GDPR Compliance Policy

Design Phase Integration:

Whenever we develop or update software, applications, or business processes that involve personal data, we proactively assess privacy risks and incorporate protective measures at the design stage. For example, we minimize data collection to only what is necessary for the specified purpose (data minimization) and choose system architectures that safeguard personal data (such as using pseudonymization or aggregation techniques where appropriate).

Default Privacy Settings:

Livappy's services are configured with privacy-friendly defaults. This means that, unless a user actively chooses otherwise, the minimum necessary personal data is collected and used. Any features that could impact privacy are set to the most protective settings by default⁹. Users are not required to opt-in to extra data collection for the service to function – privacy is the standard setting.

Data Protection Impact Assessments (DPIAs):

We conduct Data Protection Impact Assessments for any new or significantly changed processing activities that may pose high risks to individual privacy. Through DPIAs, we identify potential privacy issues early and address them by adjusting our design or implementing additional safeguards. This process ensures compliance with GDPR Article 35 and demonstrates our thorough consideration of privacy risks in advance.

Training and Awareness:

Our engineering and product teams receive training on Privacy by Design principles. We cultivate an internal culture where employees and contractors are aware of privacy obligations and consistently apply privacy-centric thinking when handling personal data. Before launching new features, we conduct privacy reviews or checklists to ensure compliance controls are in place.

Ongoing Reviews and Improvements:

Privacy by Design is not a one-time effort. Livappy continuously monitors and reviews its systems to ensure they uphold privacy standards over time. We perform periodic audits and updates to security and privacy controls, adapt to new regulatory guidance, and incorporate user feedback to improve data protection. If changes in technology or data use occur, we revisit our designs to maintain the highest level of data protection by default.

Encryption:

All personal data handled by Livappy is protected by strong encryption, both in transit and at rest. We use up-to-date encryption protocols (such as TLS) for data in transit over networks, and robust encryption algorithms to encrypt data stored in our databases and backups. This ensures that even if data were to be intercepted or accessed without authorization, it would remain unintelligible and secure¹². Where feasible, we offer mechanisms for managing encryption keys securely to prevent any single point of compromise.

Access Controls:

Livappy enforces strict access control mechanisms to ensure personal data is only accessible to authorized personnel on a need-to-know basis. We have implemented role-based access controls and user authentication systems (including multi-factor authentication for sensitive systems) to limit who can access data. Staff access to personal data is granted based on job role and revoked or adjusted promptly when roles change. Every employee or contractor with access to personal data is bound by confidentiality obligations and receives training on data security.

Logging and Monitoring:

We maintain detailed logging of system access and data processing activities. All access to personal data repositories, as well as significant actions taken with personal data, are logged in secure audit trails. Livappy employs monitoring tools to review logs and detect any irregular or unauthorized activities. This not only helps us prevent and identify potential security incidents, but also provides an audit record to demonstrate accountability for data access and modifications.

Network and System Security:

Livappy protects its IT systems through measures such as firewalls, intrusion detection and prevention systems (IDS/IPS), anti-malware protection, and secure network architecture. We separate environments (e.g., development, testing, production) to reduce risk, and employ vulnerability management practices including regular vulnerability scanning and penetration testing. Any identified security issues are promptly addressed.

Organisational Policies and Training:

We have established internal security and data protection policies that all employees and contractors must follow. These policies cover proper handling of personal data, use of devices, incident reporting protocols, and more. We conduct regular training and awareness programs so that our team stays vigilant and knowledgeable about cybersecurity and privacy best practices. Access to personal data requires compliance with these policies, and violations can result in disciplinary action.

Regular Audits and Assessments:

Livappy periodically audits its data protection measures and conducts risk assessments to ensure ongoing effectiveness. We review user access rights regularly, test our incident response plans, and may engage independent auditors to evaluate our security controls. Any weaknesses or opportunities for improvement identified are promptly remediated. These audits help us maintain compliance and continually align with evolving security standards and regulatory guidance.

Business Continuity and Backups:

To protect against data loss or destruction, we maintain secure data backup routines and have disaster recovery plans in place. Backups of critical personal data are encrypted and stored securely (including off-site or cloud backups), and we periodically test data restoration. In the event of any system failure or disaster, Livappy can recover personal data to prevent permanent loss, in line with integrity and availability requirements.

Pseudonymization and Data Minimization:

Wherever appropriate, Livappy applies pseudonymization to personal data – replacing identifying fields with artificial identifiers – to reduce risk in case of unauthorized access. We also adhere strongly to the principle of data minimization, collecting and retaining only the personal data that is necessary for our specified purposes¹⁰. By minimizing the data we hold and separating or anonymizing data where possible, we limit the impact of any potential security issue.

Immediate Detection and Internal Alert:

We have systems and processes in place to detect and alert us to potential data breaches. Our employees are trained to recognize and escalate security incidents. The moment a breach is suspected or identified, our internal response team (which includes IT, security, and management personnel) is notified. We designate a specific incident manager to oversee the investigation.

Containment and Assessment:

Livappy will quickly contain the breach to prevent further data leakage (for example, by isolating affected systems, revoking compromised credentials, or shutting down specific functions). We then investigate the incident to determine the nature and scope of the breach, what data and individuals are impacted, and the potential risks to data subjects. As part of this assessment, we evaluate the likelihood and severity of any harm that may result.

Notification of Affected Individuals:

If the breach is likely to result in a high risk to the personal data or privacy of individuals, we will also communicate the breach to the affected data subjects without undue delay¹⁷. This communication will be done in clear and plain language, describing the nature of the breach and providing recommendations for the individuals to mitigate potential adverse effects (for example, we might advise resetting passwords or being vigilant against phishing if credentials were exposed). We will not notify individuals if, due to effective technical measures (like encrypted data) or other factors, the breached data is unintelligible or the risk is low, unless authorities instruct us to do so.

Remediation and Future Prevention:

Livappy will immediately take steps to remediate the cause of the breach. This may involve fixing software vulnerabilities, tightening access controls, improving encryption, or other corrective actions to ensure a similar incident does not recur. We will also document lessons learned and update our security policies and training accordingly. Senior management is informed of all breaches and remediation progress, ensuring accountability and support for necessary improvements.

Documentation:

In compliance with GDPR Article 33(5), Livappy documents all data breaches, regardless of whether they require notification. This internal breach register records the facts relating to the breach, its effects, and the remedial actions taken. Such documentation allows supervisory authorities to verify our compliance and helps us continually refine our security incident response. Even for minor incidents, we keep a record as part of our accountability obligations¹⁸.

Mandatory DPAs with All Processors:

We have a policy that no personal data will be shared with or entrusted to a third-party processor unless a GDPR-compliant DPA is in place. This includes major partners such as Amazon Web Services (AWS) for cloud hosting, Veriff for identity verification services, Google for cloud-based tools or analytics, and any other vendor or contractor processing data. Each of these processors has contractually agreed to abide by GDPR's requirements, to only process data on Livappy's documented instructions, and to implement appropriate security measures.

Assurances and Sufficient Guarantees:

In line with Article 28 and Recital 81 of the GDPR, Livappy only engages processors that provide sufficient guarantees of their capability to protect personal data²¹. Our Data Processing Agreements stipulate that processors must implement all appropriate technical and organizational measures to safeguard data (e.g., encryption, access controls, confidentiality obligations) and assist Livappy in fulfilling data subject requests and breach notifications as needed²². We carefully vet new suppliers for their data protection practices and reputation before onboarding them as processors.

Key DPA Terms:

Each DPA that Livappy signs contains all required clauses as per GDPR Article 28(3). These include, among others: the processor will process personal data only on Livappy's instructions; personnel processing the data are bound by confidentiality; the processor will help ensure compliance with security requirements and assist with data subject rights and DPIAs; sub-processors cannot be engaged without our authorization and must be bound by the same obligations; the processor will return or delete personal data at the end of the engagement; and the processor must submit to audits and provide evidence of compliance²². These contractual terms give Livappy and our users confidence that personal data remains protected even when handled by third parties.

Monitoring and Enforcement:

Livappy maintains an inventory of all current data processors and the status of our agreements with them. We monitor our processors' compliance – for example, by reviewing their security certifications, audit reports, or adherence to codes of conduct. If a processor fails to meet their data protection obligations, we take prompt action which could include requiring remediation, suspending data processing, or even terminating the contract. Additionally, our DPAs hold processors liable for protecting the data, meaning they must indemnify Livappy (and ultimately our users) for any damage caused by their processing that doesn't meet GDPR standards.

Sub-processors:

Where our processors further subcontract any processing (for instance, if AWS uses subcontractors in maintaining data centers), those sub-processors are required by our DPAs to be held to the same standards. Livappy's contracts ensure there is a chain of GDPR-compliant obligations down through all levels of data processing.