GDPR Compliance Overview
At Azuqua, we’ve been working hard to ensure GDPR compliance across the organization – including teams, processes, tools, and the Azuqua platform. Equally important is helping our customers and partners understand how GDPR affects our relationship with you and your use of the Azuqua platform.
In the months leading up to May 25, 2018, when the GDPR regulation went into effect, we took several key actions to enhance the Azuqua platform and ensure our customers and partners have the tools they need to support their GDPR operations and compliance efforts.
We are fully committed to information security and privacy and will continue to invest in our privacy and security programs as the regulatory landscape evolves.
Azuqua GDPR Product Readiness
Below is a detailed list of the features we’re building to help you be GDPR compliant. A quick note on timelines: we’ve already started to build many of these new features, and we’ll continue to ship them regularly over the next couple of months.
Key definitions used throughout:
- Data Subjects – GDPR defines “data subjects” as “identified or identifiable natural person[s].” In other words, data subjects are just people—human beings from whom or about whom Azuqua collects information in connection with our business and its operations.
- Data Controllers – The GDPR definition of a controller is “the natural or legal person, public authority, agency or another body which, alone or jointly with others, determines the purposes and means of the processing of personal data.” Basically, if your business processes personal data of data subjects for your own business purposes and needs—not just as a service provider acting on behalf of another business—then you’re likely a controller.
- Data Processors – Those entities that process personal data on behalf of data controllers, and as directed by data controllers. Basically, when the controller outsources the actual data processing function to another entity, that other entity is a processor. In many cases, Azuqua acts as a data processor.
|Area||Guidance||What Azuqua Is Doing|
|Consent||Each individual must give consent to use their personal data. The data collected must also be necessary to complete a task or transaction initiated by the individual.|
One type of lawful basis of processing is consent with proper notice.
In order for data subjects to grant consent under the GDPR, a few things need to happen:
|In Azuqua, we're adding features to make collecting, tracking, and managing consent in a GDPR-compliant way as straightforward as possible.|
Three of the most common ways that Azuqua customers provide personal data is during initial sign-up, user onboarding, support/chat, and FLOs.
Once a data subject or data controller submits their information, we will store a copy of the notice that was provided, information about which consent was provided, and timestamp of the interaction.
In Progress - Available August
From within the settings menu, existing users will be able to toggle this feature as well.
|Withdrawal of Consent||Data subjects need the ability to see what they’ve signed up for, and withdraw their consent (or object to how their data is being processed) at any time. In other words, withdrawing consent needs to be just as easy as giving it.|
|Right to Be Forgotten (Deletion)||Organisations must also protect individuals' right to be forgotten when their data is no longer relevant or necessary. |
Data subjects have the right to request deletion of all personal data you have about them. The GDPR requires the permanent removal of the data subject contact from your database, including email tracking history, call records, form submissions and more.
In many cases, you’ll need to respond to the request within 30 days. The right to deletion is not absolute, and can depend on the context of the request, so it doesn’t always apply.
|1.If our customer would like to have their data deleted from Azuqua entirely, that customer can contact firstname.lastname@example.org to have all of their data removed from all systems. We will work with customers requesting this to ensure that other members of their Azuqua organizations will be minimally impacted. Azuqua will use reasonable efforts to process requests within 30 days.|
2.If a customer would like specific execution data to be cleared in order to comply with their own GDPR deletion requests, they can contact email@example.com with the specific executions in their execution history they would like removed.
3.We will provide a way for customers to search through execution history data based on a certain field making it easier for customers to find specific execution records and respond to requests from their own customers asking for deletion of data (requests to be forgotten).
Coming later this year
|Modification||Just as data subjects can request to delete or access their data, they can ask your company to modify their personal data if it’s inaccurate or incomplete. If and when a request for modification is made, you need to be able to accommodate that request.||Just as data subjects can request to delete or access their data, they can ask your company to modify their personal data if it’s inaccurate or incomplete. If and when a request for modification is made, you need to be able to accommodate that request.|
|Security Measures||The GDPR requires a slew of data protection safeguards, from encryption at rest and in transit to access controls to data pseudonymization and anonymization.||As part of Azuqua’s approach to the GDPR, we’re strengthening our security controls across the board.|
In addition to industry standard practices around encryption, Azuqua is taking additional steps to secure data, including pseudonymization, stability and uptime, backup and disaster recovery, and regular security testing. For additional information refer to the Azuqua Security Overview at azuqua.com/security.
What is Services Data?
Services Data is any information, including personal data, which is stored in or transmitted via the Azuqua services, by, or on behalf of, our customers or partners and their end-users.
Who owns and controls Services Data?
From a privacy perspective, the customer is the controller of Services Data, and Azuqua is a processor. This means that throughout the time that a customer subscribes to services with Azuqua, the customer retains ownership of and control over Services Data in its account.
Does Azuqua have subprocessors?
Azuqua maintains an up-to-date list of the names and locations of all subprocessors used for hosting or other processing of Services Data, which can be found here. The list also may be obtained by contacting firstname.lastname@example.org.
How does Azuqua use Services Data?
We use Services Data to operate and improve our services, help customers access and use the services, respond to customer inquiries, and send communication related to the services.
What steps does Azuqua take to secure Services Data?
Azuqua prioritizes data security and combines enterprise-class security features with comprehensive audits of our applications, systems, and networks to ensure customer and business data is always protected.
For example, Azuqua servers are hosted at Tier IV or III+, SSAE-16, PCI DSS, or ISO 27001 compliant facilities. Additionally, we engage third-party security experts to perform detailed penetration tests on a periodic basis, and our Support team is on call to respond to security alerts and events.
Where will Services Data be stored?
Azuqua has data centers in three main regions — all within the United States. Services Data may be stored in any region.
How does Azuqua respond to information requests?
How does Azuqua respond to legal requests for Services Data?
In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may disclose personal data to respond to subpoenas, court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims. We may also share such information with relevant law enforcement agencies or public authorities if we believe same to be necessary in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our Terms of Service or Subscription Agreements, or as otherwise required by law.
Does Azuqua have a Data Processing Addendum (DPA) for their role as a processor?
DISCLAIMER: This website is neither a magnum opus on EU data privacy nor legal advice for your company to use in complying with EU data privacy laws like the GDPR. Instead, it provides background information to help you better understand how Azuqua has addressed some important legal points. This information is not the same as legal advice, where an attorney applies the law to your specific circumstances, so we insist that you consult an attorney if you’d like advice on your interpretation of this information or its accuracy. In a nutshell, you may not rely on this paper as legal advice, nor as a recommendation of any particular legal understanding. The products, services, and other capabilities described herein are not suitable for all situations and may have restricted availability.