations or certificates from independent third parties (e.g., ISO 27001).
The Processor shall be obliged to provide the Client with information reasonably necessary to demonstrate compliance with this DPA and Applicable Data Protection Laws.
If such evidence is insufficient or there is reasonable suspicion of a data protection violation, the Client may verify compliance through an on-site inspection during normal business hours, announced with reasonable prior notice in text form. The Processor shall assist and may refuse access to competitors. The costs of the inspection shall be borne by the Client.
The Processor shall be obliged to provide the Client with necessary information and to enable inspections by the Client or competent supervisory authorities as required under Applicable Data Protection Laws (e.g., Art. 58 GDPR). The Client also has the right under CCPA/CPRA to take reasonable and appropriate steps to help ensure that the v uses the personal information transferred in a manner consistent with the Client's obligations under the CCPA/CPRA, which may include audits and inspections.
8. Subcontracting relationships
The Processor shall specify all Sub-processor relationships engaged for the Processing of Personal Data under this Agreement in Annex 2. The Sub-processors listed in Annex 2 as of the effective date shall be deemed to have been approved by the Client. Client specifically approves the use of Luminovo GmbH, Germany) as a Sub-processor.
The use of further Sub-processors or the replacement of existing Sub-processors is permissible if the Processor informs the Client of the intended change in writing (e-mail is sufficient) at least [e.g., 30] days beforehand and gives the Client the opportunity to object to the change on reasonable data protection grounds in writing within [e.g., 14] days of receiving the notice. If no objection is made within this period, the change shall be deemed approved. The legal consequence of this fictional approval shall be pointed out to the Client upon notification. If the Client objects, the Parties will discuss in good faith to find a resolution.
When subcontracting, the Processor shall contractually ensure via a written agreement that data protection obligations at least equivalent to those set out in this DPA (including relevant CCPA/CPRA restrictions and GDPR Art. 28(4) requirements) are imposed on the Sub-processors, providing sufficient guarantees that appropriate technical and organisational measures are implemented in accordance with Applicable Data Protection Laws.
The Processor shall carefully select the Sub-processor and check before commissioning that the Sub-processor is able to comply with the agreements made. The Processor shall check that the Sub-processor has taken the technical and organisational measures required under Applicable Data Protection Laws (e.g., Art. 32 GDPR, CCPA/CPRA reasonable security) to protect Personal Data. Processor remains fully liable to the Client for the performance of its Sub-processors.
Services which the Processor uses from third parties as a purely ancillary service (e.g., cleaning, pure telecommunication, postal, transport, guarding services) without intended processing of Personal Data are not regarded as subcontracting relationships requiring approval under this section. The Processor shall nevertheless ensure appropriate precautions for the protection of Personal Data. Maintenance and servicing of IT systems involving potential access to Personal Data is considered subcontracting under this section.
9. Confidentiality obligation
When processing data for the Client, the Processor shall be obliged to maintain confidentiality about Personal Data it receives in connection with the order.
The Processor warrants that it has familiarised its employees and personnel authorized to process Personal Data with the applicable data protection provisions and has obliged them to maintain confidentiality (or they are under an appropriate statutory duty of confidentiality).
The Processor's employees' and personnel's obligation to maintain confidentiality and protect data secrecy shall continue after the termination of their employment or engagement.
The Processor must be able to show proof of its employees' and personnel's confidentiality obligation upon reasonable request by the Client.
10. Protection of data subject’s rights
The Client exclusively is responsible for the protection of the data subject's/consumer's rights under Applicable Data Protection Laws. The Processor is obliged to reasonably support the Client in its responsibility to handle requests of data subjects/consumers exercising their rights (e.g., under Art. 12-23 GDPR, CCPA/CPRA, PIPEDA). The Processor shall especially provide necessary information to the Client without undue delay to enable the Client to fulfil its response obligations (e.g., within the meaning of Art. 12 para. 3 GDPR).
Insofar as the cooperation of the Processor is necessary for the protection of data subject/consumer rights - in particular regarding access, information, correction, blocking or deletion - by the Client, the Processor shall take the necessary measures reasonably available to it in accordance with the Client's documented lawful instructions. Where possible and appropriate, the Processor shall support the Client with suitable technical and organisational measures to fulfil its obligation to respond to requests.
This shall be without prejudice to any provisions on the remuneration of additional reasonable expenses incurred by the Processor as a result of cooperation services under this Section 10, as may be agreed pursuant to Section 6.3.
In the event that a data subject/consumer asserts his or her rights with the Processor directly, although this concerns processing for which the Client is responsible, the Processor is entitled (and should endeavor) to inform the data subject/consumer that the Client is the responsible party (Controller/Business) and may provide the Client's contact details if appropriate and lawful. Processor shall promptly forward the request to the Client.
11. Confidentiality obligations (Non-Personal Data)
Both parties agree to treat all non-public information related to the conclusion and execution of this contract (other than Personal Data, which is governed by Section 9 and other provisions herein) as confidential and to use the information only for the execution of the contract. Neither party is entitled to use this information, in whole or in part, for purposes other than those just mentioned or to make this information available to third parties, unless required by law or necessary for contract execution (provided recipients are bound by confidentiality).
The obligation neither applies to information that (a) was already lawfully known to the receiving party; (b) is or becomes publicly known through no fault of the receiving party; (c) is independently developed by the receiving party; or (d) is lawfully received from a third party without restriction.
12. Remuneration
Regulations on the remuneration of services and support services are to be agreed upon separately between the parties.
13. Technical and organisational measures to ensure data security
The Processor guarantees to implement and maintain appropriate technical and organisational measures (TOMs) necessary to comply with Applicable Data Protection Laws, including Art. 32 GDPR and the requirement for reasonable security under CCPA/CPRA and PIPEDA Principle 4.7.
The current state of technical and organisational measures is attached to the agreement in Annex 3. The parties agree that adjustments due to technical and legal developments might be required. The Processor shall inform the Client reasonably in advance (e-mail is sufficient) about substantial changes that materially affect the integrity, confidentiality, or availability of Personal Data. Measures that only entail minor technical or organisational changes and do not negatively affect the overall security may be implemented by the Processor without notifying the Client.
The Processor shall regularly control the implemented technical and organisational measures for effectiveness and appropriateness and shall optimise them as necessary.
14. Duration of the order
This DPA begins upon the effective date of the Agreement and is concluded for the duration of the Agreement.
In the event of cancellation or termination of the preceding service contract (the "main contract"), this DPA shall automatically end at the same time. Isolated cancellation of this DPA without simultaneous termination of the main contract is excluded, unless required by law.
15. Termination
After termination or expiration of the Agreement, the Processor shall, at the Client's choice and instruction, return or securely delete all Personal Data (including copies) created or received in connection with the Agreement. The deletion shall be documented in a suitable manner upon request. Any statutory retention obligations or other legal obligations to store the data shall remain unaffected (subject to clause 15.2).
The Processor may store Personal Data beyond the termination of the contract only if and to the extent that the Processor has a legal obligation to retain it. In such cases, the data may only be processed for the purpose of implementing the respective statutory retention obligations and must be kept confidential. After the expiry of the retention obligation, the data must be deleted immediately and securely.
16. Final provisions
Should the Client's data held by Processor be jeopardised by third party measures (such as seizure or confiscation), insolvency proceedings or other events, the Processor shall inform the Client immediately. The Processor shall immediately inform the creditors or relevant third parties of the fact that the data in question is owned by the Client and is being processed on behalf of the Client.
Additional agreements or amendments to this DPA must be made in writing (e-mail does not suffice unless explicitly stated otherwise herein).
Should individual parts of this contract be invalid or unenforceable, this shall not affect the validity of the remaining provisions of the contract. The parties shall endeavor to replace the invalid provision with a valid one that achieves the original economic and legal purpose.
Governing Law and Order of Precedence: This DPA shall be governed by the laws designated in the main Agreement. In the event of conflict, the order of precedence shall be: (1) applicable Standard Contractual Clauses, (2) this DPA, (3) the main Agreement. Mandatory provisions of Applicable Data Protection Laws shall always apply. ORT/ PLACE: DATUM/ DATE: ORT/ PLACE: DATUM/ DATE:
Annex 1 – Subject of the order
1. Subject, nature and purpose of processing
The Client's order to the Processor shall include the following work and/or services:
The Processor processes personal data in order to smoothly grant access to an online platform for order and process optimisation. The personal data is processed in order to be able to assign possible changes in the platform to individual persons who have been granted access to the platform by the Client.
2. Type(s) of personal Data
The following types of data are regularly subject to processing:
Title, first and last name, e-mail address, address, cell phone number, telephone number, fax number, comments on customer satisfaction, first and last name of the contact person, VAT ID and profile picture (optional).
3. Categories of data subject
Group of persons affected by the data processing:
Employees and customers of the Client.
Annex 2 – Subcontractor
For the processing of data on behalf of the Client, the Processor (Luminovo Inc.) shall use the services of third parties who process data on its behalf ("subcontractors").
These are the following companies:
| Name | Address | Order Content |
|---|---|---|
| Luminovo GmbH | Schellingstr. 29, 80799 Munich, Germany | Provision of platform infrastructure elements, hosting coordination (via Azure), software development, technical support. |
| Amplitude Inc. | 201 3rd Street, Suite 200 San Francisco, CA 94103, United States | Tracking of user behaviour and product analytics data to analyse and improve the product |
| Auth0, Inc. | 100 First Street, Floor 6 San Francisco, CA 94105, United States | Autorisierung der Logins der Benutzerkonten/ Authorisation of user account logins |
| Cloudflare, Inc. | 101 Townsend Street, San Francisco, CA 94107, United States | Operation of the backend for the MCP interface and the apps, and of an isolated execution environment (sandbox) for automatically generated code |
| HelpHero (Cloudling Ltd.) | Cloudling Limited, 4 Kapanui Street, Warkworth 0910, New Zealand | Product tours to introduce the user to the product and to new functions |
| Honeycomb | 548 Market St #25362 San Francisco, CA 94104, United States | Logging of observability data to identify and fix performance problems of the product |
| Intercom, Inc. | 55 2nd Street, Suite 400 San Francisco, CA 94105, United States | Tracking of user behaviour and product analytics data to analyse and improve the product |
| June, Inc. | 1111B S Governors Ave, Suite 6491, Dover DE 19904, United States | Tracking of user behaviour and product analytics data to analyse and improve the product |
| MagicBell | Magic Bell, Inc. 2261 Market Street #4311 San Francisco, CA 94114 United States | Sending notifications in the Software |
| Microsoft Deutschland GmbH | Microsoft Deutschland GmbH, Friedrich-Ebert-Anlage 49, 60308 Frankfurt, Germany | Storage of personal data and documents (via Azure Blob Storage and Azure Database for PostgreSQL |
| Segment.io, Inc. | Twilio Inc. 101 Spear St FL 5 San Francisco, CA 94105, United States | Routing of user behaviour and product analytics data to analyse and improve the product |
| SendGrid (Twilio Inc.) | Twilio Inc. 101 Spear St FL 5 San Francisco, CA 94105, United States | Sending automated email notifications |
| Sentry (Functional Software Inc.) | Functional Software Inc. 45 Fremont Street, 8th Floor San Francisco, CA 94105, United States | Identification, monitoring, and alert of errors, bugs, and other performance issues in the software to improve the product |
| Stripe, Inc. | 354 Oyster Point Blvd South San Francisco, CA 94080, United States | Payment processing provider |
| Vercel, inc. | 201 Mission Street, Suite 300, San Francisco, CA 94105 | Cloud hosting and deployment platform used to host and serve updated versions of our application. Vercel hosts the web application and delivers it to users’ browsers, and may therefore process personal data contained in requests made by users accessing the application (e.g. IP addresses, usage/log data, and any data submitted while using the hosted application). |
Annex 3 – Technical and organisational measures of the Contractor Subcontractor
The Processor shall take the following technical and organisational measures for data security within the meaning of Applicable Data Protection Laws, including Art. 32 GDPR, and meeting reasonable security requirements under laws such as CCPA/CPRA and PIPEDA.
1. Confidentiality (Art. 32(1) GDPR)
a.Access control
Measures suitable for preventing unauthorised persons from gaining access to data processing systems with which personal data are processed or used.
Access control measures can be used to secure buildings and rooms include automatic access control systems, to use chip cards and transponders, to control access by gatekeepers and alarm systems. Servers, telecommunications systems, network technology and similar equipment should be protected in lockable server cabinets. In addition, it makes sense to support access control through organisational measures (e.g. service instructions that provide for the locking of service rooms during absences).
Technical measures
Automatic access control system
Manual locking system
Doors with knob outside
Organisational measures
Visitors accompanied by staff
Regular checks of access authorisations
Role-based access and minimisation of access rights
Access to the servers is controlled by the hosting provider Microsoft Azure. Information on physical security is described at the following URL:
https://learn.microsoft.com/en-us/azure/security/fundamentals/physical-security
b.Access control
Measures suitable for preventing data processing systems (computers) from being used by unauthorised persons.
Access control refers to the unauthorised prevention of the use of equipment. Possibilities are, for example, boot password, user ID with password for operating systems and software products used, screen saver with password, the use of chip cards for logging in as well as the use of call-back procedures. In addition, organisational measures may also be necessary, for example, to prevent unauthorised access (e.g. specifications for setting up screens, issuing guidance to users on how to choose a "good" password).
Technical measures
Login with username + password
Login with biometric data
Firewall
Intrusion detection systems
Encryption of data carriers
Automatic desktop lock
Encryption of notebooks / tablet
Organisational measures
Manage user permissions
Clean desk" policy
c.Access control
Measures to ensure that those authorised to use a data processing system can only access the data subject to their access authorisation and that personal data cannot be read, copied, modified or removed without authorisation during processing, use and after storage.
Access control can be ensured, among other things, through suitable authorisation concepts that enable differentiated control of access to data. In doing so, it is important to differentiate both the content of the data and the possible access functions to the data.
Furthermore, suitable control mechanisms and responsibilities must be defined in order to document the granting and withdrawal of authorisations and to keep them up to date (e.g. in case of hiring, change of job, termination of employment). Special attention must always be paid to the role and possibilities of the administrators.
Technical measures
Physical deletion of data carriers
Logging of access to applications, specifically at the time of entry, Datenverfügbarkeitmodification and deletion of data
Organisational measures
Privacy vault
Management of user rights by Administrators
Regular checks of access authorisations
Role-based access and minimisation of access rights
d.Separation control
Measures to ensure that data collected for different purposes can be processed separately.
Technical measures
Separation of productive and test environment
Physical separation (systems/databases/data carriers)
Multi-Client capability of relevant applications
Organisational measures
Control via authorisation concept
Definition of database rights
Data records are provided with purpose attributes
e.Pseudonymisation (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR)
Personal data shall be processed in such a way that the data can no longer be attributed to a specific data subject without recourse to additional information, provided that such additional information is kept separately and is subject to appropriate technical and organisational measures.
Technical measures
In case of pseudonymisation: separation of the assignment data and storage in separate and secured systems.
Organisational measures
Internal instruction to anonymise / pseudonymise personal data as far as possible in the event of transfer or after expiry of the statutory deletion period.
2. Integrity (Art. 32 para. 1 lit. b GDPR)
a.Transfer control
Measures to ensure that personal data cannot be read, copied, altered or removed by unauthorised persons during electronic transmission or during their transport or storage on data media, and that it is possible to verify and establish to which bodies personal data are intended to be transmitted by data transmission equipment.
Encryption techniques and virtual private networks can be used to ensure confidentiality in electronic data transmission. Measures to be taken while transporting or forwarding data carriers are transport containers with locking devices and regulations for data protection-compliant destruction of data media.
Technical measures
Email encryption
Provision via encrypted connections such as sftp, https
Organisational measures
Disclosure in anonymised or pseudonymised form
b.Input control
Measures to ensure that it is possible to check and establish retrospectively whether and by whom personal data have been entered into, modified or removed from data processing systems.
Input control is achieved through logging, which can take place on different levels (e.g. operating system, network, firewall, database, application). It must also be clarified which data is logged, who has access to logs, by whom and on what occasion/at what time these are checked, how long storage is required and when deletion of the logs takes place.
Technical measures
Technical recording of the entry, modification and deletion of data
Organisational measures
Overview of which programmes can be used to enter, change or delete which data
Traceability of entry, modification and deletion of data through individual user names (not user groups)
Allocation of rights to enter, change and delete data on the basis of an authorisation concept
Retention of forms from which data has been transferred to automated processes
3. Availability and resilience (Art. 32(1)(b) & (c) GDPR)
a.Availability control
Measures that ensure that personal data is protected against accidental destruction or loss. This includes topics such as an uninterruptible power supply, air conditioning, fire protection, data backups, safe storage of data media, virus protection, raid systems, disk mirroring, etc.
Technical measures
Fire and smoke detection systems
Organisational measures
Separate partitions for operating systems and data
Automatic backups are created at least every four hours and stored for up to seven days in a zone-redundant storage (ZRS). Special note: Luminovo uses the services of Microsoft Azure with storage location Frankfurt a. Main, Germany (managed via Luminovo GmbH). All information on the data centre, data protection and data security is described at the following URL.
https://learn.microsoft.com/en-us/azure/security/fundamentals/physical-security
4. Procedures for regular review, assessment and evaluation (Art. 32(1)(d) GDPR; Art. 25 GDPR)
a.Data protection management
Technical measures
Central documentation of all procedures and regulations on data protection with access for employees according to need / authorisation (e.g. wiki, intranet)
Organisational measures
data protection officer Naima Ress
Employees trained and committed to confidentiality/data secrecy
Regular sensitisation of employees (at least annually)
The organisation complies with the information obligations pursuant to Art. 13 and 14 GDPR
b.Incident-Response-Management
Support in responding to security
breaches Technical measures
Use of firewall and regular updating
Use of spam filter and regular updating
Organisational measures
Documented procedure for dealing with security incidents
Documentation of security incidents and data breaches e.g. ticket system
Data protection-friendly default settings (Art. 25 (2) GDPR)
Privacy by design / Privacy by default
Technical measures
No more personal data is collected than is necessary for the respective purpose
Simple exercise of the data subject's right of withdrawal through technical measures
c.Contract control (outsourcing to third parties)
Measures that ensure that personal data processed on behalf of the Client can only be processed in accordance with the Client's instructions.
In addition to data processing on behalf, this point also includes the performance of maintenance and system support services both on site and via remote maintenance. If the Contractor uses service providers in the sense of commissioned processing, the following points must always be regulated with them.
Organisational measures
Prior review of the security measures taken by the Contractor and their documentation.
Selection of the Contractor under due diligence aspects (especially with regard to data protection and data security).
Conclusion of the necessary agreement on commissioned processing with the guarantees on data transfers to third countries, if applicable.
Obligation of the Contractor to follow instructions
Obligation of the Contractor employees to maintain data secrecy
Obligation to appoint a data protection officer by the Contractor if there is an obligation to appoint one.
Agreement on effective control rights towards the Contractor
Regulation on the use of further subcontractors
Ensuring the destruction of data after termination of the contract.
In the case of longer cooperation: Ongoing review of the Contractor and its level of protection.