Privacy Policy

Data Processing Agreement
(DPA)
Last Updated: March 10th, 2021

ANNEX 1
DETAILS OF PROCESSING OF CONTROLLER PERSONAL DATA
This Annex 1 includes certain details of the Processing of Controller Personal Data as required by Article 28(3) GDPR.

Subject matter and duration of the Processing of Controller Personal Data.

The subject matter and duration of the Processing of the Controller Personal Data are set out in the Agreement and this DPA.

The nature and purpose of the Processing of Controller Personal Data 

Oropan will Process Personal Data as necessary to perform the CONTRACT pursuant to the Agreement, as further specified in the CONTRACT Documentation.

The types of Personal Data to be Processed 

Type of Personale Data are listed below:

  • Demographic and contact data (including but not limited to name, title, email address, phone number) as well as other identification data (ex. passport number, identifiers of
    other services)

ANNEX 2

DESCRIPTION OF THE TECHNICAL AND ORGANIZATIONAL SECURITY
MEASURES

This Annex 2 includes the description of the technical and organizational security measures implemented by the Data Processor.

Oropan currently observes the security practices described in this Annex 2. Notwithstanding any provision to the contrary otherwise agreed to by data exporter, Oropan may modify or update these practices at its discretion provided that such modification and update does not result in a material degradation in the protection offered by these practices. All capitalized terms not otherwise defined herein shall have the meanings as set forth in this DPA.

1. a) Access Control
2. i) Preventing Unauthorized Product Access
Infrastructure used for processing: Oropan hosts its Service with internal infrastructure managed by external providers. Additionally, Oropan maintains contractual relationships with vendors in order to provide the Service in accordance with this DPA. Oropan relies on contractual agreements, privacy policies, and vendor compliance programs in order to protect data processed or stored by these vendors.

Authentication: Oropan implemented a uniform password policy for its customer data. Employes who interact with the data via the user interface must authenticate before accessing.

Authorization: The authorization model is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the employee’s permissions against the attributes associated with each data set.

1. ii)     Preventing Unauthorized Access
Oropan implements industry standard access controls and detection capabilities for the internal networks.

Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the infrastructure. The technical measures implemented differ between infrastructure providers and include Virtual Private Cloud (VPC) implementations, security group assignment, and traditional firewall rules.

Intrusion detection and prevention: Oropan implemented a Web Application Firewall (WAF) solution to protect hosted websites and other internet-accessible applications. The WAF is designed to identify and prevent attacks against publicly available network services.

Static code analysis: Security reviews of code stored in Oropan ’s source code repositories is performed, checking for coding best practices and identifiable software flaws.

Penetration testing: Oropan maintains relationships with industry recognized penetration testing service providers for four annual penetration tests. The intent of the penetration tests is to identify and resolve foreseeable attack vectors and potential abuse scenarios.

iii)   Limitations of Privilege & Authorization Requirements

Product access: A subset of Oropan ’s employees have access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, to troubleshoot potential problems, to detect and respond to security incidents and implement data security. Access is enabled through “just in time” requests for access; all such requests are logged. Employees are granted access by role, and reviews of high risk privilege grants are performed periodically. Employee roles are reviewed at least once every six months.

Background checks: All Oropan employees undergo a background check prior to being extended an employment offer, in accordance with the applicable laws. All employees are required to conduct themselves in a manner consistent with company guidelines, non-disclosure requirements, and ethical standards.
1. Input Control
Detection: Oropan designed its infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests. Internal systems aggregated log data and alert appropriate employees of malicious, unintended, or anomalous activities.Oropan personnel, including security, operations, and support personnel, are responsive to known incidents.

Response and tracking: Oropan maintains a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, Oropan will take appropriate steps to minimize product and Customer damage or unauthorized disclosure.

Communication: If Oropan becomes aware of unlawful access to Customer data stored within its  infrastructure, Oropan will: 1) notify the affected Customers of the incident; 2) provide a description of the steps Oropan is taking to resolve the incident; and 3) provide status updates to the Customer contact, as Oropan deems necessary. Notification(s) of incidents, if any, will be delivered to one or more of the Customer’s contacts in a form Oropan selects, which may include via email or telephone.
1. d) Availability Control
Infrastructure availability: The infrastructure providers use commercially reasonable efforts to ensure a minimum of 99.95% uptime. The providers maintain a minimum of N+1 redundancy to power and network.

Fault tolerance: Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Customer data is backed up to multiple durable data stores and replicated across multiple availability zones.