Source: https://www.wimi-teamwork.com/about/security-policy-conformity-rgpd/
Timestamp: 2020-04-07 11:03:01
Document Index: 721182728

Matched Legal Cases: ['Art.16', 'Art. 15', 'Art. 15', 'Art.20', 'Art. 5', 'Art.18', 'Art.17', 'Art.13', 'Art. 7', 'Art. 5', 'Art.32', 'Art. 39']

Wimi - Securing your data at the heart of our offer GDPR Conformity
Security policy: Conformity (GDPR)
Technology & security (reliability, backup...)
Conformity (GDPR)
2. Points concerning the product
2.1 Up-to-date data
2.2 Access and copying of data
2.4 Full or partial removal
2.6 Erasure
2.7 User Acccount
3. Points regarding Security
3.1 Security of Processing
3.2 Product Access Conditions
3.3 Product Access Conditions
3.4 Technical and Organisational Security
3.5 Managing Security Failures
Wimi Conformity (GDPR)
Although the obligation is not formally established in the GDPR, it is essential that software, software packages, and other applications (that we call ‘products’) allow their users (companies or public actors) to respect the obligations imposed by the GDPR.
We have identified 3 types of constraint:
the constraints relative to the product itself
the constraints related to the usage of the product
the constraints related to the security of the product
It has outlined that as a client of Wimi, you are responsible for the changes with respect to the GDPR, and that you should response directly to the demands that it refers to.
This document provides a list of these demands, and outlines how Wimi allows you to respond to them.
This section is essentially about the endogenous constraints linked to the product itself.
Art.16 GDPR : The right to rectification “The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.”
Wimi’s response
Each Wimi user can at any time modify and rectify their personal data (in the My account section) and receive a message that indicates that the modifications have been saved and have replaced the previous data.
Art. 15.1 GDPR: The right to obtain a copy “The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed…”
Art. 15.3 GDPR: The right of access
The data subject’s right of access : the personal data protection policy lists processing of personal data that is carried out by Wimi. The controller can at any point send this document to the person who exercises the right to obtain it.
The right to obtain a copy : the data susceptible to being used for processing is filed in the « My account » section of your Wimi (accessible, modifiable, and copiable by the final user).
Art.20 GDPR: The right to data portability : “The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided…”
Wimi allows the export of all activities related to the user and allows the copying of personal data on the ‘My Account’ section of your Wimi.
Art. 5 e) GRPD: deletion of data after a certain period of time
: “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);”
Personal data is retained no longer than is necessary for processing (transparent team work, project management, traceability)
From the point a Wimi account is deleted (processing purposes becoming obsolete) all personal data of the users associated with that account is deleted within 30 days following account deletion.
Art.18 GRPD: Right to the restriction of processing
The notion of « restriction” is stated in article 4 “definitions” of the GDPR that defines the ‘restriction of processing’ as the marking of stored personal data with the aim of limiting their processing in the future.”
Wimi can put in place processing restrictions following a simple written request from the user (data subject) specifying the desired restrictions, the data or the users concerned to contact@wimi.pro.
Art.17 GDPR: the right to erasure (« the right to be forgotten »)
“1.The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing…”
Wimi is able to delete the personal data of a user who wishes to exercise the right to be forgotten following a simple written request from the data subject to the address contact@wimi.pro specifying the user or users concerned.
Art.13 et 14 GDPR: Information to be provided where personal data are collected from the data subject
–the identity and the contact details of the controller and, where applicable, of the controller’s representative;
–the purposes of the processing
–the recipients or categories of recipients of the personal data, if any;
Any Wimi user is able to consult our personal data privacy policy found on the site www.wimi-teamwork.com that provides the user with all required information regarding the GDPR.
Art. 7 : Conditions for consent
« 1.Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. »
When a new user is added to a Wimi account, they give their consent to the processing of the personal data that they put on Wimi.
Article 32 « security of processing »:
the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate.
The front end server codes all of the external connections with a web security policy mechanism (HTTP Strict Transport Security aka HSTS). This protects our services against active and passive network attacks. A ‘man-in-the-middle’ attacker has an extremely reduced capacity to intercept the queries and the responses between a user and our web application servers.
As well as this, Wimi has network isolation. Network isolation means that all of the servers in our infrastucture are isolated in the data center and connected by private, dedicated networks.
Consideration 57 GDPR:
« Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. ».
Wimi offers reinforced authentication when you activate the option ‘Advanced password policy.’
In this case, the passwords should satisfy the following conditions :
-at least 8 characters long
–a lower case letter and an upper case letter
–a number or a symbol
–has not been used before
As well as this, Wimi offers authentication through existing clients via SAML V2. In this case, the logins are strictly identical to those of the responsible client.
Art. 5 f) GDPR:
Personal Data should be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
Wimi has history logs and alerts that are able to trace suspicious activity. Access to these history logs is strictly controlled and limited. Generally, all access to the Wimi infrastructure is done through VPN- only certain, predefined PPs are authorized to establish a tunnel with the help of a RSA 4096 key. This communication tunnel is then coded in AES-256-CBC and broken down in SHA-512. The administrators must self-authenticate in SSH using their private key (ED25519 ou ECDSA) that is protected by a passphrase. All local access is strictly controlled. To protect against intrustions and risk, the data centers are inside barbed wire fences. Motion detection and video surveillance systems are in place and in continuous use. Activity that takes place outside of the data centers is controlled and registered on secured servers, and a surveillance team is on site 24/7.
Art.32 1. GDPR:
« (…) the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (…) »
Art. 39 GDPR:
« Personal data should be processed in a way that guarantees security and an appropriate level of confidentiality, including the prevention of unauthorized access and use of the data and processing equipment ».
The number of Wimi employees that have access to the infrastructure is extremely limited. Those that have access must sign a specific confidentiality agreement and agree to a confidentiality clause under their employment contract.
All access to the Wimi infrastructure is controlled, monitored and is done so by VPN- only certain predefined Ips are authorized to establish a tunnel (white list of IP addresses) with the help of an RSA 4096 key.
This communication tunnel is therefore encrypted in AES-256-CBC and broken up in SHA-512.
Administrators must therefore self-authenticate in SSH with their private key (ED25519 ou ECDSA) that is protected by a pass phrase.
The database is backed up every 3 hours. Replicated files are backed up every night. The backup servers are secure, isolated, and accessible only by backup applications.
Repository: Security Obligation of the GDPR.
Our infrastructure relies heavily on open-source technologies that align with an extremely vast community of contributors and users whose security failures are discovered quickly. We systematically apply approved security patches that are considered stable.