Technical and Organisational Measures

This document describes the technical and organisational measures (TOMs) of qutee.ai GmbH, Gerichtsstraße 2, 65185 Wiesbaden, Germany, under Art. 32 GDPR. It is Annex 1 to the Data Processing Agreement (DPA). This is a translation; the German version is binding.

Confidentiality (Art. 32(1)(b) GDPR)

Physical access control

No unauthorised access to data processing facilities, e.g. magnetic or chip cards, keys, electric door openers, security staff or gatekeepers, alarm systems, video systems.

Technical measures

• Alarm system
• Automatic access control system
• Video surveillance of entrances
• Chip card / transponder systems
• Security locks
• Security lock on the server room
• Locking system with code lock
• Securing of building shafts
• Doorbell system with camera
• Server rooms can only be entered with specific keys

Organisational measures

• Key policy / key register
• Reception / gatekeeper
• Visitor book / visitor log
• Employee and visitor badges
• Visitors accompanied by employees
• Care in selecting security staff
• Care in selecting cleaning services

System access control

No unauthorised use of systems, e.g. (secure) passwords, automatic locking, two-factor authentication, encryption of storage media.

Technical measures

• Login with user name and password
• Login with biometric data
• Anti-virus software on servers
• Anti-virus software on clients
• Anti-virus software on mobile devices
• Firewall
• Intrusion detection systems
• Mobile device management
• VPN for remote access
• Encryption of storage media
• Encryption of smartphones
• BIOS protection (separate password)
• Blocking of external interfaces (USB)
• Automatic screen lock
• Encryption of notebooks and tablets

Organisational measures

• Management of user permissions
• Creation of user profiles
• “Secure password” policy
• “Deletion / destruction” policy
• “Clean desk” policy
• General data protection and security policy
• Mobile device policy
• “Manual screen lock” instructions

Data access control

No unauthorised reading, copying, changing or removing within the system, e.g. permission concepts and needs-based access rights, logging of access.

Technical measures

• Document shredder
• External document destruction service (DIN 66399)
• Physical deletion of storage media
• Logging of access to applications, specifically when data is entered, changed and deleted

Organisational measures

• Use of permission concepts
• Minimum number of administrators
• Management of user rights

Separation control

Separate processing of data collected for different purposes, e.g. multi-tenancy, sandboxing.

Technical measures

• Separation of production and test environments
• Physical separation (systems / databases / storage media)
• Multi-tenancy of relevant applications

Organisational measures

• Control through permission concept
• Definition of database rights

Pseudonymisation

Technical measures

• Where data is pseudonymised: the mapping data is kept separately in separate, secured systems (encrypted where possible)

Organisational measures

• Internal instruction to pseudonymise personal data where possible when it is passed on or after the statutory deletion period has expired

Integrity (Art. 32(1)(b) GDPR)

Transfer control

No unauthorised reading, copying, changing or removing during electronic transmission or transport, e.g. encryption, virtual private networks (VPN), electronic signature.

Technical measures

• Email encryption
• Use of VPN
• Logging of access and retrieval
• Secure transport containers
• Provision over encrypted connections such as SFTP, HTTPS
• Use of signature procedures

Organisational measures

• Documentation of data recipients and of the planned duration of transfer or the deletion periods
• Overview of regular retrieval and transfer processes
• Transfer in anonymised or pseudonymised form
• Care in selecting transport staff and vehicles
• Personal handover with record

Input control

Determining whether and by whom personal data has been entered into, changed in or removed from data processing systems, e.g. logging, document management.

Technical measures

• Technical logging of data entry, changes and deletion
• Manual or automated review of logs

Organisational measures

• Overview of which programs can be used to enter, change or delete which data
• Traceability of data entry, changes and deletion through individual user names (not user groups)
• Rights to enter, change and delete data assigned on the basis of a permission concept
• Retention of forms from which data was taken into automated processing
• Clear responsibilities for deletion

Availability and resilience (Art. 32(1)(b) GDPR)

Availability control

Protection against accidental or deliberate destruction or loss, e.g. backup strategy (online/offline; on-site/off-site), uninterruptible power supply (UPS), virus protection, firewall, reporting channels and emergency plans.

Technical measures

• Fire and smoke detection systems
• Fire extinguishers in the server room
• Server room monitoring of temperature and humidity
• Air-conditioned server room
• UPS
• Surge-protected power strips in the server room
• RAID system / disk mirroring
• Video surveillance of the server room
• Alarm on unauthorised access to the server room

Organisational measures

• Written backup and recovery concept
• Monitoring of the backup process
• Regular data recovery tests with documented results
• Backup media stored in a secure place outside the server room
• No plumbing in or above the server room
• Emergency plan in place (e.g. BSI IT-Grundschutz 100-4)
• Separate partitions for operating systems and data

Rapid recovery (Art. 32(1)(c) GDPR)

Protection against accidental or deliberate destruction or loss, e.g. backup strategy (online/offline; on-site/off-site), uninterruptible power supply (UPS), virus protection, firewall, reporting channels and emergency plans.

Technical measures

• Volume Shadow Copy Service (VSS) on the server to quickly restore deleted data on the file server

Organisational measures

• Backup concept with data kept on site and redundantly at a second location
• Emergency manual

Procedures for regular testing, assessment and evaluation (Art. 32(1)(d) GDPR; Art. 25(1) GDPR)

Data protection management

Technical measures

• Central documentation of all data protection procedures and rules, accessible to employees as needed and authorised (e.g. wiki, intranet)
• Other documented security concept
• The effectiveness of the technical safeguards is reviewed at least once a year

Organisational measures

• External data protection officer
• Employees trained and bound to confidentiality
• Regular awareness training for employees, at least once a year
• Data protection impact assessments (DPIA) are carried out where needed
• The organisation meets its information obligations under Art. 13 and 14 GDPR
• Formal process for handling access requests from data subjects

Incident response management

Technical measures

• Firewall, regularly updated
• Spam filter, regularly updated
• Virus scanner, regularly updated
• Intrusion detection system (IDS)

Organisational measures

• Documented process for detecting and reporting security incidents and data breaches (including notification duties towards the supervisory authority)
• Documented procedure for handling security incidents
• Data protection officer and information security officer involved in security incidents and data breaches
• Documentation of security incidents and data breaches, e.g. in a ticket system
• Formal process and responsibilities for following up on security incidents and data breaches

Data protection by default (Art. 25(2) GDPR)

Technical measures

• Data subjects can easily exercise their right to withdraw consent through technical measures

Organisational measures

• No more personal data is collected than necessary for the given purpose

Further measures

• Where possible, the default settings of third-party providers’ systems use Germany as the location, or alternatively the EU.

Processor control

No processing on behalf under Art. 28 GDPR without corresponding instructions from the controller, e.g. clear contract design, formal order management, strict selection of service providers, prior verification, follow-up checks.

Organisational measures

• Prior review and documentation of the security measures taken by the processor
• Selection of the processor with due care (particularly regarding data protection and data security)
• Conclusion of the necessary data processing agreement or EU standard contractual clauses
• Written instructions to the processor
• Processor’s employees bound to confidentiality
• Processor obliged to appoint a data protection officer where required
• Agreement of effective audit rights towards the processor
• Rules on the use of further subprocessors
• Ensuring destruction of data after the end of the assignment
• For longer cooperation: ongoing review of the processor and its level of protection

All changes · For a signed copy as PDF, email [email protected].