Schedule 2

Compusense Technical and Organizational Measures

The present document describes the technical and organizational measures implemented by Compusense to safeguard the processing of personal data, when security and privacy duties on customer data are in our service scope.

Main purpose of these measures is to:

Document Management

This document will be reviewed on a regular basis to confirm applicability in time and form to any changes in scope and compliance when processing customers personal data.

Measures

Security policies.

Information Security (IS) policies are followed by all Compusense employees. A security awareness and privacy training program are mandatory across the board, compliance scheduled on a yearly basis. All IS policies are reviewed, and when necessary improved, by Compusense Executive Management team at least annually as well.

Regarding any third-party vendor, Compusense reviews their annual Security Audit report to confirm alignment with own IS policies and practices.

Access control.

Measures to ensure only authorized persons gain access and use data processing systems, and that they can only access data approved for their access authorization, are in place. Personal data is not susceptible of being read, copied, modified or removed during processing. Measures are:

Physical access control.

Access to our third-party data centre is restricted and adopting appropriated access controls to all areas where data processing systems reside. Compusense facilities are protected to prevent any unauthorized persons from accessing areas where data processing systems may be in use. Measures include:

Logical access control.

Measures suitable for preventing data processing systems from being used by unauthorized persons are in place and include:

Systems and Network security control.

Security measures for systems and networks handling data processing have been implemented to protect connectivity between all IT systems, which include:

Security Incident management control.

In the event of any security incident, there is an Incident Response plan and the respective response policies to address such an event. Prompt communication to affected parties in case any data breach is part of the standard procedure, adopting local law practices for this type of security incidents, when it might happen. Among the measures in place for this purpose are:

Separation control.

Measures ensure data collected from different customers is not mixed in their processing. These includes:

Pseudonymization or anonymization.

Pseudonymization or anonymization measures on customers data are in place whenever possible. High level of encryption is adopted to protect confidentiality when data is transfer and storage. Pseudonymization aims to use additional information to restore the identity of previously modified data, while anonymization is irreversible: data cannot be restored with its original identifiers.

Input control.

Accuracy and verification of personal data entered into Compusense service offer is out of our scope. Customers are responsible for validating the integrity of any personal data provided for further processing. However, log reviewing is implemented to identify by whom data has been entered, changed or deleted. The integrity of log information is always secured to avoid modifications. Measures for this purpose are:

Availability and Recoverability control.

Measures to ensure that personal data is protected against accidental destruction or loss are implemented. Our third-party data centre offers a state-of-the-art facility with the highest level of backup resiliency (tier III data centre), which alongside with Compusense internal security policies and procedures can guarantee a prompt response and recovery to business-as-usual mode. Example of these measures are:

Threat and Vulnerability control.

Measures are implemented to identify, manage, mitigate and address remediation of any potential vulnerabilities in the Compusense environment. Such measures are:

Review, Assessment and Evaluation control.

Risk is evaluated at regular intervals according to information gathered from different sources, internally and externally to Compusense. Findings are reviewed to assessed risk and mitigation/remediation actions planned accordingly. When changes are required on data processing systems, a change process is implemented which allows full testing and evaluation of updates before residing in the production environment.

Compusense IS policies, procedures and controls are audited yearly to comply with industry data protection practices.

Quality

Quality

Quality test methods are used to evaluate a product based on its sensory attributes and overall consumer perception to ensure it meets certain standards of excellence and consistency. These methods provide a consumer-centric assessment of product quality, ensure consistency and adherence to quality standards and drive continuous improvement and customer satisfaction. Examples include, but are not limited to, Shelf Life, Degree of Difference,

Difference from Control, In/Out, etc.

Quality test methods are used to evaluate a product based on its key attributes to ensure it meets specific standards of excellence for consistency. These methods provide an internal assessment of the product quality to adhere to quality standards and achieve customer satisfaction. Examples include, but are not limited to, Shelf-Life, Degree of Difference, Difference from Control, and In & Out methods.

compusense-logo-black
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.