Committing to Compliance

Convert has read the general provisions and definitions as well as the scope of this new legislation. COMPLETED

6 new Data Protection Principles have been introduced:

1. Lawfulness, fairness and transparency
2. Purpose limitations
3. Data minimisation
4. Accuracy
5. Storage limitations
6. Integrity and confidentiality

Convert already raised awareness and made sure that key decision makers are aware that the law is changing and identified areas that could cause compliance problems under the GDPR. COMPLETED

Convert employees who handle personal data of other employees or customers will receive training in order to ensure that they handle changes in accordance with GDPR. Convert should keep a record of training and provide update and refresher training on an annual basis. COMPLETED

Through this, Convert will define new Policies and Procedures, the most common should be:

1. Generic Policy Framework
2. Data Management Policy
3. General Data Protection Policy
4. Data Classification Procedure
5. Staff Data Protection Training Policy
6. Data Access Request Procedure
7. Personal Data Breach Escalation Policy
8. Emergency Management Plan

1. Consent from individual
2. Contract with individual
3. Compliance with a legal obligation
4. Vital interests
5. Public task
6. Legitimate interest

Convert will:

1. Audit the use of personal data to assess what lawful processing ground(s) it currently relies on and whether they remain valid under the GDPR
2. Train staff so that they are aware of legal processing grounds.

1. Unbundled
2. Active opt-in
3. Granular
4. Named
5. Easy to withdraw
6. Documented
7. No imbalance in the relationship

Our main plan is to review methods for seeking, obtaining and recording consent to ensure compliance.

Convert will implement explicit and affirmative consent through check boxes and clear privacy policies. Convert works together with lawyers to craft policies and terms based on your needs and data processing.

In addition, Convert will track all the actions that users take, from the signup to account deletion, and ensure that each step complies with new laws of consent.

Finally, Convert has in mind these questions to answer when the new consent is applied:

1. Was the consent freely given? Is the consent presented in a manner which is clearly distinguishable from other matters.
2. in an intelligible and easily accessible form, using clear and plain language?
3. Can Convert demonstrate that the data subject gave their consent?
4. Does the data subject have the ability to withdraw their consent?

Create and implement new practices for (i) verifying the age of individuals and (ii) obtaining parental or guardian consent when processing the data of children. COMPLETED

Convert does not keep such data. Data that people enter into Convert app cannot later be used to discriminate against them due to their identity, expression or behavior, thereby restricting the enjoyment of their rights.

In the future, in case it is needed, Convert will only keep special category data for as long as it needs it, once it is no longer needed will securely remove it from its systems in an auditable way. COMPLETED

Convert does not keep such data. COMPLETED

Convert will examine every data subject’s request with respect. However in cases where Convert can prove that the data subject cannot be identified, data subject's rights will be limited. COMPLETED

During data collection, e.g. user registration, Privacy Notices must exist and be clear. COMPLETED

1. access their information;
2. have inaccuracies corrected;
3. have information erased;
4. prevent direct marketing;
5. prevent automated decision making and profiling;
6. data portability.

Convert will enable employees and customers to request their personal data processed by Convert. COMPLETED

Trained personnel will respond to requests within the 1 month timeframe. COMPLETED

Convert acts as a controller and will comply with all corresponding regulations. COMPLETED

Several guidelines will be applied during the software development circle:

1. Training (developers will be trained on Privacy and Security aspects)
2. Design (all data oriented and process oriented design requirements will be driven by GDPR)
3. Coding (developers will use approved tools and frameworks, disable unsafe functions and modules, and regularly carry out static code analysis and code review)
4. Testing (test whether data protection and security requirements are implemented properly will be conducted)
5. Before every release, an Incident Response Plan will be established, and a full security review of the software will be carried out. Release will then be approved and all relevant data from the entire development process will be archived.
6. Maintenance (Convert should be prepared to respond to incidents, personal data breaches, faults and attacks, and be capable of issuing updates, guidelines, and information to users and those affected by the software)

Convert acts as a processor and will comply with all corresponding GDPR regulations. COMPLETED

Article 30 says that these requirements don’t apply to organisations of under 250 employees, in addition Convert Experiences also does not manage personal data at the finish of this roadmap. COMPLETED

Convert will ensure that there are procedures in place to detect, investigate and report on personal data breaches within 72 hours of becoming aware of it. COMPLETED

Privacy Impact Assessment (PIA): If you are using "new technologies" which process personal data which is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall carry out an assessment of the protection of personal data.

Prior Consultation: Data controllers should consult the supervisory authority every time a PIA identifies an inherently high risk processing activity.

Not strictly necessary as the type of processing Convert does is unlikely to result in a high risk, but Convert will put a simple PIA in place anyway COMPLETED

Convert won’t need to appoint a DPO (since it it not a large company), but a trained team will be responsible for data protection matters as part of their role. COMPLETED

Convert will find the appropriate Codes of Conducts and Certifications and comply with them. The most “popular” are:

1. ISO 27001 (Information Security Management)
2. ISO 27017 (Cloud Security)
3. ISO 27018 (Cloud Privacy)
4. SSAE16 / ISAE 3402 (SOC 2/3)
5. PCI-DSS (See our Policy here)
6. ISO 9001 (Quality Management)
7. https://cispe.cloud/code-of-conduct/

Convert has read these articles. COMPLETED

Convert has read these articles. COMPLETED

Convert has read these articles. COMPLETED

Convert has read these articles. COMPLETED

Convert has read these articles. COMPLETED