[et_pb_section fb_built=”1″ theme_builder_area=”post_content” _builder_version=”4.27.4″ _module_preset=”default”][et_pb_row _builder_version=”4.27.3″ _module_preset=”default” custom_margin=”||||false|false” custom_padding=”0px||||false|false” locked=”off” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.27.0″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_text_color=”#FFFFFF” header_2_font=”ABC Sans Regular||||||||” header_2_text_color=”#FFFFFF” header_2_font_size=”40px” background_enable_color=”off” use_background_color_gradient=”on” background_color_gradient_direction=”172deg” background_color_gradient_stops=”#00637d 0%|rgba(255,255,255,0) 55%” background_color_gradient_overlays_image=”on” background_image=”https:\/\/start-placement.com\/wp-content\/uploads\/declare.jpg” background_position=”top_center” background_vertical_offset=”27%” background_blend=”multiply” height=”250px” custom_margin=”||30px||false|false” custom_margin_tablet=”||20px||false|false” custom_margin_phone=”||||false|false” custom_margin_last_edited=”on|tablet” custom_padding=”20px|15px||20px|false|false” hover_enabled=”0″ header_2_font_size_tablet=”36px” header_2_font_size_phone=”30px” header_2_font_size_last_edited=”on|phone” global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n
[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” theme_builder_area=”post_content” column_structure=”2_3,1_3″][et_pb_column _builder_version=”4.27.4″ _module_preset=”default” type=”2_3″ theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″]<\/p>\n
We ensure the implementation of and compliance with the required technical and organisational measures in accordance with \u00a7 32 DSGVO. These include measures to ensure the ongoing confidentiality, availability and resilience of data processing systems and services. Appropriate technical and organisational measures include, for example, the encryption of personal data and strict access control.<\/p>\n
The data protection officer of Startcon GmbH is Peder Iblher. He can be contacted at datenschutz@startcon.berlin for your concerns.<\/p>\n
We use procedures and documentation that provide for regular auditing, assessment and evaluation of the effectiveness of the technical and organisational measures implemented to ensure the security of data processing.<\/p>\n
We conduct training on data protection and data security on a bi-annual basis.<\/p>\n
Physical access to servers is provided by our cloud service provider. Its servers are located within the EU.<\/p>\n
Data media is also only stored in secure locations where strong physical access controls are in place.<\/p>\n
\u2013 Access to all customer services and data is protected by identity management.\u00a0This includes an authorisation concept and strong authentication measures in line with corporate standards. \u2013 All access rights and authorisations for users of the data processing systems are checked and recertified once a year; highly privileged access rights are recertified at least once every six months.<\/p>\n
\u2013 Unsuccessful access attempts are regularly evaluated. \u2013 All servers and workstations have proper security configurations and are continuously checked for vulnerabilities.\u00a0Any vulnerabilities identified are addressed accordingly. \u2013 All services and workstations require a username and password that complies with our password policy: \u2013 All passwords contain upper and lower case letters, special characters and numbers and have at least twelve digits. \u2013 Passwords must not be shared with anyone. All passwords are to be treated as sensitive, confidential information. \u2013 Standard passwords shall not be used or shall be changed immediately. \u2013 All operator-level passwords must be changed at least once every six months. In the case of critical access authorisation, the change must be made once every quarter.<\/p>\n
We ensure that our authorised staff and consultants only access data to which their access authorisation applies: \u2013 Access to resources is only granted if the person in question is authorised to access them. \u2013 User access permissions to systems and data, including supervisor set-up and granting of access rights, are requested, changed or revoked as part of a predefined workflow. \u2013 A user account is exclusively assigned to a specific user. \u2013 All users are assigned to specific groups.<\/p>\n
We ensure that personal data can be verified and confirmed when it is intended to be shared and the parties concerned have provided or submitted their personal data for this purpose. \u2013 All staff are responsible for ensuring that data is communicated only when \u2013 this is done using predefined communication technologies \u2013 a clear lawful or business purpose is pursued \u2013 the relevant staff member has signed a confidentiality agreement accepting responsibility for the protection of data \u2013 this is in accordance with existing confidentiality agreements \u2013 the recipient is authorised to receive the data \u2013 this does not violate the security principles explained during the security training. \u2013 Persons with administrative duties are authorised to communicate directly with servers or applications if \u2013 the connection is secured by strong encryption \u2013 the authenticity of the server or application has been verified. \u2013 Communication of data to employees of non-clients or companies is only permitted if the party concerned can guarantee the security of the data sent. \u2013 The IT infrastructure is protected against unauthorised electronic forwarding by firewalls. \u2013 The IT infrastructure is protected by disabling ports that are not required and by transport protocols.<\/p>\n
We ensure that it is possible to trace whether and by whom personal data have been entered into the data processing systems and whether and by whom these personal data have been changed or deleted. \u2013 The data processing systems can only be used if the users have previously undergone strong identification and authentication controls. \u2013 A backup and retention policy is in place that defines the procedures for data backups and secure data storage during the retention period.<\/p>\n
We ensure that the confidentiality and integrity of data is protected during the transmission of personal data and during the transport of data media: \u2013 Policies and procedures are in place to ensure that \u2013 data sent over public networks is encrypted using strong encryption and valid and correct certificates that are tested at least once a quarter \u2013 all authentication data is encrypted, \u2013 all staff and partners are aware of their responsibilities. \u2013 There is no communication of data in physical form (USB sticks, CDs, etc.).<\/p>\n
We ensure that all functions of the data processing systems are operational and that incidents affecting them are reported by: \u2013 procedures to be applied by an incident management officer, including provisions for escalation procedures and a call tree \u2013 Incident management procedures \u2013 Security Information and Event Management (SIEM) procedures for security breaches, information loss, unauthorised disclosure and other emergencies \u2013 standardised change management and testing procedures to ensure service delivery without interruptions.<\/p>\n
We ensure that stored personal data is not corrupted by system malfunctions through: \u2013 having a redundant data centre infrastructure and a failsafe data centre \u2013 the use of database management techniques that allow for the recovery of data in the event of system malfunctions.<\/p>\n
We ensure that personal data can only be processed in accordance with our instructions and those of our clients by: \u2013 regulating all orders for the processing of personal data in written contracts \u2013 regulating the basic requirements regarding liability, assignment of responsibilities, security requirements and measures, and control rights \u2013 assisting contracting authorities in the exercise of their supervisory rights \u2013 supporting our clients\u2019 data protection officers \u2013 verifying compliance with contractual obligations.<\/p>\n
We ensure that personal data is protected against accidental destruction or loss through business continuity and disaster recovery rules based on a business impact analysis (BIA). Our business impact analysis includes the following: \u2013 the definition of the scope of the assets and an identification of the assets included in that scope \u2013 An identification of the existing or planned IT assets, data and control flows and their respective status. \u2013 an identification of the threats presented, the types of threats and their sources \u2013 an assessment of the impact that a loss of confidentiality, integrity, authenticity or availability could have \u2013 derived protective measures in the event of such an impact. Our Data Protection Centre has implemented appropriate environmental controls, including: \u2013 automatic fire detection mechanisms \u2013 Protective measures against water damage \u2013 Uninterruptible power supply (UPS) units \u2013 Climate and temperature controls \u2013 Monitoring of the environmental conditions of the servers. We ensure that data collected for different purposes is processed separately: \u2013 Separate data processing for different clients \u2013 Access to processing systems only after strong identification and authentication controls are in place for our personnel \u2013 Performance of functional and non-functional tests \u2013 A standardised procedure for error management.<\/p>\n
Berlin in May 2020<\/p>\n
[\/et_pb_text][\/et_pb_column][et_pb_column _builder_version=”4.27.4″ _module_preset=”default” type=”1_3″ theme_builder_area=”post_content”][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
Our data protection standardsBasic We ensure the implementation of and compliance with the required technical and organisational measures in accordance with \u00a7 32 DSGVO. These include measures to ensure the ongoing confidentiality, availability and resilience of data processing systems and services. Appropriate technical and organisational measures include, for example, the encryption of personal data and […]<\/p>\n","protected":false},"author":6,"featured_media":0,"parent":0,"menu_order":83,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-6413","page","type-page","status-publish","hentry"],"yoast_head":"\n