TECHNICAL AND ORGANISATIONAL MEASURES

Introduction

1. 1. Controller
      The controller according to Art. 4 No. 7 EU General Data Protection Regulation (DSGVO) is HubDo Aps, Ribegade 17, 02tv, 2100 Copenhagen, Denmark, e-mail: gdpr@hubdo.com. We are legally represented by Peter Nicholls (Founder & CEO).
   2. Data protection officer
      Our Data Protection Officer is Pete Nicholls as above‍
   3. Subject of the document
      This document summarizes the technical and organizational measures taken by the controller within the meaning of Article 32 (1) of the GDPR. These are measures with which the controller protects personal data. The purpose of the document is to support the controller in fulfilling its accountability obligations under Art. 5 (2) GDPR.
2. Confidentiality (Art. 32 para. 1 lit. b DSGVO)
   1. Physical access control
      The following implemented measures prevent unauthorized persons from gaining access to the data processing facilities:
      1. Manual locking system (e.g. key)
      2. Security locks
      3. Instruction to employees not to work in premises open to the public (e.g. cafés)
      4. Work in the home office: unauthorized persons have no access to the employee's residence
      5. Work in home office: instruct employees, if possible, to work in study separate from living quarters
   2. Data access control
      The following implemented measures prevent unauthorized persons from accessing the data processing systems:
      1. Authentication with user and password
      2. Use of anti-virus software
      3. Use of Firewall deployment in all SaaS applications
      4. Encryption of data carriers
      5. Automatic desktop lock
      6. User Permissions Management
      7. Create user profiles
      8. Use of 2-factor authentication
      9. General corporate policy on data protection or security
      10. Protected storage for secure passwords
      11. Company policy for "least privileges"
      12. General instruction to manually lock desktop when leaving workstation
   3. Data usage control
      1. The following implemented measures ensure that unauthorized persons do not have access to personal data:
      2. Use of an authorization concept
      3. Number of administrators is kept as small as possible
      4. Instruction to employees that only absolutely necessary data is printed out
      5. Instruction to employees that data will only be deleted after consultation
   4. Separation control
      The following measures ensure that personal data collected for different purposes are processed separately:
      1. Separation of productive and test system
      2. Logical client separation (on the software side)
      3. Creation of an authorization concept
      4. Setting database rights‍
3. Integrity (Art. 32 para. 1 lit. b DSGVO)
   
   1. Transfer control
      It is ensured that personal data cannot be read, copied, changed or removed without authorization during transfer or storage on data carriers and that it is possible to check which persons or bodies have received personal data. The following measures are implemented to ensure this:
      1. Logging of accesses and retrievals
      2. Provision of data via encrypted connections such as SFTP or HTTPS
      3. Home Office: Employer's Remote Deletion Right
   2. Input control
      The following measures ensure that it is possible to check who has processed personal data in data processing systems and at what time:
      1. Logging of the entry, modification and deletion of data
      2. Traceability of data entry, modification and deletion through individual user names (not user groups)
      3. Assignment of rights to enter, change and delete data on the basis of an authorization concept
      4. Clear responsibilities for deletions
      5. Instruction to employees to delete data only after consultation
4. Availability and resilience (Art. 32 para. 1 lit. b DSGVO)
   The following measures ensure that personal data is protected against accidental destruction or loss and is always available to the client:
   1. 1. Regular backups
      2. Creation of a backup & recovery concept
      3. Keeping data backup in a secure, off-site location
      4. Hosting (at least of the most important data) with a professional hoster
5. Procedures for regular review, assessment and evaluation (Art. 32(1)(d) GDPR; Art. 25(1) GDPR)
   1. Data protection management
      The following measures are intended to ensure that an organization that meets the basic requirements of data protection law is in place:
      1. Supervision by Data Protection Officer Pete Nicholls
      2. Obligation of employees to data secrecy
      3. Regular training of employees in data protection
      4. Keeping an overview of processing activities (Art. 30 GDPR)
   2. Incident response management
      The following measures are intended to ensure that notification processes are triggered in the event of data privacy breaches:
      1. Data breach notification process pursuant to Art. 4 No. 12 GDPR to the supervisory authorities (Art. 33 GDPR)
      2. Data breach notification process pursuant to Art. 4 No. 12 DSGVO vis-à-vis data subjects (Art. 34 DSGVO)
      3. Involvement of the data protection officer in security incidents and data breaches
   3. ‍Data protection-friendly default settings (Art. 25 (2) GDPR)
      The following implemented measures take into account the requirements of the principle of "Least Privilege":
      1. Implementation of "Least Privilege", providing access only to data required by employees in order to fulfil their role
      2. No more personal data is collected than is necessary for the respective purpose.
   4. Order control
      The following measures ensure that personal data can only be processed in accordance with the instructions:
      
      1. Written instructions to the contractor or instructions in text form (e.g. by data processing agreement)
      2. Ensuring the destruction of data after completion of the order, e.g. by requesting appropriate confirmations
      3. Confirmation from contractors that they commit their own employees to data secrecy (typically in the data processing agreement)
      4. Careful selection of contractors (especially with regard to data security).

Also, review our Privacy Policy here.