GDPR Policy

A DPA is an agreement between WORKetc and our customers that regulates the processing of customer personal data that we perform on your behalf.

The DPA outlines the commitments that WORKetc (Data Processor) and you (Data Controller) have agreed to in order to ensure the lawful processing of your customer personal data.

WORKetc has updated our Terms of Service on May 25th, 2018 to incorporate the DPA, therefore, you will not require to sign a DPA agreement as you have already agreed to our Terms of Service when you signed up for WORKetc.

For your convenience, you can download a copy of the DPA here.

The GDPR regulations that a business must meet are broken down into two different roles:

1. Data Controller: The organization that decides why someone’s personal data is collected and how the data will be collected.
2. Data Processor: The organization that actually processes the personal data of individuals on behalf of the controller.

When our customers accept the WORKetc Terms of Service, they permit WORKetc to maintain the data from our customers on their respective WORKetc accounts. In this case, our customers are the data controllers (as they determine how and why they collect data) and WORKetc is the data processor as we actually maintain the data the controller collects on our system, so we act as the data processor.

WORKetc operates our infrastructure using several servers provided by Amazon Web Services (AWS). Below is a breakdown of where your data is stored based on region:

• All European Customers have their data hosted on our AWS Server in Frankfurt, Germany.
• All North American Customers have their data hosted on our AWS Server in Oregon, Michigan USA.
• All our Asia Pacific Customers have their data hosted on our AWS Server in Sydney, Australia.

If you are in the EEA your data will be hosted in Frankfurt, Germany. However, AWS has all the appropriate certifications in place to allow your data to be transferred to any one of our other servers without breaching the applicable data protection regulations.

Should your data move outside of the EEA zone, for the purposes of providing geographic redundancy to ensure the maximum protection possible of your data, the servers your data will be stored on will still be compliant with the applicable data protection regulations.

WORKetc makes use of several third-party providers to ensure our quality of service.

You can find a full list of our Sub-Processors here. On this page you will also be able to:

• Object to a new-sub-processor
• Request to receive an email notification when a WORKetc introduces a new sub-processor

WORKetc does not provide any limitations to the personal data that you choose to store in WORKetc, with the exception of data that may include questionable legal or moral content (for example pornography, illegal drug use, hate crimes), or which has been obtained by fraudulent activities or indirect methods (for example, third-party data that you are not authorized to use, purchased email lists or contact records).

However, you have the sole responsibility for the legality, reliability, integrity, accuracy and quality of your Customer Data.

Please Note: Even though WORKetc allows users to store custom data on our platform, we do not allow you to store Sensitive Personal Data (as defined by the EU Data Commission Office).

WORKetc has several systems to ensure the security of all data that we process:

• Secure Socket Layer technology (SSL) – standard security technology for establishing an encrypted link between a server and a client
• 256-bit encryption during storage on our severs – A hacker will require 2²⁵⁶ different combinations to break a 256-bit encrypted message.
• HTTP Strict Transport Security – web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. 
• Content Security Policy – an added layer of security that helps to detect and mitigate certain types of attacks

You can read more about each point above by pressing on any of the system names above.

WORKetc also utilizes Amazon Web Services (AWS) to host all our data, you can read more about the security and encryption capabilities of AWS.

WORKetc understands the importance of ensuring that your data is never lost. For this reason, our systems automatically backup our entire WORKetc database every 5 hours.   When a backup is created, it is automatically deleted after 14 days.

To back up our systems in a secure and efficient manner, we use a backup method known as a data snapshot. This method of data backup ensures that the data remains anonymous. After your WORKetc account is closed, all customer personal data we hold is fully removed from our database and the archived backups are fully removed 90 days after account closure.   We retain this data for the stated period for your peace of mind – making it available during this period should you require your own discrete copy.

If you wish to request the immediate removal of all your customer personal data, you can do so by submitting this form.

You also have the option of creating a backup of your WORKetc account by going to Settings -> Manage Account -> Backup Account, this will allow you to create a SQL Server 2016 database backup.

Please Note: that WORKetc cannot be held responsible for what you choose to do with your data after you export it out of WORKetc.

Members of our Product Support team often require access to the systems that are used to manage personal customer data.

We ensure that all WORKetc staff with any access to any customer personal data have signed a Non-Disclosure and Confidentiality Agreement prior to allowing said employees any access to your data.

WORKetc also maintains a comprehensive off-boarding process to ensure that if an employee’s employment is terminated, they lose all access to all WORKetc systems.

A member of the WORKetc Support team will never access personal customer data unless they are given specific instruction from the customer to-do so (this can either be done by phone, email or online webform).

When any member of the WORKetc support team accesses your Customer Personal Data, we have the following security systems in place:

1. Establish an encrypted connection via TLS 1.2 (2048 bit) encryption layer to the database server through specified access in the AWS proprietary firewall.
2. Establish a console session or connect using SQL Management Studio and query data as needed.

In addition to our security system, WORKetc logs all instances when a WORKetc employee accesses any Customer Personal Data and stores those logs securely on our encrypted database.

For additional security, the account owner can choose to remove all WORKetc support access to all Customer Personal Data. The Help Article with instructions on this feature can be found here.

WORKetc is dedicated to ensuring your data stays secure. In the extremely unlikely event of a data breach. We guarantee that we will advise you within 72-hours of the time we became aware of the data breach.

Within the data breach notification, we will provide you with all the required incident details as indicated in Article 33 of the GDPR (found here).

• You will receive a data breach notification with-in 72 hours of WORKetc being aware of the breach
• You will receive all other information related to the data breach within the four (4) week time allowed by the GDPR Regulations

WORKetc will send the incident notification the account owner listed on the WORKetc account.

WORKetc host all the data that we collect on Amazon Web Services (AWS).

AWS is a global leader in Infrastructure as a Service (IaaS) and they take physical and network security seriously. Their data centers are housed in nondescript facilities. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff, video surveillance, intrusion detection systems, and other electronic means. Access to their data center floors requires two-factor authentication a minimum of two times.

AWS Maintains several industry compliance certificates that guarantee the safe transfer, storage, and access to your data.

All AWS Infrastructure is GDPR compliant and adheres to the following international certification standards:

• ISO 27001 – Security management best practices and comprehensive security controls 
• ISO 27017 – Information security aspects of cloud computing.
• ISO 27018 – Code of practice that focuses on protection of personal data in the cloud
• SOC 1, SOC 2 & SOC 3 –  Independent third-party examination reports that demonstrate how AWS achieves key compliance controls and objectives.
• PCI DSS Level 1 – PCI DSS applies to all entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD)

All AWS Infrastructure also adheres to the following EU specific certification standards:

• Common Cloud Computing Controls Catalogue (C5) – Scheme introduced in Germany by the Federal Office for Information Security (BSI) to help organizations demonstrate operational security against common cyber-attacks
• CISPE Code of Conduct – Helps customers ensure that their cloud infrastructure provider is using appropriate data protection standards to protect their data consistently
• EU – US Privacy Shield Framework – Enables the compliant transfer of personal data from data controllers in the EU to data controllers (or processors) in the US.

You can find a full list of AWS Compliance Programs here. You can also press on any certificate above to receive more details on the specific certificate.

An annual Security Vulnerability Audit is conducted by Synopsys (A company worth $2 Billion USD & listed on Nasdaq 100 Leading Security Company). Any potential threats or vulnerabilities identified by the audit are fully addressed by WORKetc as a matter highest priority and resolved in the shortest time possible.