Annex 3 — PARTNER TECH Europe GmbH

Technical and Organisational Measures (TOMs)

Annex 3 - Technical and organisational measures of the Processor

The Processor implements the following technical and organisational measures for data security within the meaning of Article 32 GDPR.

1. Confidentiality

a) Physical access control

Measures suitable for preventing unauthorised persons from gaining access to data processing facilities in which personal data are processed or used:

Alarm system
Smart card/transponder locking system
Security locks
Key management (issuing keys, etc.)
Identity checks at reception
Careful selection of cleaning personnel

b) System access control

Measures suitable for preventing unauthorised persons from using data processing systems:

Assignment of user permissions
Assignment of passwords
Authentication using a username / password
Use of VPN technology
Security locks
Key management (issuing keys, etc.)
Careful selection of cleaning personnel
Use of antivirus software
Use of a hardware or software firewall

c) Data access control

Measures ensuring that persons authorised to use a data processing system can access only the data covered by their access permissions, and that personal data cannot be read, copied, modified or removed without authorisation during processing or use, or after storage:

Implementation of an access rights policy
Management of access rights by system administrators
Number of administrators reduced to the minimum necessary
Password policy, including password length and password changes
Use of document shredders or service providers (where possible, with a data protection quality seal)

d) Separation

Measures ensuring that data collected for different purposes can be processed separately:

Implementation of an access rights policy
Definition of database access rights
Separation of production and test systems

e) Pseudonymisation & encryption

No pseudonymisation is carried out.

Personal data are encrypted in transit (256-bit encryption). No further encryption is applied on the server systems.

2. Integrity

a) Input control

Measures ensuring that it is possible to subsequently verify and establish whether, and by whom, personal data have been entered into, modified in or removed from data processing systems:

Assignment of rights to enter, modify and delete data on the basis of the access rights policy

b) Transfer control

Measures ensuring that personal data cannot be read, copied, modified or removed without authorisation during electronic transmission or transport, or while stored on data media, and that it is possible to verify and establish the entities to which personal data are intended to be transmitted using data transmission facilities:

Establishment of dedicated lines or VPN tunnels
For physical transport: careful selection of transport personnel and vehicles

c) Availability control

Measures ensuring that personal data are protected against accidental destruction or loss:

Uninterruptible power supply (UPS)
Air conditioning in server rooms
Equipment for monitoring temperature and humidity in server rooms
Surge-protected power strips in server rooms
Fire and smoke detection systems
Fire extinguishing equipment in server rooms
Development of a backup & recovery plan
Storage of backups at a secure off-site location
Server rooms not located beneath sanitary facilities

d) Process for regularly testing, assessing and evaluating

Measures ensuring that personal data processed on behalf of the Controller can be processed only in accordance with the Controller’s instructions:

Selection of the Processor with due care (particularly regarding data security); auditing of processes
Prior review of the documentation and security measures implemented by the Processor
Written instructions to the Processor (e.g. through a data processing agreement) within the meaning of Article 28 GDPR
Requiring the Processor’s employees to maintain data confidentiality
Regular refresher training for employees
The Processor has appointed a data protection officer
Ensuring the destruction of data upon completion of the engagement
Effective rights to monitor and audit the Processor have been agreed

3. Availability

An uninterruptible power supply (UPS) is used for the servers.
The server rooms are air-conditioned.
Fire and smoke detection systems are in place.
A data backup and recovery plan is in place.
An emergency plan is in place.

4. Process for regularly testing, assessing and evaluating

Company management acknowledges its responsibility for data protection and information security.
Employees receive regular training on data protection.
Employees are required to maintain the confidentiality of personal data.
A data protection officer has been appointed.
An established process for reporting personal data breaches is in place.
A process for conducting data protection impact assessments (DPIAs) is in place.
A process is in place to ensure that requests from data subjects are handled within the applicable time limits.
A record of processing activities within the meaning of Article 30(1) and (2) GDPR is maintained.