Practical Cloud customers that collect and store personal data are considered data controllers under Directive 95/46/EC. Data controllers bear the primary responsibility for ensuring that their processing of personal data is compliant with relevant EU data protection law, including Directive 95/46/EC and the GDPR as of May 25, 2018.

The European Commission has approved a set of standard provisions called the Standard Contractual Clauses (“Model Clauses”) which provide a data controller a compliant mechanism to transfer personal data to a data processor outside the European Economic Area (“EEA”).

Practical Cloud periodically replicates data for purposes of archival, backup and audit logs. We use CodeGuard and Rackspace to store some of the information that is backed up, such as database information and attachment files.

Service data and customer data like encrypted file storage, email, archiving and backup are region specific. We use different providers for different services. Data hosted in the EU region does not leave that region.

The General Data Protection Regulation (“GDPR”) is a new European privacy regulation which will replace the current EU Data Protection Directive (“Directive 95/46/EC”). The GDPR aims to strengthen the security and protection of personal data in the EU and harmonize EU data protection law.

The GDPR applies to all organizations operating in the EU and processing “personal identifiable data” of EU residents. Personal data is any information relating to an identified or identifiable natural person.

One of the key aspects of the GDPR is that it creates consistency across EU member states on how personal data can be processed, used, and exchanged securely. Organizations will need to demonstrate the security of the data they are processing and their compliance with GDPR on a continual basis, by implementing and regularly reviewing robust technical and organizational measures, as well as compliance policies.

Practical Cloud will be compliant with the GDPR when it becomes enforceable in May 2018. Our privacy team is working with customers around the world to answer their questions and to help them prepare for using Practical Cloud’s Services after the GDPR becomes effective. Additionally, our privacy team is reviewing Practical Cloud’s current product features and practices to ensure we support our customers with their GDPR compliance requirements.

Practical Cloud encourages customers to begin preparing for the GDPR by reviewing their privacy and data security processes and policies to ensure compliance by May 2018. Data controllers bear the primary responsibility for ensuring that their processing of personal data is compliant with EU data protection law. Below are some key points to consider for GDPR compliance:

• Geographical Application: The GDPR may apply to organizations that are established in the EU as well as certain organizations established outside the EU but which are processing the personal data of EU citizens, depending on their activities.
• Rights of End-Users: Organizations should be cognizant of End-Users whose personal data they may be processing. The GDPR establishes enhanced rights for End-Users, and organizations should be able to accommodate those rights.
• Data Breach Notifications: Organizations that are controllers of personal data should have clear processes in place in order to comply with the GDPR requirement to report data breaches in accordance with the time frames set out within the GDPR. Practical Cloud will notify affected customers without undue delay if we become aware of a data breach of our services.
• Appointment of Data Protection Officer (“DPO”): Customers may need to appoint DPOs to manage issues relating to the processing of personal data.
• Data Processing Agreement (“DPA”): Where personal data is transferred outside the EEA, a customer may need DPAs in place with its sub-processors to ensure an adequate level of protection for the transferred data. Practical Cloud’s DPA addresses GDPR and can be obtained by submitting a request to [email protected]
• Data Protection Impact Assessment (“DPIA”): DPIAs usually describe organizations data processes and protective measures, particularly those that may be risky. For data processing activities, customers need to conduct and file with authorities a DPIA.

Customers can use Practical Cloud’s third-party ISO certifications and SOC 2 audit reports to help conduct their risk assessments and determine whether appropriate technical and organizational measures are in place. For additional information, please contact us at [email protected].

Practical Cloud provides customers the option to delete Service Data that may contain personal data, such as profiles, tickets, images, and attachments, in active Practical Cloud Support accounts. Customers also have full access to delete cloud data, such as emails, archives, backups, databases and website content.