BETWEEN
i. Sirea (3392905-1) of Hermanninsaarentie, Porvoo, Finland ("FABBLO")
ii. you ("Customer")The parties set forth in
i-ii are hereinafter jointly referred to as the “Parties” and individually as a “Party”.
WHEREAS
1. DEFINITIONS
1.1.
“Affiliate” means an entity that, directly or indirectly, controls, is
controlled by, or is under common control with a Party. As used herein, “control” means the power to direct
the management or affairs of an entity and the beneficial ownership of fifty
percent (50%) or more of the voting equity securities or other equivalent
voting interests of an entity.
1.2.
“Applicable Law(s)” means all Finnish, US, UK, and EU laws, regulations, and
other legal or regulatory requirements relating to privacy, data
protection/security, or the Processing of Personal Data applicable to FABBLOs'
performance of its services under the Agreement,including without limitation
the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”) as amended by the
California Privacy Rights Act of 2020 (“CPRA”), including any
implementing regulations, the United Kingdom Data Protection Act 2018, Finnish
Data protection act 1050/2018, Finnish Personal Data law 523/1999 and the
General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”).
1.3.
“Customer Contact Data” means the Customer’s contact information.
1.4.
“Customer Personal Data” means Customer Data, as defined in the Agreement,
consisting of Personal Data, except for Customer Contact Data.
1.5.
“EEA”
means,
for purposes of this DPA, the European Economic Area (which is composed of the
member states of the European Union), Norway, Iceland, Liechtenstein, and
Switzerland.
1.6.
“EU SCCs”
means
the Standard Contractual Clauses issued pursuant to the EU Commission
Implementing Decision (EU) 2021/914 of 4 June 2021 on Standard Contractual
Clauses for the transfer of personal data to third countries pursuant to
Regulation (EU) 2016/679 of the European Parliament and of the Council,
available at http://data.europa.eu/eli/dec_impl/2021/914/oj and completed as
described in Section 9.
1.7.
“Personal Data Breach” means the accidental or unlawful destruction, loss,
alteration, or unauthorized disclosure of or access to
Customer Personal Data.
1.8.
“Personal Data” includes “personal data,” “personal information,” and “personally identifiable
information,” each as
defined by Applicable Law.
1.9
"Cloud service provider" means the entity that provides the application platform for FABBLO, operating as an independent company separate from FABBLO.
1.10.
“Process”
and
“Processing” mean any operation or set
of operations performed on Personal Data, or on sets of Personal Data, whether
or not by automated means, such as collecting, recording, organizing, creating, structuring, storing, adapting or altering,
retrieving, consulting, using, disclosing (by transmission, dissemination or
otherwise making such data available), aligning or combining, restricting,
erasing, or destroying such Personal Data.
1.11. “Standard Contractual
Clauses” means the EU
SCCs or the UK SCCs, as applicable.
1.12. “UK SCCs” means the International
Data Transfer Addendum to the EU Commission Standard Contractual Clauses,
available as of the Effective Date at
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/
and completed as described in Section 9.
2. RELATIONSHIP OF THE PARTIES
2.1.
Customer is the Controller as defined under
Applicable Laws, and Customer determines the means and purposes for which
Customer Personal Data is Processed by FABBLO. To the extent FABBLO Processes
Customer Personal Data subject to Applicable Laws, FABBLO is a Processor and
Service Provider as defined under Applicable Laws, and FABBLO will Process the
Customer Personal Data according to the instructions set forth in this DPA, the
Agreement, and as required under Applicable Laws. Customer and FABBLO are
independent Controllers, as defined under Applicable Laws, with respect to
Customer Contact Data. Either Party may Process Customer Contact Data as
necessary for the purpose of (i) carrying out its obligations under the
Agreement, (ii) applicable legal or regulatory requirements, (iii) requests and
communications with the other Party, (iv) administrative, business, and
marketing purposes, and (v) to protect its respective rights in accordance with
applicable law and, in the case of FABBLO, maintaining the security and
integrity of the Services.
2.2.
FABBLO hereby certifies that it understands the
restrictions and obligations set forth in this DPA in relation to its role as a
Processor and Service Provider, and that it will comply with them.
3. CUSTOMER’S INSTRUCTIONS TO FABBLO
3.1. Purpose Limitation. FABBLO will not
3.1.1.
sell or share (as defined by CCPA) Customer
Personal Data,
3.1.2.
Process Customer Personal Data for any purpose
other than for the specific purposes set forth in the Agreement,
3.1.3.
retain, use, or disclose any such data outside of
the direct business relationship between the Parties,
3.1.4.
combine any Customer Personal Data with personal
information that it receives from, or on behalf of, another person or persons,
or collects from its own interaction with a consumer, except as otherwise
permitted by Applicable Law, or
3.1.5.
otherwise engage in any Processing of Customer
Personal Data beyond that in which a Processor may engage under the Applicable
Law or in which a Service Provider may engage under the Applicable Law, unless
obligated to do otherwise by Applicable Law. In such a case, FABBLO will inform
Customer of the applicable legal obligation before engaging in the Processing,
unless legally prohibited from doing so. Further details regarding FABBLOs'
Processing operations are set forth in Schedule 1. To the extent Customer
discloses or makes available deidentified data (as such term is defined under
Applicable Law) within the Customer Data to FABBLO, FABBLO shall not attempt to
re-identify such data.
3.2.
Lawful Instructions. Customer will not instruct
FABBLO to Process Customer Personal Data in violation of Applicable Law. FABBLO
will without undue delay inform Customer if, in FABBLOs’ opinion, an instruction
from Customer infringes Applicable Law. The Agreement, including this DPA,
constitutes Customer’s complete and
final instructions to FABBLO regarding the Processing of Customer Personal
Data, including for purposes of the Standard Contractual Clauses. Customer
shall also have the right to take reasonable and appropriate steps to stop or
remediate any unauthorized Processing of Customer Personal Data by FABBLO.
4. LIMITATIONS ON DISCLOSURE
FABBLO will not disclose Customer Personal Data to any third party without first obtaining Customer’s written consent, except as provided in Section 5, Section 7 or Section 9, except as required by law. FABBLO will require all employees, contractors, and agents who Process Customer Personal Data on FABBLOs' behalf to protect the confidentiality of the Customer Personal Data and to comply with the other relevant requirements of this DPA.
5. SUBCONTRACTING
5.1. Use of Sub-Processors
FABBLO may subcontract the collection
or other processing of Customer Personal Data only in compliance with
Applicable Law and any additional conditions for subcontracting set forth in
the Agreement.
5.2 Acknowledgment of Sub-Processors
The Customer acknowledges that FABBLO's Affiliates and certain third parties
may be retained as sub-processors to process Customer Personal Data on FABBLO's
behalf. A list of these third-party sub-processors includes, but is not limited
to:
In addition to the above sub-processors, customer data is also processed by several platforms, like Google, Facebook – list as addendum, where you, customer, are a user. Those sub-processors process data according to their own privacy policy which you have separately accepted.
5.3.
Prior to a sub-processor’s Processing of Customer
Personal Data, FABBLO will impose contractual obligations on the sub-processor
substantially the same as those imposed on FABBLO under this DPA to the extent
applicable to the nature of the services provided by such sub-processor. FABBLO
is not liable for its sub-processors’ performance.
5.4. Notification
FABBLO will provide Customers with
at least thirty (30) days’ written notice of new sub-processors before authorizing such sub-processor(s) to Process Customer Personal Data in
connection with the provision of the Services. FABBLO will notify Customer at
the email address provided in the signature block of this DPA for purposes of
this notification. The sub-processor agreements to be provided under Section
5(j) of the EU SCCs may have all commercial information, or provisions
unrelated to the EU SCCs, redacted prior to sharing with Customer, and Customer
agrees that such copies will be provided only upon written request.
5.5. Right to Object
Customer may object to FABBLOs'
use of a new sub-processor on reasonable grounds relating to the protection of
Customer Personal Data by notifying FABBLO promptly in writing at email@fabblo.com within ten
(10) business days after receipt of FABBLOs' notice in accordance with the
mechanism set out in Section 5.2. In its notification, Customer will explain
its reasonable grounds for objection. In the event Customer objects to a new
sub-processor, FABBLO will use commercially reasonable efforts to make
available to Customer a change in the Services or recommend a commercially
reasonable change to Customer’s configuration or use of the Services to avoid Processing of
Customer Personal Data by the objected-to new sub-processor without
unreasonably burdening Customer. If FABBLO is unable to make available such
change within a reasonable period of time, which will not exceed thirty (30)
days, either Party may terminate without penalty the Processing of Customer
Personal Data and/or the Agreement with respect only to those services which
cannot be provided by FABBLO without the use of the objected-to new
sub-processor by providing written notice to the other Party.
6. ASSISTANCE AND COOPERATION
6.1. Security
FABBLO will provide reasonable
assistance to Customer regarding Customer’s compliance with its
security obligations under Applicable Law relevant to FABBLOs’ role in Processing
Customer Personal Data, taking into account the nature of Processing and the
information available to FABBLO, by implementing the technical and
organisational measures set forth in Schedule 2, without prejudice to FABBLOs'
right to make future replacements or updates to the measures that do not
materially lower the level of protection of Customer Personal Data. FABBLO will
ensure that the persons FABBLO authorised to Process the Customer Personal Data
are subject to written confidentiality agreements or are under an appropriate
statutory obligation of confidentiality no less protective than the
confidentiality obligations set forth in the Agreement.
6.2. Personal Data Breach Notification and Response
FABBLO will comply with the Personal Data Breach-related obligations directly
applicable to it under Applicable Law. Taking into account the nature of
Processing and the information available to FABBLO, FABBLO will inform Customer
of a substantiated Personal Data Breach without undue delay or within the time
period required under Applicable Law, and in any event no later than
seventy-two (72) hours following such substantiation. FABBLO will notify
Customer at the email address provided at the registration form for
purposes of Personal Data Breach notifications. Any such notification is not an
acknowledgement of fault or responsibility. This notification will include
FABBLOs' then-current assessment of the following information, to the extent
available, which may be based on incomplete information:
6.2.1.
The nature of the Personal Data Breach,
including, where possible, the categories and approximate number of data
subjects concerned and the categories and approximate number of Customer
Personal Data records concerned;
6.2.2.
the likely consequences of the Personal Data
Breach; and
6.2.3.
measures taken or proposed to be taken by FABBLO
to address the Personal Data Breach, including, where applicable, measures to
mitigate its possible adverse effects.
6.3.
FABBLO will provide timely and periodic updates
to Customer as additional information regarding the Personal Data Breach
becomes available. Customer is solely responsible for complying with legal
requirements for incident notification applicable to Customer and fulfilling
any third-party notification obligations related to any Personal Data Breach.
Nothing in this DPA or in the Standard Contractual Clauses will be construed to
require FABBLO to violate, or delay compliance with, any legal obligation it may
have with respect to a Personal Data Breach or other security incidents
generally.
7. DATA SUBJECT REQUESTS
To the extent legally permitted, FABBLO will without undue delay notify Customer if FABBLO receives any request from an individual seeking to exercise any right afforded to them under Applicable Law regarding their Personal Data (a “Data Subject Request”). To the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, FABBLO will, upon Customer’s request, take commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent FABBLO is legally permitted to do so and the response to such Data Subject Request is required under Applicable Law.
8. DPIAS AND CONSULTATION WITH AUTHORITIES
Upon Customer’s written request, FABBLO will provide Customer with reasonable cooperation and assistance as needed and appropriate to fulfill Customer’s obligations under Applicable Law to carry out a data protection impact assessment related to Customer’s use of the Services. FABBLO will provide reasonable assistance to Customer in the cooperation or prior consultation with the Supervisory Authority (as defined under the GDPR) in the performance of its tasks relating to the data protection impact assessment, and to the extent required under the Applicable Law.
9. INTERNATIONAL DATA TRANSFERS
9.1.
Customer authorises FABBLO and its sub-processors
to make international transfers of the Customer Personal Data in accordance
with this DPA so long as Applicable Law for such transfers is respected.
9.2.
With respect to Customer Personal Data
transferred from the EEA, the EU SCCs will apply and form part of this DPA,
unless the European Commission issues updates to the EU SCCs, in which case the
updated EU SCCs will control. Undefined capitalized
terms used in this provision will have the meanings given to them (or their
functional equivalents) in the definitions in the EU SCCs. For purposes of the
EU SCCs, they will be deemed completed as follows:
9.2.1. Where Customer acts as a Controller and FABBLO
acts as Customer's Processor with respect to Customer Personal Data subject to
the EU SCCs, Module 2 applies.
9.2.2. Where Customer acts as a Processor and FABBLO
acts as Customer's sub-processor with respect to Customer Personal Data subject
to the EU SCCs, Module 3 applies.
9.2.3. Section 7
(the optional docking Section) is not included.
9.2.4. Under Section 9 (Use of sub-processors), the
Parties select Option 2 (General written authorization). The initial list of
sub-processors is set forth at Section 5. FABBLO will provide notice of updates
to that list at least ten (10) business days in advance of any intended
additions or replacements of sub-processors, in accordance with Section 5 of
this DPA.
9.2.5. Under Section 11 (Redress), the optional
requirement that data subjects be permitted to lodge a complaint with an
independent dispute resolution body is inapplicable.
9.2.6. Under Section 17 (Governing law), the Parties
select Option 1 (the law of an EU Member State that allows for third-party
beneficiary rights). The Parties select the law of Finland.
9.2.7. Under Section 18 (Choice of forum and
jurisdiction), the Parties select the courts of Finland.
9.2.8. Annexes I and II of the EU SCCs are set forth in
Schedule 1 below.
9.2.9. Annex III of the EU SCCs (List of sub-processors)
is inapplicable.
9.2.10. By entering into this DPA, the Parties are deemed
to be signing the EU SCCs.
9.3.
With respect to Customer Personal Data
transferred from the United Kingdom for which the law of the United Kingdom
(and not the law in any European Economic Area jurisdiction) governs the
international nature of the transfer, the UK SCCs form part of this DPA and
take precedence over the rest of this DPA as set forth in the UK SCCs, unless
the United Kingdom issues updates to the UK SCCs, in which case the updated UK
SCCs will control. Undefined capitalized terms used in this
provision will have the meanings given to them (or their functional
equivalents) in the definitions in the UK SCCs. For purposes of the UK SCCs,
they will be deemed completed as follows:
9.3.1. Table 1 of the UK SCCs:
9.3.1.1. The Parties’ details are the Parties and their affiliates to the extent
any of them is involved in such transfer, including those set forth in Schedule
1.
9.3.1.2. The Key Contacts are the contacts set forth in
Schedule 1.
9.3.2. Table 2 of the UK SCCs: The Approved EU SCCs
referenced in Table 2 are the EU SCCs as executed by the Parties pursuant to
this Addendum.
9.3.3. Table 3 of the UK SCCs: Annex 1A, 1B, and II are
set forth in Schedule 1.
9.3.4. Table 4 of the UK SCCs: Either Party may
terminate this Addendum as set forth in Section 19 of the UK SCCs.
9.4.
By entering into this DPA, the Parties are deemed
to be signing the UK SCCs and their applicable Tables and Appendix Information.
9.5.
With respect to Customer Personal Data
transferred from Switzerland for which Swiss law (and not the law in any
European Economic Area jurisdiction) governs the international nature of the
transfer, the EU SCCs will apply and will be deemed to have the following
differences to the extent required by the Swiss Federal Act on Data Protection
(“FADP”):
9.6.
References to the GDPR in the EU SCCs are to be
understood as references to the FADP insofar as the data transfers are subject
exclusively to the FADP and not to the GDPR.
9.7.
The term “member state” in the EU SCCs
will not be interpreted in such a way as to exclude data subjects in
Switzerland from the possibility of suing for their rights in their place of
habitual residence (Switzerland) in accordance with Section 18(c) of the EU
SCCs.
9.8.
References to Personal Data in the EU SCCs also
refer to data about identifiable legal entities until the entry into force of
revisions to the FADP that eliminate this broader scope.
9.9.
Under Annex I(C) of the EU SCCs (Competent
supervisory authority): where the transfer is subject exclusively to the FADP
and not the GDPR, the supervisory authority is the Swiss Federal Data
Protection and Information Commissioner, and where the transfer is subject to
both the FADP and the GDPR, the supervisory authority is the Swiss Federal Data
Protection and Information Commissioner insofar as the transfer is governed by
the FADP, and the supervisory authority is as set forth in the EU SCCs insofar
as the transfer is governed by the GDPR.
10. AUDITS
The parties agree that the Customer may
conduct audits of FABBLO's operations to ensure that the processing of personal
data is in compliance with the Agreement and applicable law. FABBLO commits to
providing reasonable cooperation during the audit, including supplying
necessary information and documentation.
The Customer must provide FABBLO with
written notice of its intention to conduct an audit at least 30 business days
in advance. The audit shall be conducted in a manner that minimizes disruption
to FABBLO's business operations and shall not exceed two (2) business days in
duration.
The Customer shall not receive any data
or confidential information that is not directly relevant to the purposes of
the audit. FABBLO reserves the right to limit access to certain information
pertaining to other customers or business secrets.
11. LEGAL PROCESS
If FABBLO is legally compelled by a court or other government authority to disclose Customer Personal Data, then to the extent permitted by law, FABBLO will promptly provide Customer with sufficient notice of all available details of the legal requirement and reasonably cooperate with Customer’s efforts to challenge the disclosure, seek an appropriate protective order, or pursue such other legal action, as FABBLO deems appropriate.
12. DESTRUCTION OF PERSONAL DATA
Upon termination of the subscription and written request from Customer, FABBLO will delete or anonymize Customer Personal Data, unless prohibited by Applicable Law. Notwithstanding the foregoing, nothing will oblige FABBLO to delete or anonymize Customer Personal Data from files created for security, backup and business continuity purposes sooner than required by FABBLOs' data retention processes. Any Customer Personal Data that may be retained beyond the duration of the Agreement will still be protected in accordance with this DPA and FABBLO shall not process such Customer Personal Data except as strictly permitted under Applicable Law.
13. APPLICABILITY AND ORDER OF PRECEDENCE
This DPA replaces any existing data processing addendum the Parties may have previously entered into in connection with the Agreement. In the event of a conflict between the terms of the Agreement and this DPA, the terms of the DPA will apply. In the event of a conflict between this DPA and the applicable Standard Contractual Clauses, the Standard Contractual Clauses will apply.
ANNEXES I AND II of the EU SCCs.
1. List of Parties
1.1.1. Module Two: Transfer Controller to Processor
1.1.2. Module Three: Transfer Processor to Processor
1.2. Data exporter(s):
1.2.1. Name: The exporter is the Customer specified in
the Agreement.
1.2.2. Address: specified at FABBLO subscription (aka registration) form
1.2.3. Contact person’s name, position and contact details: as specified at FABBLO registration form when making the subscription
1.2.4. Activities relevant to the data transferred under
these Sections: Obtaining the Services from data importer.
1.2.5. Role (Controller/Processor): Controller
1.3.
Data importer(s):
1.3.1. Name: FABBLO
1.3.2. Address: Hermanninsaarentie 3, 06400 Porvoo, Finland
1.3.3. Contact person’s name, position and contact details: Maj Sirén, owner of Sirea, email@fabblo.com
1.3.4. Activities relevant to the data transferred under
these Sections: Providing the Services to data exporter.
1.3.5. Role (Controller/Processor): Processor
2. Description of Transfer
2.1.
Module Two: Transfer Controller to Processor
2.2.
Module Three: Transfer Processor to Processor
3. Categories of data subjects whose personal data
is transferred
3.1. Data subjects whose Personal Data is uploaded by data exporter to, or otherwise received directly or indirectly from data exporter by or through, the Services, or provided by data exporter to FABBLO to input into the Services.
4. Categories of personal data transferred
4.1.
The data exporter may transfer Personal Data to
FABBLO, the extent of which is determined and controlled by the data exporter
in its sole discretion. Such Personal Data may include any category of Personal
Data the data exporter may enter into the Services.In particular, Account
Holders/Business Owners: Full Name, Email Address, Profile Picture (optional),
Business Name, Website URL and Website Visitors:Name (if provided), Email
Address (if provided), IP Address, Chat Transcript, Browser Type and Version, Device
Information.
4.2.
Sensitive data transferred and applied
restrictions or safeguards that fully take into consideration the nature of the
data and the risks involved, such as for instance strict purpose limitation,
access restrictions (including access only for staff having followed
specialised training), keeping a record of access to the data, restrictions for
onward transfers or additional security measures.
4.2.1 Not anticipated
5. The frequency of the transfer (e.g. whether the
data is transferred on a one-off or continuous basis)
5.1. Continuously, for the length of the subscription period between the Parties.
6. Nature of the processing
6.1 Customer Personal Data transferred will be processed to (i) provide the Services to the data exporter and fulfill the data importer’s obligations under the Agreement; and (ii) comply with applicable law
7. Purpose(s) of the data transfer and further
processing
7.1. Customer Personal Data transferred will be processed to (i) provide the Services to the data exporter and fulfill the data importer’s obligations under the Agreement; and (ii) comply with applicable law.
8. The period for which the personal data will be
retained, or, if that is not possible, the criteria used to determine that
period
8.1. Customer Personal Data will be retained for the length of time necessary to provide Services under the subscription and in accordance with [FABBLOs' data retention processes and as otherwise required by applicable law.
9. For transfers to (sub-)processors, also specify
subject matter, nature and duration of the processing
9.1. FABBLOs' sub-processors will process Customer Personal Data to assist FABBLO in providing the Services pursuant to the Agreement, for as long as needed for FABBLO to provide the Services.
10. Competent Supervisory Authority
10.1. Module Two: Transfer Controller to Processor
10.2. Module Three: Transfer Processor to Processor
11. Identify the competent supervisory authority/ies in accordance with Section 13.
1.1. The Parties will follow the rules for identifying such authority under Section 13 and, to the extent legally permissible, select the Information Commissioner's Office (ICO).
SCHEDULE 2
TECHNICAL AND ORGANIZATIONAL MEASURES
Technical and Organizational Measures Including Technical and Organizational Measures to Ensure the Security of the Data
1.1. Module Two: Transfer Controller to Processor
1.2. Module Three: Transfer Processor to Processor
Description of the technical and organizational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
1. ACCESS CONTROLS
1.1.
Control Measures
FABBLO has implemented reasonable system access
controls and physical access controls designed to limit access based on
authorization and prevent personnel and others who should not have access from
obtaining access to FABBLO systems housing Customer Data.
1.2.
System Access Controls
1.2.1. FABBLO's system access control measures include
the following:
1.2.1.1. restricting unauthorized
users from accessing information not needed for their roles through role-based
user access, and using "least privileged" principles;
1.2.1.2. unique user accounts identifiable to individual
users, password requirements, and Auth0 authentication;
1.2.1.3. provisioning and removal of employee access to
Customer Data when access is no longer required; and
1.2.1.4. periodic access reviews to ensure that only
FABBLO personnel who still require access to Customer Data have such access.
1.2.1.5 utilizing cloud hosting infrastructure for the Services, with all
physical security controls managed by the cloud hosting provider.
2. OPERATIONS MANAGEMENT AND
NETWORK SECURITY
2.1. The chosen cloud service provider establishes and
maintains reasonable operations management and network security measures,
including:
2.1.1. network segmentation based on the
label or classification level of the information stored;
2.1.2. protection of servers and web
applications using restrictive firewalls; and
2.1.3. regular review, testing, and
installation of security updates and patches to servers.
3. CHANGE MANAGEMENT
3.1.
Change and Release Management
3.1.1. FABBLO acknowledges
that its chosen cloud service provider maintains a structured
process for managing software, system, and configuration changes, which
includes:
3.1.1.1. testing and approval processes for changes before deployment to
production; and
3.1.1.2. security assessments for significant updates to identify potential
vulnerabilities
3.2.
Secure Application Development
3.2.1. FABBLO collaborates with its cloud service provider to ensure that secure application development policies and
standards are followed, aligned with industry best practices, including the
OWASP Top 10. The provider maintains transparency through an accessible development
roadmap and a bug reporting system for the reseller community.
4. DATA ENCRYPTION AND DELETION
4.1.
FABBLO ensures that its cloud service provider implements robust data encryption practices to protect Customer Data, including:
4.1.1. encryption of Customer Data while at rest, utilizing industry best practice encryption standards and methods to safeguard stored information.
4.1.2. encryption of Customer Data while in transit, employing industry-standard encryption methods designed to secure communications between the provider’s servers and customer browsers.
4.2. Information Protection
4.2.1. The cloud service provider utilizes cryptographic controls and approved algorithms for information protection within the service environment, adhering to relevant security policies and standards.
4.3. Workstation Security
4.3.1. Employee workstations are secured with strong passwords, and screen lockout measures to prevent unauthorized access.
4.4. Data Deletion Practices
4.4.1. FABBLO relies on its cloud service provider to maintain policies and procedures regarding the deletion of Customer Data in accordance with applicable laws and NIST guidance. Customer Data is deleted upon customer request and removed from the cloud service provider's servers.
5. SUB-PROCESSORS
5.1. Use
of Sub-Processors
5.1.1. FABBLO acknowledges that its
chosen cloud service provider utilizes certain sub-processors to assist in
delivering the Services. These sub-processors may have access to Customer Data
as part of their role in providing the service.
5.2. Assessment
and Oversight
5.2.1. Prior to engaging any sub-processor,
the cloud service provider conducts thorough assessments of their security and
privacy practices to ensure they align with the necessary standards for data
protection.
5.3. Written
Agreements
The cloud service
provider enters into written agreements with each sub-processor, which include obligations
related to privacy, data protection, and data security. They ensure that all
sub-processors meet the necessary compliance and security standards. This
includes:
- Vetting all sub-processors to ensure they adhere to GDPR and other applicable
regulations.
- Working only with providers that have strong security certifications (e.g.,
ISO 27001, SOC 2).
- Including data protection clauses in contracts with all sub-processors.
6. SYSTEM MONITORING AND VULNERABILITY MANAGEMENT
6.1 FABBLO's chosen cloud service provider regularly monitors its production
environment for unauthorized intrusions, vulnerabilities, and related threats.
The monitoring measures implemented by the provider includes:
6.1.1. use of intrusion detection methods to prevent and
identify potential security attacks from users outside the boundaries of the
system;
6.1.2. performance of automated application and
infrastructure vulnerability scans to identify vulnerabilities, classification
of vulnerabilities using industry standards, and remediation of vulnerabilities
based on severity level;
6.1.3. annual third-party penetration testing;
6.1.4. annual risk assessments and continuous monitoring;
6.1.5. periodic third-party security audits;
6.1.6. monitoring, logging, and reporting on critical or
suspicious activities with regard to network devices, including retention of
logs for forensic-related analysis, maintenance of audit logs that record and
examine activity within production environment, back-up of logs in
real-time, and implementation of controls to prevent modification or tampering
of logs;
6.1.7. operation of a “bug bounty” program to
identify potential security vulnerabilities; and
6.1.8. deployment of anti-virus and malware tools to
detect and remediate harmful code or programs that can negatively impact the
Services.
6.1.9. FABBLO implements its own
security measures, including the use of antivirus software, screen lockout measures and firewalls on its
equipment, to protect against unauthorized access and malware threats.
6.2. Customer
Assurance
6.2.1. FABBLO is committed to keeping customers
informed about the security measures implemented by both FABBLO and its cloud
service provider, ensuring transparency and confidence in the integrity of the
services offered.
7. PERSONNEL CONTROLS
7.1. FABBLO
implements reasonable measures to ensure the reliability of its personnel who
have access to Customer Data, including:
7.1.1. Providing security training to
all employees upon hiring, which includes an overview of FABBLO's commitment to
information security;
7.1.2. Mandating annual privacy and
security training to reinforce the importance of protecting Customer Data and
to educate on best practices in privacy and security;
7.1.3. Instructing employees to
promptly report any potential personal data breaches to the designated Security
contact;
7.1.4. Establishing disciplinary
measures for violations of FABBLO's information security practices to maintain
a culture of compliance and security awareness.
8. BACKUPS, BUSINESS CONTINUITY, AND DISASTER RECOVERY
8.1. Backups
8.1.1. FABBLO's cloud service provider
manages backups of Customer Data, ensuring robust measures are in place to
maintain data integrity and availability.
8.2. Business Continuity and Disaster
Recovery
8.2.1. The cloud service provider is
responsible for implementing business continuity and disaster recovery plans
designed to minimize service disruption and ensure the protection of Customer
Data. These plans facilitate prompt restoration of services in the event of a
failure or disaster.
8.2.2 The cloud service provider conducts regular
testing of its disaster recovery plan to ensure its effectiveness and updates
the plan as necessary to address any changes in the operational environment.
8.3. Customer
Assurance
8.3.1. FABBLO is committed to providing
customers with information regarding the backup and disaster recovery measures
implemented by the cloud service provider, thereby ensuring transparency and
confidence in the security of Customer Data.
ADDENDUM
We
use content or service offers of third-party providers on the basis of our
legitimate interests in order to integrate their content and services
(“services”). This always requires that the third-party providers of this
content are aware of the IP address of the user, as without the IP address they
would not be able to send the content to their browser.
The
IP address is therefore necessary for the display of this content. The
following provides an overview of third-party providers and their content,
together with links to their privacy policies, which contain further
information on the processing of data and so-called opt-out measures, if any. This list of
third-party providers may include, but is not limited to, the following
companies. While FABBLO does not utilize these platforms directly, our clients
may integrate them to pull public reviews they have received into the FABBLO
app. This ensures transparency about the services available and how they manage
user data, which is essential for compliance with data protection regulations.
This list ensures transparency about the third-party services we use, but not limited, and how they handle user data, which is crucial for compliance with data protection regulations.
Maj Sirén
SIREA
04.02.2025, when this document was last updated