Comprehensive Pre-Filled Request For Information For Convert Experiences

N/A

N/A

No

No

No

N/A

No

N/A

We have in place a Business Continuity policy

N/A

We are an A/B testing software company so you will use the software to A/B test its websites

app.convert.com, convert.com, support.convert.com

A/B testing and optimization vendor

N/A

No

No

N/A

convert.com/pricing

Yes/No

No

No

No

No

No

Yes

Yes

Yes

Yes

Yes

No

No

Yes

Yes

N/A

None

N/A

N/A

We rely on Amazon Web Services who is responsible for protecting the global infrastructure that runs all of the services offered in the AWS cloud. This infrastructure is comprised of the hardware, software, networking, and facilities that run AWS services.

We rely on Amazon Web Services who is responsible for protecting the global infrastructure that runs all of the services offered in the AWS cloud. This infrastructure is comprised of the hardware, software, networking, and facilities that run AWS services.

Live Logs in Convert track how end users are interacting with web pages and experiments on them at a project and experiment level in real time. They capture information like timestamp when a goal triggered, the event type that was triggered, variation displayed to the end user and many more details. Live logs are different from the logs that are kept here: logs.convertexperimetns.com. These are used for debugging purposes and are kept only for 7 days.

We rely on Amazon Web Services who is responsible for protecting the global infrastructure that runs all of the services offered in the AWS cloud. This infrastructure is comprised of the hardware, software, networking, and facilities that run AWS services.

We rely on Amazon Web Services who is responsible for protecting the global infrastructure that runs all of the services offered in the AWS cloud. This infrastructure is comprised of the hardware, software, networking, and facilities that run AWS services.

Business Continuity is managed as part of the Emergency Management Plan to ensure seamless follow up of an emergency and continuity of services.

This Plan takes into account several incidents that may be minor/localised (levels 1 or 2a) incidents or (levels 2b or 3) emergencies.

• Serious Staff Incident
• Utilities Failure
• Pandemic / Serious Outbreak of Infectious Disease
• Data Network Failure
• IT Systems Failure
• Fraud
• Personal Data Security Breach
• Serious Blog/Social Network Incident
• Competitors move faster in technology
• Losing of connectivity between people because of a natural disaster
• Large lawsuit by customer
• DDOS attacks
• Financial disaster (Wall Street)
• Bus-Factor: One person does it all
• Free competitor comes in with similar standards
• Third parties that we rely on

These have been identified as the main incidents after a Pre-Mortem Analysis.

Our Incident Management Program (network, computers and data) consists of

• Identify the essential elements of what is required to attain compliance or successful cybersecurity resilience
• Assess: Gauge and evaluate Convert Insights state of protection mechanisms, gaps and opportunities for improvement.
• Develop: This step involves the set of activities required to draft and test the adoption of the cybersecurity strategy, policy and set of actions to manage cyber security. The overall set of documents include know-how, know-what knowledge on areas such as surveillance and monitoring of threats, security audits, vulnerability assessments, incident handling and reporting, risk management, business continuity and more.
• Train: After development, we create awareness of the Program by providing training to relevant stakeholders.
• Continuously monitor the internal and external environment for changes or developments.

Convert’s Data Management Policy defines three roles for accessing data:

• Data Controller who has the responsibility to ensure that appropriate data management policies are in place so that the data owners can ensure they are compliant with legislation to the best of their ability.
• Data Owner who authorise the access and use of data, regularly review access privileges, assess the risks, ensure that appropriate contingency plans are in place to safeguard the data.
• Data Custodian to whom in some cases data will be entrusted (e.g. an individual or a third party company) for the purposes of storage and/or processing.

Using VPN and AWS console

No

https://www.convert.com/features/ab-testing/api/, https://api.convert.com/doc/v2/

No

We do not integrate with IDEs yet

https://support.convert.com/hc/en-us/articles/360044054271-How-to-enable-SSO-Login-feature-for-my-Convert-account-

https://support.convert.com/hc/en-us/articles/204871655-Add-and-Track-Social-Sharing-Buttons

We can integrate with many third party tools by using this: https://support.convert.com/hc/en-us/articles/360042473452

Depends on the platform and what options they have for custom js tracking

None to little as we usually integrate by a click of a button via the UI

No

Not yet but we can check if you are interested into this

Javascript and custom events, data layers

We do not integrate with those yet

No

JavaScript

By using the Visual and Code Editors

Convert is an A/B testing platform so does not interact with the backend

N/A

Yes

No

No

Yes

Yes

N/A

N/A

No

N/A

N/A

We rely on AWS

We rely on Akamai

Yes we rely AWS cloud services

None

Business Continuity is managed as part of the Emergency Management Plan to ensure seamless follow up of an emergency and continuity of services. This Plan takes into account several incidents that may be minor/localised (levels 1 or 2a) incidents or (levels 2b or 3) emergencies.

• Serious Staff Incident
• Utilities Failure
• Pandemic / Serious Outbreak of Infectious Disease
• Data Network Failure
• IT Systems Failure
• Fraud
• Personal Data Security Breach
• Serious Blog/Social Network Incident
• Competitors move faster in technology
• Losing of connectivity between people because of a natural disaster
• Large lawsuit by customer
• DDOS attacks
• Financial disaster (Wall Street)
• Bus-Factor: One person does it all
• Free competitor comes in with similar standards
• Third parties that we rely on

These have been identified as the main incidents after a Pre-Mortem Analysis

No extra costs, uptime is here: http://status.convert.com/

N/A

With the Visual Editor

Via the Collaborators and granural permission levels

N/A

There is no specific timeline, as we receive an integration request we work on this the soonest possible

Information We Collect When You Register and Create An Account
Visitors to our website (convert.com) (the ""Site"") may read information about us and our products and services without revealing any personally identifiable information. However, in order to become a customer, you must create an account and set up a profile. When you do this, we ask for your name, your organization's name, its street address and your e-mail address. We also require you to select a password. Once you are a registered user you can update your profile and you may elect to provide additional information (e.g. a nickname and certain user preferences).

Information We Collect When You Register for a Webinar
Visitors or Customers can register for a webinar. Here we store the email address to share the webinar details.

Information We Collect When You Request the Newsletter
Visitors or Customers can sign up to receive our Newsletter. Here we store the email address to share the Newsletter on a monthly basis.

Information We Collect From Your Websites
The Services we provide consist of tracking visits to your website and collecting information about the behavior of those visitors. The data we collect helps you optimize your website and to use it strategically. This data may include the web addresses (URLs) of pages visited, the URLs of web pages that referred your visitors to your website, details about the web browsers that visitors to your website use to browse your website, the operating systems used by those visitors, the number of screen colors and the screen resolution used by the visitors to view your websites, and external geodata elements connected to your visitors' ip address (including country, city, region, etc.). Our Services are organized so that our customers can specify the categories of data they wish to receive. The aforementioned categories of information do not necessarily enable us or others to identify you or the visitors to your website. However, if the URLs we collect contain information that in themselves identify personally identifiable information, such as a name or phone number, or if they link to pages that contain personally identifiable information, then we may collect that information as well.

Notes for transparency:
On by default

• Currently session cookie ID (timeout 20 minutes on cookie and server cache).
• Currently falling under performance cookies in our interpretation of GDPR / ePrivacy Directive and ePrivacy Regulations.

Off by default

• When cross browser targeting is turned on by the customers we insert unique cookie in URL to pick-up on the other domain (could be interpreted by GDPR as personal data). This feature is off by default as part of our privacy by default policy.
• When a unique visitor IDs are given by the customer to replace session IDs this could be interpreted as personal data This feature is off by default as part of our privacy by default policy.
• When geotargeting is used (not on my default) we could store country, region and city in CDN or server cache for correct targeting.

Other Information We Collect
Our Services allow our customers to transmit and store additional information on our servers. This additional information can be anything, including personally identifiable information, except that we don't permit URLs or internet addresses to be stored. We have no control over what information is transmitted by our customers to our servers. Our customers may also request that we receive personally identifiable information that has been rightfully obtained by those customers, such as the email addresses of those who visit their websites and the information that visitors to their websites choose to post.

Cookies
A "cookie" is a small data file that can be placed on your hard drive when you visit certain websites. We use cookies to identify visitors who browse our customers' websites. These cookies contain an identifier that identifies each such visitor anonymously in order to analyze his or her past behavior in relation to your website. None of our cookies contain or collect personally identifiable information. Info below:
_conv_s
convert.com
This cookie contains an ID string on the current session. This contains non-personal information on what subpages the visitor enters – this information is used to optimize the visitor's experience.
1 day
HTTP Cookie, 1st party cookie, Strictly Necessary
_conv_v
convert.com
This cookie is used to identify the frequency of visits and how long the visitor is on the website. The cookie is also used to determine how many and which subpages the visitor visits on a website – this information can be used by the website to optimize the domain and its subpages.
6 months (or 7 days if ITP 2.1 applies)
HTTP Cookie, 1st party cookie, Strictly Necessary

We are using European carbon neutral servers on AWS Cloud based in Frankfurt so it is Europe based.

We do not have such an official compliance certificate but we are planning to obtain one in the next 2 years. At the moment we rely on AWS ISO certificates since our servers are on their cloud infrastructure.

For any transfer of personal data outside the European Economic Area to a country which is deemed by the EU to not have an “adequate” level of data protection, we have put in place with our affiliates, with our third party service providers, and with our customers, the necessary safeguards and mechanisms to ensure that such transfers comply with applicable data protection laws.

These safeguards include the EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework (EU-US DPF) and the UK Extension to the EU-US DPF. In addition, we may institute in the future, in our discretion, other lawfully approved mechanisms such as Binding Corporate Rules and Codes of Conduct. For transfers to third party service providers, we ensure that such entity maintains appropriate safeguards and shall have in place required data protection terms to ensure protection of personal data to the same degree as required of Convert.

We make it easy for our customers to formalize and share with their stakeholders, including employees, customers and potential auditors, that they use Convert Experiences in a way that meets GDPR data processing obligations.

The Data Processing Agreement (DPA) is an easy-to-execute document that only requires an electronic signature from the customer. For reference, please visit this https://www.convert.com/gdpr/dpa/.

Yes, access to systems is based on specific roles and duties of each role and is reviewed frequently.

Yes

Our cloud infrastructure (AWS) takes care of it.

Our cloud infrastructure (AWS) takes care of it.

• All passwords should be reasonably complex and difficult for unauthorized people to guess. members should choose passwords that are at least eight characters long and contain a combination of upper- and lower-case letters, numbers, and punctuation marks and other special characters. These requirements will be enforced with software when possible.
• In addition to meeting those requirements, members should also use common sense when choosing passwords. They must avoid basic combinations that are easy to crack. For instance, choices like “password,” “password1” and “Pa$$w0rd” are equally bad from a security perspective.
• A password should be unique, with meaning only to the members who choose it. That means dictionary words, common phrases and even names should be avoided. One recommended method to choosing a strong password that is still easy to remember: Pick a phrase, take its initials and replace some of those letters with numbers and other characters and mix up the capitalization. For example, the phrase “This may be one way to remember” can become “TmB0WTr!”.
• Members must choose unique passwords for all of their company accounts, and may not use a password that they are already using for a personal account.
• All passwords must be changed annually, with a higher frequency varying based on the sensitivity of the account in question. This requirement will be enforced using software when possible.
• If the security of a password is in doubt– for example, if it appears that an unauthorized person has logged in to the account — the password must be changed immediately.
• Default passwords — such as those created for new members when they start or those that protect new systems when they’re initially set up — must be changed as quickly as possible.

Our cloud infrastructure (AWS) takes care of it.

No

Yes - Dionysia Kontotasiou, Head of Privacy & Security, dionysia@convert.com

Yes - Yes, penetration tests are being conducted every 12 months by an independent external third party.

Yes

Yes

If a member of Convert Insights considers that a security breach has occurred, this must be reported immediately. Part 1 of the Security Breach Report Form should be completed without delay. Part 1 of the Report Form will assist in conducting an initial assessment of the incident by establishing:
if a security breach has taken place; if so:
what data and systems are involved in the breach;
the cause of the breach;
the extent of the breach (how many individuals are affected);
the harms to affected individuals that could potentially be caused by the breach;
how the breach can be contained.
Following this initial assessment of the incident, an appropriate Lead Investigator is appointed to investigate the incident and will decide if it is also necessary to appoint a group of relevant stakeholders to assist with the investigation. The Lead Investigator will determine the severity of the incident and by completing part 2 of the Security Breach Report Form (i.e. s/he will decide if the incident can be managed and controlled locally or if it is necessary to escalate the incident to the Emergency Management Team. The severity of the incident will be categorised as level 1, 2a, 2b or 3

Yes

Yes we have a Data Management Policy in place

Yes

Yes - We have a Data Retention schedule written as a policy.

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes - For international data transfers we rely on the EU-US Data Privacy Framework (EU-US DPF), the UK Extension to the EU-US DPF and EU Standard Contractual Clauses (SCCs)

No

Yes

Yes

Yes - Convert Insights operates a strict “notice and takedown” procedure. Users are encouraged to be vigilant and to report any suspected violations of the Data protection Policies immediately to support@convert.com. On receipt of notice (or where Convert Insights otherwise becomes aware) of any suspected breach of these Policies, Convert Insights reserves the following rights: to remove, or require the removal of, any content which is deemed to be in breach or potentially in breach of these Policies; and/or to disable any User and access to Convert Insights IT Resources. If any breach of these Policies is observed, then (in addition to the above) disciplinary action up to and including dismissal in the case of Staff or contract termination in the case of third parties may be taken.

Yes

Dionysia Kontotasiou

Yes, our Information Security Program (data in any format) consists of:

Understanding the Data: to properly approach information security, Convert Insights first needs to understand the types of information it collects and stores.

Performing a Risk Assessment: A risk assessment is a key tool for determining where systems may be vulnerable to a security incident.

Determining Legal Requirements: our Information Security Program is developed by reference to our legal compliance obligations.

Developing Policies and Internal Controls: We created and maintain the policies and internal controls that ensure Convert Insights is complying with key laws and regulations on an ongoing basis. Key policies and internal controls are described in point 3.

Addressing Ongoing Compliance: Key components of ensuring ongoing compliance include: (i) Providing security training and awareness programs (ii) Monitoring and auditing compliance efforts and benchmarking against the security compliance plan (iii) Evaluating and revising program controls, policies and protocols.

• Generic Policy Framework
• Acceptable Usage Policy
• IT Security Policy
• Web and Social Media Policy
• Emergency Management Plan
• Employee Password Policy
• Open Source Software License Policy
• Privacy and Security Checklist for GDPR Compliance when selecting third party software
• Staff Information Security Training Policy

Convert Insights reserves the right to amend these Policies at any time in any manner in which sees fit at the absolute discretion of the Company. Any such revisions are noted in the revision history of each policy. Policies are reviewed at least annually, to determine whether it requires revision in light of new threats or technologies.

May 2018

Staff Information Security Training Policy sets out the training that Convert Insights staff will be provided with to ensure that all handling of information is compliant with the General Data Protection Regulation (GDPR).

In general training for all data users cover these areas:

• IT Security awareness strategy is delivered through multiple methods with the aim of raising user awareness and highlighting end user responsibilities.
• Scheduled targeted Security Awareness Training sessions are available on demand in conjunction with Data Protection training.
• On staff induction new hires are briefed on the Data Protection Policy and the IT Security Policy.

We use these processes to ensure that information security policies are in place:

There is someone with specific responsibility for Information Security in Convert Insights.

All staff receive annual awareness of the Information Security Regulations.

Everyone managing and handling information understands that they are directly and personally responsible for following good information security practice.

Only staff who need access to information as part of their duties are authorised to do so.

Everyone managing and handling information is appropriately supervised.

Methods of handling information are clearly described.

An audit of information is conducted on an annual basis. This includes an assessment and evaluation to ensure that all information held is accurate and up to date and that adequate controls are in place to ensure information is managed and stored appropriately.

A copy of Information Security Policies are given to all new members of staff.

Procedures for selecting appropriate third-party service providers and obtaining written agreements from them to ensure that information receives adequate security and protection.

Reasonably up-to-date network firewall protection.

Reasonably up-to-date virus and malware protection.

Routine monitoring of computer systems for unauthorized access.

Convert Insights operates a strict “notice and takedown” procedure. Users are encouraged to be vigilant and to report any suspected violations of the Information Security Policies immediately to support@convert.com. On receipt of notice (or where Convert Insights otherwise becomes aware) of any suspected violation of these Policies, Convert Insights reserves the following rights: to remove, or require the removal of, any content which is deemed to be in breach or potentially in breach of these Policies; and/or to disable any User and access to Convert Insights IT Resources. If any breach of these Policies is observed, then (in addition to the above) disciplinary action up to and including dismissal in the case of Staff or contract termination in the case of third parties may be taken.

Convert Insights endeavours, at all times, to ensure consistent, high quality implementations and management of its IT resources, processes and practices. A comprehensive framework of well-defined policies, procedures and standards are required to facilitate and ensure this. In developing the IT policies, procedures and standards for Convert Insights, due regard and consideration has been given to the ISO 27000 series of standards which have been specifically reserved by ISO (International Standards Organisation) for information security matters. It is not intended that Convert Insights seeks to be compliant with all aspects of the relevant ISO information security standards as this would not be appropriate in all instances. However, it is intended that Convert Insights would aspire to implement policies, standards and procedures which are consistent with key aspects of the standards.

We rely on Amazon Web Services who is responsible for protecting the global infrastructure that runs all of the services offered in the AWS cloud. This infrastructure is comprised of the hardware, software, networking, and facilities that run AWS services.

Regarding the physical security measures, AWS data centers are housed in nondescript facilities. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.

AWS only provides data center access and information to employees and contractors who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical access to data centers by AWS employees is logged and audited routinely.

Details from AWS are presented here: https://d0.awsstatic.com/whitepapers/aws-security-whitepaper.pdf

No, access is only restricted to Convert Insights members as defined in our IT Security Policy.

Yes, Convert Insights is a remote distributed team. Several policies are in place to secure remote connectivity:

• IT Security Policy
• Web and Social Media Policy
• Employee Password Policy
• Open Source Software License Policy
• Privacy and Security Checklist for GDPR Compliance when selecting and installing third party software

Yes, antivirus is compulsory pre-requisite for any computer joining the Convert Insights network as described in our IT Security Policy.

We rely on AWS tools for this. Amazon Inspector automatically assesses vulnerabilities and deviations from best practices. AWS Systems Manager and specifically Patch Manager automatically apply patches in a timely manner.

We have requested a Vulnerability and Penetration testing from AWS.

All Convert Insights laptops must have their internal hard drive encrypted.

All Convert Insights mobile devices that host Convert Insights data (email) must be protected by encryption and layered authentication where appropriate.

Where sensitive information is transmitted through a public network to an external third party the information must be encrypted first and sent via secure channels (SFTP, SSH, HTTPS, VPN etc.)

Yes, access to systems is based on specific roles and duties of each role and is reviewed frequently.

Yes, all individuals have a unique user ID (end users, DBA’s, network admin, programmers) for their personal and sole use so that activities can be traced to the responsible person as indicated in our IT Security Policy.

N/A

To protect data from falling into the wrong hands, it’s important that Data Controllers and Data Owners (as defined in Data Management Policy) understand which users have access and why these users need access to systems and data. The decision process for users to gain access to systems and data is based on the need-to-know principle, which is that access to data must be necessary for the conduct of the users’ job functions.

Yes, Convert Insights Inc. is PCI-DSS compliant. Convert Insights Inc. isn’t itself SOC compliant, but our datacenter providers are (AWS/Hetzner). Customers interested in SOC reports concerning the cloud infrastructure providers utilized by our services can obtain the reports directly from the respective providers.

Yes, our Cyber Security Program (network, computers and data) consists of:

• Identify the essential elements of what is required to attain compliance or successful cybersecurity resilience.
• Assess: Gauge and evaluate Convert Insights state of protection mechanisms, gaps and opportunities for improvement.
• Develop: This step involves the set of activities required to draft and test the adoption of the cybersecurity strategy, policy and set of actions to manage cyber security. The overall set of documents include know-how, know-what knowledge on areas such as surveillance and monitoring of threats, security audits, vulnerability assessments, incident handling and reporting, risk management, business continuity and more.
• Train: After development, we create awareness of the Program by providing training to relevant stakeholders.
• Continuously monitor the internal and external environment for changes or developments.

Yes, we have listed the key cyber security risks, just to name a few here:

• Data loss or theft
• Compliance/regulatory incidents
• Social engineering attacks
• Impersonations
• Lack of Policies
• Human factor
• Bring your Own Device (BYOD)
• Lack of training and awareness
• Lack of recovery plan
• Aging infrastructure
• Passwords
• Third party service providers
• Hacking (DDOS, Cookies theft)
• These risks are reviewed and updated twice annually.

May 2018

This is planned for Q4 2018.

If a member of Convert Insights considers that a security breach has occurred, this must be reported immediately. Part 1 of the Security Breach Report Form should be completed without delay. Part 1 of the Report Form will assist in conducting an initial assessment of the incident by establishing: if a security breach has taken place; if so:

• what data and systems are involved in the breach;
• the cause of the breach;
• the extent of the breach (how many individuals are affected);
• the harms to affected individuals that could potentially be caused by the breach;
• how the breach can be contained

Following this initial assessment of the incident, an appropriate Lead Investigator is appointed to investigate the incident and will decide if it is also necessary to appoint a group of relevant stakeholders to assist with the investigation. The Lead Investigator will determine the severity of the incident and by completing part 2 of the Security Breach Report Form (i.e. s/he will decide if the incident can be managed and controlled locally or if it is necessary to escalate the incident to the Emergency Management Team. The severity of the incident will be categorised as level 1, 2a, 2b or 3.

Yes. security events are closely tied to the applications that are affected.

Our Incident Response Plan involves the Emergency Management Team [EMT].

The Emergency Management Team [EMT] has full responsibility for the response to and management of a major emergency. In the event of the EMP being activated, all staff will work under the direction of the EMT. Members of the EMT and staff with specific responsibilities will receive appropriate formal training in Emergency Management and related responsibilities. It is the responsibility of senior managers to ensure that staff members are aware of their responsibilities.

The Chair of EMT is responsible for the overall management of emergency coordination and response for Convert Insights.

Core members of EMT have specific duties as outlined in our Emergency Management Plan.

On the basis of the evaluation of risks and consequences, the Lead Investigator, and others involved in the incident as appropriate, will determine whether it is necessary to notify the incident to others outside Convert Insights. For example: individuals (data subjects) affected by the incident; other bodies such as regulatory bodies, the press/media; external legal advisers.

As well as deciding Who to notify, the Lead Investigator must consider: What is the message that needs to be put across? In each case, the notification should include as a minimum:

• a description of how and when the incident occurred;
• what data and IT assets were involved;
• what action has been taken to respond to the risks posed by the incident.

How to communicate the message? What is the most appropriate method of notification (e.g. are there large numbers of people involved? Does the incident involve sensitive data? Is it necessary to write to each individual affected? Is it necessary to seek legal advice on the wording of the communication?).

Why are we notifying? Notification should have a clear purpose, e.g. to enable individuals who may have been affected to take steps to protect themselves (e.g. by cancelling a credit card or changing a password), to allow regulatory bodies to perform their functions, provide advice and deal with complaints, etc.

Convert Insights is obliged under the General Data Protection Regulation Article 33 to keep personal data safe and secure and to respond promptly (within 72 hours) and appropriately to data security breaches.

Yes, we have an internal procedure on how to report the incidents and keep them in a central place for Policies’ improvement.

Yes, in the event of an Emergency incident, Senior Management is notified.

Yes, this lies under notification section and who to notify once the incident takes place.

Yes, responsibility for managing all aspects of external communication and contact with the media following an Emergency rests with the Content Crafter Role within Convert Insights. The Content Crafter will handle all information flow to print and broadcast media following early consultation with the Emergency Management Team (EMT). An early and clear response from Convert Insights is essential to set the tone for subsequent updates. Social media will be used as one of the key communication channels. Security around the incident will be crucial to the control of information flow and message management; therefore media access must be strictly curtailed unless agreed specifically by the EMT.

No

Subsequent to a cyber security breach, a review of the incident by the Lead Investigator will take place to ensure that the steps taken during the incident were appropriate and to identify areas that may need to be improved. The Lead Investigator will send a copy of all cyber security breach reports to the whole team and will use these to compile a central record of incidents. Convert Insights will report on incidents at least on a quarterly basis in order to identify lessons to be learned, patterns of incidents and evidence of weakness and exposures that need to be addressed.

For each serious incident, the Lead Investigator will conduct a review to consider and report on the following:

• What action needs to be taken to reduce the risk of future breaches and minimise their impact?
• Whether policies procedures or reporting lines need to be improved to increase the effectiveness of the response to the breach?
• Are there weak points in security controls that need to be strengthened?
• Are staff and users of services aware of their responsibilities for information security and adequately trained?
• Is additional investment required to reduce exposure and if so what are the resource implications?

Since we did not face any cyber security attacks, there was no need to update the Policies by lessons learnt so far, however we have a standard annual review and the Policies and Procedures are adapted to the new trends whenever needed.

Staff Information Security and Data Protection Training Policies set out the training that Convert Insights staff will be provided with to ensure that all handling of data and IT resources is compliant with the General Data Protection Regulation (GDPR). In general training for all users cover these areas:

• Security
• Data Protection Principles
• Data Subject Rights
• Security Breaches
• Privacy Notices

Additional training is provided for the Development and HR teams.Finally, a checklist is included in the Policies with quick references to what staff need to know regarding Data and Protection and IT resources security.

Yes, our Cyber Security Program (network, computers and data) consists of:

• Identify the essential elements of what is required to attain compliance or successful cybersecurity resilience.
• Assess: Gauge and evaluate Convert Insights state of protection mechanisms, gaps and opportunities for improvement.
• Develop: This step involves the set of activities required to draft and test the adoption of the cybersecurity strategy, policy and set of actions to manage cyber security. The overall set of documents include know-how, know-what knowledge on areas such as surveillance and monitoring of threats, security audits, vulnerability assessments, incident handling and reporting, risk management, business continuity and more.
• Train: After development, we create awareness of the Program by providing training to relevant stakeholders.
• Continuously monitor the internal and external environment for changes or developments.

Yes, Dionysia Kontotasiou, dionysia@convert.com

Yes

Yes

Yes

Yes - Business Continuity is managed as part of the Emergency Management Plan to ensure seamless follow up of an emergency and continuity of services. This Plan takes into account several incidents that may be minor/localised (levels 1 or 2a) incidents or (levels 2b or 3) emergencies.

• Serious Staff Incident
• Utilities Failure
• Pandemic / Serious Outbreak of Infectious Disease
• Data Network Failure
• IT Systems Failure
• Serious Blog/Social Network Incident
• Competitors move faster in technology
• Losing of connectivity between people because of a natural disaster
• Large lawsuit by customer
• DDOS attacks
• Financial disaster (Wall Street)
• Bus-Factor: One person does it all
• Free competitor comes in with similar standards
• Third parties that we rely on
• These have been identified as the main incidents after a Pre-Mortem Analysis

Yes

Yes

No

No

Yes

Yes

Yes

Business Continuity is managed as part of the Emergency Management Plan to ensure seamless follow up of an emergency and continuity of services. This Plan takes into account several incidents that may be minor/localised (levels 1 or 2a) incidents or (levels 2b or 3) emergencies.

• Serious Staff Incident
• Utilities Failure
• Pandemic / Serious Outbreak of Infectious Disease
• Data Network Failure
• IT Systems Failure
• Fraud
• Personal Data Security Breach
• Serious Blog/Social Network Incident
• Competitors move faster in technology
• Losing of connectivity between people because of a natural disaster
• Large lawsuit by customer
• DDOS attacks
• Financial disaster (Wall Street)
• Bus-Factor: One person does it all
• Free competitor comes in with similar standards
• Third parties that we rely on

These have been identified as the main incidents after a Pre-Mortem Analysis.

Yes, Emergency Management Plan and Business Continuity are reviewed and tested at least annually. Last update was in May 2018.

Yes, our cloud infrastructure (AWS) takes care of it.

Yes, our DPO: dionysia@convert.com

Business Continuity is managed as part of the Emergency Management Plan to ensure seamless follow up of an emergency and continuity of services. This Plan takes into account several incidents that may be minor/localised (levels 1 or 2a) incidents or (levels 2b or 3) emergencies.

• Serious Staff Incident
• Utilities Failure
• Pandemic / Serious Outbreak of Infectious Disease
• Data Network Failure
• IT Systems Failure
• Fraud
• Personal Data Security Breach
• Serious Blog/Social Network Incident
• Competitors move faster in technology
• Losing of connectivity between people because of a natural disaster
• Large lawsuit by customer
• DDOS attacks
• Financial disaster (Wall Street)
• Bus-Factor: One person does it all
• Free competitor comes in with similar standards
• Third parties that we rely on

These have been identified as the main incidents after a Pre-Mortem Analysis.

Yes

Yes, managed through AWS

Yes, managed through AWS

Emergency Management Plan and Business Continuity are reviewed and tested at least annually. Last update was in March 2020.

Yes

No

Yes, via Stripe payment processor

Yes