Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The company reviews data center access at least once a year.

The company uses environmental monitoring devices configured to automatically alert management in the event of environmental incidents.

To establish efficient governance for PII processing.

To minimize the PII which is processed to what is strictly necessary for the legitimate interest pursued by the PII controller and to limit the disclosure of PII to a minimum number of internal and external parties.

To retain PII no longer than necessary to fulfill the stated purpose(s) or to abide by applicable laws.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

To ensure, through contractual or other means, that third party recipients provide at least equivalent levels of PII protection.

Mandatory: - Requests from data subjects are handled without undue delay - Procedures are established to support the controller in responding to data subject requests - Employees are trained to immediately notify the responsible contact upon receipt of a data subject request and to coordinate subsequent actions accordingly

To establish a privacy impact assessment process and to perform a privacy impact assessment as necessary.

To monitor and audit PII protection controls and the effectiveness of internal PII protection policy.

Mandatory: - Requests from data subjects are handled without undue delay - Procedures are established to support the controller in responding to data subject requests - Employees are trained to immediately notify the responsible contact upon receipt of a data subject request and to coordinate subsequent actions accordingly

Mandatory: - Transfers of data to third countries are identified and systematically documented - Documentation of third-country transfers is maintained, for example within the register of processing activities - Appropriate safeguards for international data transfers are in place in accordance with Chapter 5 of GDPR, including consideration of relevant court decisions and transfer impact assessments where applicable - It is determined whether consent from the responsible party is required for each transfer to a third country