DocuSign Ƙarin Ƙirƙirar Bayanan Bayanai
Abubuwan da ke ciki
boye
YADDA AKE CIKA DA WANNAN DPA
- Wannan Ƙarin DPA ya ƙunshi sassa biyu: babban jikin Ƙarin DPA, da Jadawalin 1, 2, 3, 4 da 5.
- Wannan ƙarin DPA an riga an sanya hannu a madadin Nasa.
- Don kammala wannan Ƙarin DPA, Abokin ciniki dole ne:
a. Kammala Sunan Abokin Ciniki da Sashen Adireshin Abokin Ciniki.
b. Cika bayanin a cikin akwatin sa hannu kuma sa hannu.
c. Tabbatar da cewa bayanin da ke kan Jadawalin 3 ("Bayani na Gudanarwa") yana nuna daidai da batutuwa da nau'ikan bayanan da za a sarrafa.
d. Aika da kammala kuma sanya hannu Ƙarin DPA don Mallaka a sirri@owndata.com.
Bayan samun naka na cikakken ƙarin DPA a wannan adireshin imel, wannan ƙarin DPA zai zama abin ɗaure bisa doka.
Sa hannun wannan Ƙarin DPA a shafi na 3 za a yi la'akari da shi ya zama sa hannu da yarda da ƙa'idodin Yarjejeniyar Ƙa'idar (ciki har da abubuwan da suka shafi su) da Ƙarin UK, dukansu an haɗa su a nan ta hanyar tunani.
YADDA WANNAN DPA AKE AIKI
Idan Abokin Ciniki na Abokin Ciniki da ke sanya hannu kan wannan Ƙarin DPA wani ɓangare ne a cikin Yarjejeniyar, wannan Ƙarin DPA ƙari ne kuma ya zama wani ɓangare na Yarjejeniyar ko DPA mai wanzuwa. A irin wannan yanayin, ƙungiyar da ke cikin Yarjejeniyar ko DPA mai ci tana cikin wannan DPA.
Idan Abokin Abokin Ciniki da ke sa hannu akan wannan Ƙarin DPA ya aiwatar da Form ɗin oda tare da Nasa ko Affiliate bisa ga Yarjejeniyar ko DPA mai wanzuwa, amma ba ita kanta wani ɓangare na Yarjejeniyar ba ko DPA ɗin da ke wanzu, wannan ƙarin DPA ƙari ne ga wancan Form ɗin oda kuma Forms na sabuntawa masu dacewa, kuma mahaɗin da ke cikin irin wannan Form ɗin oda yana cikin wannan ƙarin DPA.
Idan Abokin Ciniki na Abokin Ciniki da ke sa hannu akan wannan Ƙarin DPA ba ya shiga cikin Form ɗin oda ko Yarjejeniyar ko DPA mai wanzuwa, wannan Ƙarin DPA ba shi da inganci kuma baya ɗaure bisa doka. Irin wannan mahaluƙi ya kamata ya nemi ƙungiyar Abokin Ciniki wanda ke cikin Yarjejeniyar ko DPA mai wanzuwa ta aiwatar da wannan ƙarin DPA.
Idan Abokin Ciniki na Abokin Ciniki da ke sanya hannu kan Ƙarin DPA ba ƙungiya ba ce zuwa Form ɗin oda ko Yarjejeniyar Biyan Kuɗi ko DPA mai wanzuwa kai tsaye tare da Nasa, amma a maimakon haka abokin ciniki ne a kaikaice ta hanyar mai siyar da sabis na kansa, wannan ƙarin DPA ba shi da inganci kuma yana da inganci. ba bisa doka ba. Irin wannan mahallin ya kamata ya tuntuɓi mai siyar da izini don tattaunawa ko ana buƙatar gyara ga yarjejeniyarta da mai siyarwar.
A cikin yanayin kowane rikici ko rashin daidaituwa tsakanin wannan Ƙarin DPA da kowace yarjejeniya tsakanin Abokin ciniki da Nasa (ciki har da, ba tare da iyakancewa ba, Yarjejeniyar ko DPA mai wanzuwa), sharuɗɗan wannan Ƙarin DPA za su sarrafawa kuma su ci nasara.
Wannan Ƙarin Ƙirƙirar Ƙirƙirar Bayanai, gami da Jadawalin sa da Abubuwan Taɗi, ("Ƙarin DPA") ya zama wani ɓangare na Ƙarin Tsarin Bayanan da ake da shi wanda aka gano a sama ("DPA mai wanzuwa") tsakanin OwnBackup Inc. ("Mallaka") da Abokin ciniki. Haɗa wannan ƙarin DPA da DPA da ke wanzu za su samar da cikakkiyar yarjejeniyar sarrafa bayanai (“DPA”) don rubuta yarjejeniyar ɓangarorin game da sarrafa bayanan sirri. Idan irin wannan mahallin Abokin ciniki da na mallaka ba su shiga yarjejeniya ba, to wannan DPA ba ta da wani tasiri kuma ba ta da wani tasiri na doka.
Ƙungiyar Abokin Ciniki mai suna a sama yana shiga cikin wannan Ƙarin DPA don kansa kuma, idan ɗaya daga cikin Ƙungiyoyin sa yana aiki a matsayin Masu Gudanar da Bayanan Keɓaɓɓu, a madadin waɗanda ke da izini. Duk manyan kalmomin da ba a fayyace su a nan ba za su sami ma'anar da aka bayyana a cikin Yarjejeniyar.
A yayin samar da Sabis na SaaS ga Abokin ciniki a ƙarƙashin Yarjejeniyar, Nasa na iya sarrafa Bayanan Keɓaɓɓu a madadin Abokin ciniki. Bangarorin sun amince da ƙarin sharuɗɗa masu zuwa game da irin wannan Gudanarwa.
- BAYANI
"CCPA" yana nufin Dokar Sirri na Masu Amfani da California, Cal. Civ. Lambar § 1798.100 et. seq., kamar yadda Dokar Haƙƙin Sirri ta California ta 2020 ta gyara kuma tare da kowane ƙa'idodin aiwatarwa.
"Mai kula" yana nufin mahallin da ke ƙayyade dalilai da hanyoyin sarrafa bayanan Keɓaɓɓen kuma ana ɗaukar ma'anar "kasuwanci" kamar yadda aka ayyana a cikin CCPA.
"abokin ciniki" yana nufin mahaɗan mai suna a sama da kuma Ƙungiyoyin sa.
"Dokokin Kariyar Bayanai da Dokokin" yana nufin duk dokoki da ka'idojin Tarayyar Turai da ta
Kasashe membobi, Yankin Tattalin Arziki na Turai da membobinta, Burtaniya, Switzerland, Amurka, Kanada, New Zealand, da Ostiraliya, da rabe-raben siyasa daban-daban, masu amfani da sarrafa bayanan sirri. Waɗannan sun haɗa da, amma ba'a iyakance su ba, masu biyowa, gwargwadon abin da aka zartar: GDPR, Dokar Kariyar Bayanai ta Burtaniya, CCPA, Dokar Kariyar Bayanan Masu Amfani da Virginia ("VCDPA"), Dokar Sirri na Colorado da ƙa'idodi masu alaƙa ("CPA). ”), Dokar Sirri na Abokin Ciniki na Utah (“UCPA”), da Dokar Connecticut Game da Keɓaɓɓen Bayanai na Keɓaɓɓu da Kula da Kan layi (“CPDPA”).
"Batun Bayanai" yana nufin wanda aka gano ko wanda za'a iya gane shi wanda Bayanan sirri ke da alaƙa da shi kuma ya haɗa da "mai amfani" kamar yadda aka ayyana a Dokokin Kariya da Ka'idoji. "Turai" yana nufin Tarayyar Turai, Yankin Tattalin Arziki na Turai, Switzerland, da Burtaniya. Ƙarin tanadin da ya dace don canja wurin bayanan sirri daga Turai suna ƙunshe a cikin Jadawalin 5. A cikin yanayin da aka cire Jadawalin 5, Abokin ciniki ya ba da garantin cewa ba zai aiwatar da bayanan Keɓaɓɓun bayanan da ke ƙarƙashin Dokokin Kariyar Bayanai da Dokokin Turai ba.
"GDPR" yana nufin ka'idar (EU) 2016/679 na Majalisar Tarayyar Turai da na Majalisar 27 Afrilu 2016 game da kare lafiyar mutane game da sarrafa bayanan sirri da kuma motsin irin waɗannan bayanan, da kuma soke umarnin 95/46 /EC (Dokar Kariya ta Gabaɗaya).
"Rukunin Kansu" yana nufin Mallaka da Ƙungiyoyin sa masu aiki da sarrafa bayanan sirri.
"Bayanan Mutum" yana nufin duk wani bayani da ya shafi (i) wani mutum na halitta da aka gano ko wanda za'a iya gane shi da, (ii) gano ko ma'auni na shari'a (inda aka kare irin waɗannan bayanan kamar bayanan sirri, bayanan sirri, ko bayanan sirri na sirri a ƙarƙashin Dokoki da Dokokin Kariyar Bayanai ), inda ga kowane (i) ko (ii), irin waɗannan bayanan shine Bayanan Abokin Ciniki.
"Sabis na Sarrafa Bayanan Mutum" yana nufin Sabis na SaaS da aka jera a cikin Jadawalin 2, wanda Nasa zai iya aiwatar da Bayanan Keɓaɓɓu.
"Tsarin aiki" yana nufin duk wani aiki ko saitin ayyuka da aka yi akan Bayanan sirri, ko ta hanyar atomatik ko a'a, kamar tarin, rikodi, tsari, tsarawa, ajiya, daidaitawa ko canji, dawowa, tuntuɓar, amfani, bayyanawa ta hanyar watsawa, yadawa ko akasin haka. samar da samuwa, daidaitawa ko haɗawa, ƙuntatawa, gogewa ko lalata.
“Processor” na nufin mahallin da ke sarrafa bayanan sirri a madadin Mai Gudanarwa, gami da yadda ya dace kowane “mai bada sabis” kamar yadda CCPA ta ayyana wannan kalmar.
"Kasuwancin Kwangilar Kwangila" yana nufin Annex ga shawarar aiwatar da Hukumar Tarayyar Turai
(EU) 2021/914 https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) na 4 Yuni 2021 akan Standard Contractual Clauses don canja wurin bayanan sirri ga masu sarrafawa da aka kafa a cikin ƙasashe na uku bisa ga Doka (EU) 2016/679 na Majalisar Turai da na Majalisar Tarayyar Turai da kuma batun gyare-gyaren da ake buƙata don United Masarautar da Switzerland sun kara bayyana a cikin Jadawalin 5.
“Sub-processor” na nufin duk wani Mai sarrafawa da Nasa ke yi, ta wani memba na Ƙungiya ko ta wani Sub-processor.
"Hukumar Kulawa" yana nufin wata hukuma ko gwamnati da aka ba da izini da ke da ikon doka akan Abokin ciniki.
"Birtaniya Addendum" yana nufin Ƙaddamar da Canja wurin Bayanan Ƙasa ta Ƙasashen Duniya zuwa Ƙungiyar Ƙwararrun Ƙwararrun Ƙwararrun Ƙungiyar EU (akwai kamar na 21 Maris 2022 a https://ico.org.uk/for-organisations/guideto-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transferagreement-and-guidance/), kammala kamar yadda aka bayyana a cikin Jadawalin 5.
"Dokar Kariyar Bayanai ta Burtaniya" yana nufin ka'idar 2016/679 na Majalisar Turai da na Majalisar kan kariyar 'yan Adam dangane da sarrafa bayanan sirri da kuma ba da izinin zirga-zirgar irin waɗannan bayanan kamar yadda ya kasance wani ɓangare na dokar Ingila da Wales, Scotland da Arewacin Ireland ta hanyar sashe na 3 na Dokar Tarayyar Turai (Fitarwa) ta 2018, kamar yadda za a iya gyarawa lokaci zuwa lokaci ta Dokokin Kariyar Bayanai da Dokokin Burtaniya. - UMARNIN KIRA
a. Ban da Ƙa'idodin Kwangilar Kwangilar da aka haɗa a ciki, waɗanda za su kasance a gaba, a cikin yanayin rashin daidaituwa tsakanin wannan Ƙarin DPA da DPA da ke yanzu, sharuɗɗan DPA na yanzu za su yi rinjaye. - IYAKA NA HAKURI
a. Har zuwa iyakar Dokokin Kariyar Bayanai da Dokokin, kowane ɓangare na kowane ɓangare da duk na Abokan haɗin gwiwa, waɗanda aka ɗauka tare a cikin jimillar, wanda ya taso daga ko alaƙa da wannan ƙarin DPA, ko a cikin kwangila, azabtarwa ko kuma ƙarƙashin kowane ka'idar abin alhaki, yana ƙarƙashin juzu'i na "Liability Limit", da irin waɗannan sassan da suka keɓance ko iyakance abin alhaki, na Yarjejeniyar, da duk wani tunani a cikin irin wannan. sharuddan alhakin alhakin jam’iyya yana nufin jimillar alhakin wannan jam’iyya da duk ‘ya’yanta. - CANJIN CANJIN INGANCI
a. A yayin da tsarin canja wuri na yanzu da bangarorin suka dogara da shi don sauƙaƙe canja wurin bayanan sirri zuwa ɗaya ko fiye da ƙasa waɗanda ba su tabbatar da ingantaccen matakin kariya ba a cikin ma'anar Dokokin Kariyar bayanai da ƙa'idodi, an gyara. , ko maye gurbin ɓangarorin za su yi aiki cikin aminci don aiwatar da irin wannan hanyar canja wurin don ba da damar ci gaba da sarrafa bayanan sirri da yarjejeniyar ta tsara. Amfani da irin wannan hanyar canja wuri zai kasance ƙarƙashin cikar kowane ɓangare na duk buƙatun doka don amfani da irin wannan hanyar canja wurin.
Abokan sa hannun masu izini na jam'iyyun sun aiwatar da wannan Yarjejeniyar da kyau, gami da duk Jadawalai masu dacewa, Matsaloli, da Rataye da aka haɗa a ciki.
Jerin Jadawalin
Jadawalin 1: Jerin Sub-Processor na yanzu
Jadawalin 2: Sabis na SaaS masu dacewa don sarrafa bayanan sirri
Jadawalin 3: Cikakkun bayanai na Gudanarwa
Jadawalin 4: Ikon Tsaro na kansa
Jadawalin 5: Taimakon Turai
JAWABI 1 Jerin Sub-Processor na Yanzu
| Sub-Processor Name | Adireshin Mai sarrafawa | Yanayin sarrafawa | Tsawon Lokaci | Wurin sarrafawa |
| OwnBackup Limited kasuwar kasuwa | 3 Aluf Kalman Magen StZ, Tel Aviv 6107075, Israel | Tallafin abokin ciniki da kulawa | Domin wa'adin yarjejeniyar. | Isra'ila |
| Amazon Web Services, Inc.* | 410 Terry Avenue North, Seattle, Washington 98109, Amurka | Gudanar da aikace-aikacen da adana bayanai | Domin wa'adin yarjejeniyar. | Amurka, Kanada, Jamus, United Kingdom, ko Ostiraliya |
| Kamfanin Microsoft (Azure)* | One Microsoft Way, Redmond, Washington 98052, Amurka | Gudanar da aikace-aikacen da adana bayanai | Domin wa'adin yarjejeniyar. | Netherlands ko Amurka |
| Elasticsearch, Inc..** | 800 West El Camino Real, Suite 350, Dutsen View, California 94040, Amurka | Fihirisa da bincike | Domin wa'adin yarjejeniyar. | Netherlands ko Amurka |
* Abokin ciniki na iya zaɓar ko dai Amazon Web Sabis ko Microsoft (Azure) da wurin da ake so na Gudanarwa yayin saitin farko na Abokin ciniki na Sabis na SaaS.
** Yana aiki ne kawai ga abokan cinikin Ajiye waɗanda suka zaɓi turawa a cikin Microsoft (Azure) Cloud.
JAWABI 2 Sabis na SaaS Masu Aiwatar da Ayyukan Gudanar da Bayanan Keɓaɓɓu
- Warke don ServiceNow
- Warke don Dynamics
- Maida don Salesforce
- Governance Plus don Salesforce
- Taskoki
- Kawo Gudanarwar Maɓalli Naku
- Hanzarta
JAWABI NA 3 Cikakken Bayanin Gudanarwa
Mai fitarwa Data
Cikakken Sunan Shari'a: Sunan abokin ciniki kamar yadda aka ƙayyade a sama
Babban Adireshin: Adireshin abokin ciniki kamar yadda aka ƙayyade a sama
Tuntuɓar: Idan ba haka ba idan wannan zai zama farkon lamba akan asusun Abokin ciniki.
Tuntuɓi Imel: Idan ba haka ba, wannan zai zama adireshin imel na farko akan asusun Abokin ciniki.
Mai shigo da bayanai
Cikakken Sunan Shari'a: OwnBackup Inc.
Babban Adireshin: 940 Sylvan Ave, Englewood Cliffs, NJ 07632, Amurka
Tuntuɓar: Jami'in Kere Sirri
Tuntuɓi Imel: sirri@owndata.com
Hali da Manufar Gudanarwa
Mallaka za ta aiwatar da bayanan sirri kamar yadda ya cancanta don aiwatar da Sabis na SaaS bisa ga Yarjejeniyar da Umarni, kuma kamar yadda Abokin Ciniki ya ba da umarni a cikin amfani da Sabis na SaaS.
Tsawon Lokaci
Mallakar da ke sarrafa bayanan sirri na tsawon lokacin yarjejeniyar, sai dai in an yarda a rubuce.
Riƙewa
Nasa zai riƙe Bayanan Keɓaɓɓu a cikin Sabis na SaaS na tsawon lokacin Yarjejeniyar, sai dai in an yarda da ita a rubuce, dangane da matsakaicin lokacin riƙewa da aka ƙayyade a cikin Takardun.
Yawan Canja wurin
Kamar yadda Abokin ciniki ya ƙaddara ta hanyar amfani da Sabis ɗin SaaS.
Canja wurin zuwa Sub-processor(s)
Kamar yadda ya cancanta don yin Sabis na SaaS bisa ga Yarjejeniyar da Umarni, kuma kamar yadda aka bayyana a cikin Jadawalin 1.
Rukunin Abubuwan Bayanai
Abokin ciniki na iya ƙaddamar da Bayanan Keɓaɓɓu zuwa Sabis na SaaS, gwargwadon abin da Abokin ciniki ya ƙaddara kuma ke sarrafa shi a cikin ikonsa kawai, kuma wanda zai iya haɗawa amma ba'a iyakance ga keɓaɓɓen bayanan da ke da alaƙa da nau'ikan batutuwan bayanai masu zuwa:
- Masu yiwuwa, abokan ciniki, abokan kasuwanci da masu siyar da Abokin ciniki (waɗanda mutane ne na halitta)
- Ma'aikata ko tuntuɓar abokan ciniki, abokan ciniki, abokan kasuwanci da masu siyarwa
- Ma'aikata, wakilai, masu ba da shawara, masu zaman kansu na Abokin ciniki (waɗanda mutane ne na halitta) Masu amfani da Abokin ciniki sun ba da izini don amfani da Sabis na SaaS
Nau'in Bayanan Mutum
Abokin ciniki na iya ƙaddamar da Bayanan Keɓaɓɓu zuwa Sabis na SaaS, gwargwadon abin da Abokin ciniki ya ƙaddara kuma ke sarrafa shi a cikin ikon sa kawai, kuma wanda zai iya haɗawa amma ba'a iyakance shi ga nau'ikan bayanan Keɓaɓɓun masu zuwa ba:
- Sunan farko da na ƙarshe
- Take
- Matsayi
- Ma'aikaci
- Bayanin tuntuɓar (kamfanin, imel, waya, adireshin kasuwanci na zahiri)
- ID data
- Bayanan rayuwa na sana'a
- Bayanan rayuwa na sirri
- Bayanan yanki
Nau'ikan bayanai na musamman (idan ya dace)
Abokin ciniki na iya ƙaddamar da nau'ikan bayanan sirri na musamman ga Sabis na SaaS, gwargwadon abin da Abokin ciniki ya ƙaddara kuma ke sarrafa shi a cikin ƙwararrun sa, kuma wanda saboda tsabta zai iya haɗawa da sarrafa bayanan kwayoyin halitta, bayanan biometric don manufar musamman. gano wani na halitta ko bayanai game da lafiya. Dubi matakan a Jadawalin 4 don yadda Nasa ke kare nau'ikan bayanai na musamman da sauran bayanan sirri.
Jadawalin 4 Gudanar da Tsaro na kansa 3.3
- Gabatarwa
- Abubuwan aikace-aikacen-as-a-sabis na software (Sabis na SaaS) an tsara su daga farkon tare da tsaro a zuciya. Sabis na SaaS an tsara su tare da sarrafa tsaro iri-iri a cikin matakai da yawa don magance kewayon haɗarin tsaro. Wadannan kulawar tsaro suna iya canzawa; duk da haka, kowane canje-canje zai kiyaye ko inganta yanayin tsaro gabaɗaya.
- Bayanin sarrafawar da ke ƙasa ya shafi aiwatar da Sabis na SaaS akan duka Amazon Web Sabis (AWS) da dandamali na Microsoft Azure (Azure) (tare da ake kira da Masu Ba da Sabis ɗinmu na Cloud, ko CSPs), sai dai kamar yadda aka ƙayyade a cikin ɓoyayyen ɓoyayyen da ke ƙasa. Waɗannan kwatancin abubuwan sarrafawa ba su shafi software na RevCult sai dai kamar yadda aka tanadar a ƙarƙashin “Tabbataccen Ci gaban Software” a ƙasa.
- Audits da Takaddun shaida
- Sabis na SaaS an ba da izini a ƙarƙashin ISO/IEC 27001: 2013 (Tsarin Gudanar da Tsaro na Bayani) da ISO/IEC 27701: 2019 (Tsarin Gudanar da Bayanin Sirri).
- Wanda ya mallaki yana yin nazarin SOC2 Type II na shekara-shekara a ƙarƙashin SSAE-18 don tabbatar da kansa don tabbatar da ingancin ayyukan tsaro na bayanai, manufofi, hanyoyin aiki, da ayyukansa don waɗannan Ma'auni na Sabis na Amincewa: Tsaro, Sami, Sirri, da Tsare-tsare Tsari.
- Own yana amfani da yankuna na CSP na duniya don ƙididdigewa da adanawa don Sabis na SaaS. AWS da Azure sune manyan wuraren aiki tare da izini da yawa, gami da SOC1 - SSAE-18, SOC2, SOC3, ISO 27001, da HIPAA.
- Web Sarrafa Tsaro na Aikace-aikace
- Samun damar abokin ciniki zuwa Sabis na SaaS kawai ta hanyar HTTPS (TLS1.2+), yana kafa ɓoyayyen bayanan da ke wucewa tsakanin mai amfani da ƙarshen aikace-aikacen kuma tsakanin Own da tushen bayanan ɓangare na uku (misali, Salesforce).
- Masu gudanar da Sabis na SaaS na abokin ciniki na iya samarwa da kuma ba da damar masu amfani da Sabis na SaaS da haɗin kai kamar yadda ya cancanta.
- Sabis na SaaS suna ba da ikon sarrafawa na tushen rawar don bawa abokan ciniki damar sarrafa izini na org da yawa.
- Ma'aikatan Sabis na SaaS na abokin ciniki na iya samun damar hanyoyin tantancewa gami da sunan mai amfani, mataki, lokaciamp, da kuma tushen filayen adireshin IP. Ana iya yin rajistar rajistan ayyukan viewed da fitarwa ta mai kula da Sabis na abokin ciniki ya shiga cikin Sabis ɗin SaaS da kuma ta API ɗin Sabis na SaaS.
- Ana iya iyakance damar zuwa Sabis na SaaS ta hanyar adireshin IP na tushen.
- Sabis na SaaS suna ba abokan ciniki damar ba da damar tabbatar da abubuwa da yawa don samun dama ga asusun Sabis na SaaS ta amfani da kalmomin shiga na lokaci ɗaya.
- Sabis na SaaS suna ba abokan ciniki damar kunna sa hannu guda ɗaya ta hanyar masu ba da shaidar SAML 2.0.
- Sabis na SaaS suna ba abokan ciniki damar ba da damar manufofin kalmar sirri da za a iya daidaita su don taimakawa daidaita kalmomin shiga Sabis na Sabis zuwa manufofin kamfanoni.
- Rufewa
- Own yana ba da zaɓuɓɓukan Sabis na SaaS masu zuwa don ɓoye bayanan a sauran:
- Daidaitaccen bayarwa.
- An rufaffen bayanai ta amfani da boye-boye-gefen uwar garken AES-256 ta hanyar tsarin sarrafa maɓalli wanda aka inganta a ƙarƙashin FIPS 140-2.
- Ana amfani da ɓoyayyen ambulan kamar yadda babban maɓalli bai taɓa barin Module Tsaro na Hardware (HSM).
- Ana juya maɓallan ɓoyewa ba ƙasa da kowace shekara biyu ba.
- Zaɓin Gudanar da Maɓalli na Babba (AKM).
- An rufaffen bayanai a cikin keɓaɓɓen akwati na ma'auni tare da maɓallin ɓoyayyen ɓoyayyen da abokin ciniki ya samar (CMK).
- AKM yana ba da damar adana maɓalli na gaba da jujjuya shi tare da wani maɓallin ɓoyayyen mahimmin.
- Abokin ciniki na iya soke babban maɓallan ɓoyewa, wanda ke haifar da rashin isa ga bayanan nan take.
- Kawo Zaɓin Tsarin Gudanar da Maɓalli naka (KMS) (akwai akan AWS kawai).
- Ana ƙirƙira maɓallan ɓoyewa a cikin na abokin ciniki, asusun da aka siya daban ta amfani da AWS KMS.
- Abokin ciniki yana bayyana manufar maɓallin ɓoyewa wanda ke ba da izinin asusun Sabis na abokin ciniki akan AWS don samun damar maɓalli daga AWS KMS na abokin ciniki.
- An rufaffen bayanai a cikin kwalin ajiyar kayan da aka keɓe wanda Nasa ke sarrafa, kuma an saita shi don amfani da maɓallin ɓoyewar abokin ciniki.
- Abokin ciniki na iya soke samun dama ga rufaffen bayanan nan take ta hanyar soke damar Nasa zuwa maɓallin ɓoyewa, ba tare da yin hulɗa da Nasa ba.
- Ma'aikatan nasu ba su da damar yin amfani da maɓallan ɓoyewa a kowane lokaci kuma ba sa samun dama ga KMS kai tsaye.
- Dukkan ayyukan maɓalli na amfani suna shiga cikin KMS na abokin ciniki, gami da dawo da maɓalli ta wurin ajiyar abu da aka keɓe.
- Rufewa cikin wucewa tsakanin Sabis na SaaS da tushen bayanan ɓangare na uku (misali, Salesforce) yana amfani da HTTPS tare da TLS 1.2+ da OAuth 2.0.
- Daidaitaccen bayarwa.
- Own yana ba da zaɓuɓɓukan Sabis na SaaS masu zuwa don ɓoye bayanan a sauran:
- Cibiyar sadarwa
- Sabis na SaaS suna amfani da sarrafawar hanyar sadarwa na CSP don ƙuntata shigar da cibiyar sadarwa.
- Ana amfani da ƙungiyoyin tsaro na jihohi don iyakance shigowar hanyar sadarwa da ficewa zuwa wuraren ƙarshe masu izini.
- Sabis na SaaS suna amfani da tsarin gine-ginen cibiyar sadarwa da yawa, gami da mahara, rarrabuwar hankali ta Amazon Virtual Private Clouds (VPCs) ko Azure Virtual Networks (VNets), ba da damar masu zaman kansu, DMZs, da yankuna marasa amana a cikin kayan aikin CSP.
- A cikin AWS, ana amfani da ƙuntatawa na VPC S3 a kowane yanki don ba da izinin shiga kawai daga VPCs masu izini.
- Kulawa da Auditing
- Ana kula da tsarin Sabis na Sabis da cibiyoyin sadarwa don abubuwan tsaro, lafiyar tsarin, rashin daidaituwa na cibiyar sadarwa, da samuwa.
- Sabis na SaaS yana amfani da tsarin gano kutse (IDS) don saka idanu ayyukan cibiyar sadarwa da faɗakarwa Mallakin halayen da ake tuhuma.
- Ana amfani da Sabis na SaaS web aikace-aikace Firewalls (WAFs) ga duk jama'a web ayyuka.
- Mallakar aikace-aikacen rajistan ayyukan, cibiyar sadarwa, mai amfani, da abubuwan da suka faru na tsarin aiki zuwa uwar garken syslog na gida da takamaiman SIEM na yanki. Ana bincika waɗannan rajistan ayyukan ta atomatik kuma a sake sake suviewed don ayyukan tuhuma da barazana. Duk wani anomalies yana ƙaruwa yadda ya dace.
- Nasa yana amfani da bayanan tsaro da tsarin gudanar da taron (SIEM) yana ba da ci gaba da bincike na tsaro na cibiyoyin sadarwa na Sabis na SaaS da yanayin tsaro, faɗakarwar mai amfani da ɓarna, umarni da sarrafawa (C&C) binciken harin, gano barazanar atomatik, da bayar da rahoton alamun sasantawa (IOC). ). Duk waɗannan iyawar ana gudanar da su ta hanyar tsaro da ma'aikatan Own.
- Tawagar martanin abin da ya faru na sa ido security@owndata.com wanda aka laƙaba da amsa bisa ga Tsarin Ba da Amsa na Kamfanin (IRP) idan ya dace.
- Warewa Tsakanin Asusu
- Sabis na SaaS suna amfani da sandboxing na Linux don ware bayanan asusun abokin ciniki yayin aiki. Wannan yana taimakawa wajen tabbatar da cewa duk wani rashin lafiya (misaliample, saboda matsalar tsaro ko kwaro na software) ya kasance a tsare ga asusun kansa guda ɗaya.
- Ana sarrafa samun damar bayanan ɗan haya ta musamman masu amfani da IAM tare da bayanai tagging wanda ke hana masu amfani mara izini shiga bayanan mai haya.
- Farfado da Bala'i
- Nasa yana amfani da ma'ajin abu na CSP don adana rufaffen bayanan abokin ciniki a cikin yawancin samuwa-shiyoyi.
- Don bayanan abokin ciniki da aka adana akan ma'ajiyar abu, Own yana amfani da sigar abu tare da tsufa ta atomatik don tallafawa bin ƙa'idodin dawo da bala'i na Own's. Don waɗannan abubuwan, an tsara tsarin Nasu don tallafawa manufar dawowa (RPO) na sa'o'i 0 (wato ikon dawo da kowane sigar kowane abu kamar yadda ya kasance a cikin kwanakin 14 da suka gabata).
- Duk wani dawo da misalan lissafi ana cika shi ta hanyar sake gina misalin bisa tsarin sarrafa sarrafa kansa.
- An ƙirƙira Tsarin Farfaɗo da Bala'i don tallafawa maƙasudin lokacin dawowa na awa 4 (RTO).
- Gudanar da Rashin Lafiya
- Nasa yana yin lokaci-lokaci web Ƙimar raunin aikace-aikacen, ƙididdigar lambar ƙididdiga, da kimantawa na waje mai ƙarfi a matsayin wani ɓangare na ci gaba da shirin sa na sa ido don taimakawa tabbatar da aiwatar da matakan tsaro na aikace-aikacen da kyau da aiki yadda ya kamata.
- A kan wani tsarin shekara-shekara, Own yana ɗaukar masu gwajin shiga na ɓangare na uku masu zaman kansu don yin duka hanyar sadarwa da web kimantawa rauni. Iyakar waɗannan binciken na waje sun haɗa da yarda da Buɗewa Web Aikace-aikacen Tsaro Project (OWASP) Manyan 10 Web Rashin lahani (www.owasp.org).
- An shigar da sakamakon kimar rauni cikin tsarin ci gaban software na Own (SDLC) don gyara lahanin da aka gano. An ba da fifiko na musamman na rashin lahani kuma an shigar da su cikin tsarin tikiti na ciki don bin diddigin ƙuduri.
- Martanin Lamarin
- Idan akwai yuwuwar rashin tsaro, Teamungiyar Ba da Amsa abin da ya faru za ta yi kimanta halin da ake ciki kuma ta samar da dabarun da suka dace. Idan aka tabbatar da yuwuwar cin zarafi, Own zai yi aiki nan da nan don rage cin zarafi da adana bayanan bincike, kuma zai sanar da abokan hulɗar da abin ya shafa ba tare da bata lokaci ba don taƙaita musu halin da ake ciki tare da samar da sabunta matsayin ƙuduri.
- Amintaccen Ci gaban Software
- Own yana amfani da amintattun ayyukan ci gaba don aikace-aikacen software na Own da RevCult a duk tsawon rayuwar ci gaban software. Waɗannan ayyukan sun haɗa da nazarin lambobin a tsaye, Salesforce security review don aikace-aikacen RevCult da na nasu aikace-aikacen da aka shigar a cikin misalin abokan ciniki' Salesforce, peer review na canje-canje na lamba, ƙuntata samun damar ma'ajin lambar tushe bisa ƙa'idar mafi ƙarancin gata, da shiga ma'ajiyar lambar tushe da canje-canje.
- Tawagar Tsaro ta sadaukar
- Own yana da ƙungiyar tsaro mai sadaukarwa tare da fiye da shekaru 100 na haɗe-haɗe da gogewar tsaro na bayanai masu fuskoki da yawa. Bugu da ƙari, membobin ƙungiyar suna kiyaye takaddun shaida da masana'antu da yawa, gami da amma ba'a iyakance ga CISM, CISSP, da ISO 27001 Jagoran Masu Auditor ba.
- Sirri da Kariyar Bayanai
- Own yana ba da tallafi na asali don buƙatun samun damar jigon bayanai, kamar haƙƙin gogewa (haƙƙin mantawa) da ɓoyewa, don tallafawa bin ƙa'idodin keɓanta bayanan, gami da Babban Dokar Kariyar Bayanai (GDPR), Dokar Kula da Inshorar Lafiya da Lamuni. (HIPAA), da Dokar Sirri na Masu Amfani da California (CCPA). Har ila yau, mallaka yana ba da Ƙarin Gudanar da Bayanai don magance sirri da dokokin kariyar bayanai, gami da buƙatun doka don canja wurin bayanai na duniya.
- Bayanan Bayani
- Mai mallaka yana aiwatar da kwamitin bincike na baya, gami da binciken bayanan laifuka, na ma'aikatansa waɗanda za su iya samun damar yin amfani da bayanan abokan ciniki, dangane da hurumin zama na ma'aikaci a cikin shekaru bakwai da suka gabata, ƙarƙashin doka.
- Inshora
Nasa yana kula da, aƙalla, ɗaukar hoto mai zuwa: (a) inshorar diyya na ma'aikata daidai da duk dokar da ta dace; (b) inshorar abin alhaki na mota don motocin da ba mallakarsu ba da hayar, tare da iyaka guda ɗaya na $1,000,000; (c) Babban abin alhaki na kasuwanci (abin alhaki na jama'a) inshora tare da iyakacin iyaka na $1,000,000 a kowane abin da ya faru da $2,000,000 gabaɗaya ɗaukar hoto; (d) kurakurai da tsallake-tsallake (labaran ƙwararru) inshora tare da iyakacin $20,000,000 a kowane taron da jimillar $20,000,000, gami da firamare na farko da wuce gona da iri, gami da alhaki na cyber, fasaha da sabis na ƙwararru, samfuran fasaha, bayanai da tsaro na cibiyar sadarwa, amsa cin zarafi, tsari. tsaro da hukunce-hukunce, satar yanar gizo da kuma lamunin dawo da bayanai; da (e) inshorar rashin gaskiya/laifi na ma'aikaci tare da ɗaukar nauyin $5,000,000. Nasa zai ba wa Abokin ciniki shaidar irin wannan inshora akan buƙata.
JARIDAR 5 Taimakon Turai
Wannan jadawalin zai shafi canja wurin bayanan Keɓaɓɓu ne kawai (gami da canja wuri na gaba) daga Turai wanda, in babu aikace-aikacen waɗannan tanade-tanade, zai sa ko dai Abokin ciniki ko Nasa ya keta Dokokin Kariyar Bayanai da Dokokin.
- Tsarin Canja wurin don Canja wurin Bayanai.
a) Ka'idodin Yarjejeniyar Yarjejeniyar ta shafi duk wani canja wurin bayanan sirri a ƙarƙashin wannan ƙarin DPA daga Turai zuwa ƙasashe waɗanda ba su tabbatar da ingantaccen matakin kariyar bayanai cikin ma'anar Dokokin Kariya da Dokokin Kariyar bayanai na irin waɗannan yankuna, gwargwadon abin da ake aiwatar da canja wurin. zuwa irin waɗannan Dokokin Kariya da Ka'idoji. Nasa yana shiga cikin Ma'auni na Kwangila a matsayin mai shigo da bayanai. Ƙarin sharuɗɗan a cikin wannan Jadawalin kuma sun shafi irin wannan canja wurin bayanai. - Canje-canje bisa ga Ma'auni na Kwangila.
a) Abokan ciniki da Ma'auni na Kwangilar Kwangilar ta rufe. Matsakaicin Ƙa'idodin Yarjejeniyar Yarjejeniya da ƙarin sharuɗɗan da aka kayyade a cikin wannan Jadawalin sun shafi (i) Abokin ciniki, gwargwadon yadda Abokin ciniki ke ƙarƙashin Dokokin Kariyar Bayanai da Dokokin Turai da, (ii) Abokan haɗin gwiwar sa. Don manufar Ma'auni na Kwangilar Kwangila da wannan Jadawalin, irin waɗannan ƙungiyoyi sune "masu fitar da bayanai."
b) Modules. Ƙungiyoyin sun yarda cewa inda za a iya amfani da na'urori na zaɓi a cikin Ma'auni na Kwangila, waɗanda kawai za a yi amfani da su "MODULE TWO: Transfer controller to processor" kawai.
c) Umarni. Ƙungiyoyin sun yarda cewa amfani da Abokin Ciniki na Sabis na Gudanar da Bayanai na Keɓaɓɓen bisa ga Yarjejeniyar da DPA da ke wanzu ana ɗaukar su umarni ne daga Abokin ciniki don aiwatar da bayanan Keɓaɓɓu don dalilai na Sashe na 8.1 na Madaidaitan Ƙirar Kwangilar.
d) Nadin Sabbin Ma'aikata Masu Gudanarwa da Jerin Ma'aikata na Yanzu. Dangane da ZABI 2 zuwa Sashe na 9 (a) na Ma'auni na Kwangila, Abokin Ciniki ya yarda cewa Own na iya shigar da sabbin na'urori masu sarrafawa kamar yadda aka bayyana a cikin DPA da ke wanzu kuma ana iya riƙe Ƙungiyoyin Nasu a matsayin Mai sarrafawa, kuma Ƙungiyoyin Nasu da na Nasu na iya shiga. Sub-processors na ɓangare na uku dangane da samar da Sabis na sarrafa bayanai. Jerin Sub-processors na yanzu kamar yadda aka haɗe kamar Jadawalin 1.
e) Yarjejeniyar Sub-processor. Bangarorin sun yarda cewa canja wurin bayanai zuwa Sub-processors na iya dogaro da tsarin canja wuri ban da Ma'auni na Kwangila (na misali).ample, daure ka'idojin kamfani), kuma yarjejeniyar ta mallaki tare da irin waɗannan masu aiwatarwa na iya ƙila don haka ba su haɗawa ko madubi ƙa'idodin Kwangilar Kwangila ba, duk da wani abu da ya saba wa sashe na 9 (b) na Ma'auni na Kwangila. Koyaya, duk irin wannan yarjejeniya tare da Sub-processor zai ƙunshi wajiban kariya na bayanai waɗanda ba ƙasa da kariya fiye da waɗanda ke cikin wannan ƙarin DPA game da kariyar bayanan Abokin ciniki, gwargwadon abin da ya dace da sabis ɗin da irin wannan Sub-processor ke bayarwa. Kwafi na yarjejeniyoyin Sub-processor waɗanda dole ne na mallaka ga Abokin ciniki ya bayar bisa ga Sashe na 9 (c) na Matsakaicin Ƙa'idar Kwangila za a ba da shi ta Nasa kawai bisa rubutaccen buƙatun Abokin ciniki kuma yana iya samun duk bayanan kasuwanci, ko sassan da ba su da alaƙa da su. Matsakaicin Ƙirar Kwangilar Kwangilar ko makamancin su, wanda Nasa ya cire a gabani.
f) Audits da Takaddun shaida. Ƙungiyoyin sun yarda cewa binciken da aka kwatanta a cikin Sashe na 8.9 da Sashe na 13 (b) na Ma'auni na Kwangila za a yi shi daidai da sharuddan DPA da ke wanzu.
g) Goge Bayanai. Ƙungiyoyin sun yarda cewa shafewa ko dawo da bayanan da aka yi la'akari da Sashe na 8.5 ko Sashe na 16(d) na Ma'auni na Ƙididdigar Ƙirar za a yi daidai da sharuɗɗan DPA da ke yanzu kuma duk wani takaddun shaida na gogewa za a ba da shi ta Nasa kawai akan Abokin Ciniki. nema.
h) Masu amfana na ɓangare na uku. Bangarorin sun yarda cewa dangane da yanayin Sabis na SaaS, Abokin ciniki zai ba da duk taimakon da ake buƙata don ba da damar Own don biyan wajibcin sa ga batutuwan bayanai a ƙarƙashin Sashe na 3 na ƙa'idodin Yarjejeniyar Ma'auni.
i) Tasirin Tasiri. Dangane da Sashe na 14 na Ma'auni na Ƙa'idar Yarjejeniyar Ƙungiyoyin sun gudanar da bincike, dangane da takamaiman yanayi na canja wurin, na dokoki da ayyuka na ƙasar da aka nufa, da kuma takamaiman ƙarin kwangila, ƙungiya, da fasaha. tsare-tsaren da suka shafi, kuma, bisa ga bayanan da aka sani da su a lokacin, sun ƙaddara cewa dokoki da ayyuka na ƙasar da aka nufa ba su hana ƙungiyoyin cika wajibai na kowane ɓangare na Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙira.
j) Doka da Dandalin Gudanarwa. Bangarorin sun yarda, dangane da ZABI 2 zuwa Sashe na 17, cewa idan Ƙungiyar Tarayyar Turai da aka kafa mai fitar da bayanai ba ta ba da izinin haƙƙin masu cin gajiyar ɓangare na uku ba, Standard Contractual Clauses za a gudanar da su ta hanyar dokar Ireland. Dangane da Sashe na 18, kotunan da aka kayyade a cikin Yarjejeniyar za su warware rikice-rikicen da ke da alaƙa da Ma'auni na Yarjejeniyar, sai dai idan irin wannan kotun ba ta kasance a cikin Ƙasar Memba ta EU ba, wanda a cikin wannan yanayin taron na irin wannan takaddama zai zama kotunan Ireland. .
k) Annexes. Don dalilai na aiwatar da ƙa'idodin Yarjejeniyar Yarjejeniyar, Jadawalin 3: Za a haɗa cikakkun bayanai game da aiwatarwa azaman ANNEX IA da IB, Jadawalin 4: Gudanar da Tsaro na kansa (wanda za'a iya sabuntawa daga lokaci zuwa lokaci a https://www.owndata.com/trust/) za a haɗa shi azaman ANNEX II, da Jadawalin 1: Jerin Mai sarrafawa na Yanzu (kamar yadda za'a iya sabuntawa daga lokaci zuwa lokaci a https://www.owndata.com/legal/sub-p/) za a haɗa shi azaman ANNEX III.
l) Tafsiri. Sharuɗɗan wannan Jadawalin an yi niyya ne don fayyace kuma ba don gyara Madaidaitan Ƙirar Kwangila ba. Idan akwai wani rikici ko rashin daidaituwa tsakanin jikin wannan Jadawalin da Ka'idojin Kwangila, Ma'auni na Kwangila zai yi nasara. - Abubuwan da suka dace don Canja wuri daga Switzerland Bangarorin sun yarda cewa saboda dalilan da suka dace na Matsakaicin Yarjejeniyar Yarjejeniyar don sauƙaƙe canja wurin bayanan sirri daga Switzerland waɗannan ƙarin tanadi masu zuwa za a yi amfani da su: (i) Duk wani nassoshi ga Doka (EU) 2016/679 za a fassara shi don yin la’akari da tanadin da suka dace. na Dokar Tarayyar Swiss akan Kariyar Bayanai da sauran ka'idodin kariyar bayanai na Switzerland ("Dokokin Kariyar Bayanai"), (ii) Duk wani nassoshi game da "Jihar Memba" ko "Ƙasar Memba ta EU" ko "EU" za a fassara ta zuwa Switzerland , da (iii) Duk wani nassoshi ga Hukumar Kulawa, za a fassara shi don komawa zuwa Kwamishinan Kare Bayanai da Bayanai na Tarayyar Swiss.
- a) Table 1: Jam'iyyun, cikakkun bayanansu, da abokan hulɗarsu sune waɗanda aka bayyana a cikin Jadawalin 3.
b) Tebur na 2: "Ƙa'idodin Kwangilar Ƙa'idar Yarjejeniyar EU da aka Amince" za su kasance daidaitattun ƙa'idodin Kwangila kamar yadda aka bayyana a cikin wannan Jadawalin 5.
c) Tebur na 3: An kammala annexes I(A), I(B), da II kamar yadda aka tsara a sashe na 2(k) na wannan Jadawali na 5.
d) Tebura 4: Nasa na iya yin amfani da haƙƙin ƙaddamarwa na zaɓi na farko da aka kwatanta a Sashe na 19 na Ƙarin UK.
Takardu / Albarkatu
 |
DocuSign Ƙarin Ƙirƙirar Bayanan Bayanai [pdf] Umarni Ƙarin Ƙirƙirar Ƙirƙirar Bayanai, Ƙarƙashin Ƙirƙirar Bayanai, Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙarƙashin Ƙaƙwalwa |
