Privacy notices for the usage of FUTURA Engineering

Requirements of the European General Data Protection Regulation (GDPR)

1.      Introduction

Futura Solutions GmbH (hereinafter referred to as 'Futura Solutions') develops and operates the cloud-based purchasing and procurement platform FUTURA^®, which is used to digitally interconnect business processes between purchasers (hereinafter referred to as “customer”) and external actors, i.e., service providers, partners, and suppliers (hereinafter referred to as “users”). This technical communication basis, provided by means of a browser, enables the exchange of information and documents (hereinafter referred to as 'information') for the purpose of collaboration.

In the cloud-based purchasing and procurement platform FUTURA^®, personal data is necessarily collected and stored by the business partner (“customer”) of “user” for specific purposes defined by “customer”. In this respect, “customer” is primarily the “controller” in the sense of the EU General Data Protection Regulation (GDPR) (see Art. 4 para. 7) by collecting the personal data of “user”. “Futura Solutions” in turn processes data on behalf of the “customer” and is therefore a “processor” in the sense of the GDPR (see Art. 4 para. 8). For this reason, a contract has been concluded with “customer” for commissioned data processing in accordance with Art. 28 GDPR.

In the course of the activation of the user account (hereinafter referred to as 'account') by ‘user’, the latter has the possibility to change the personal data collected by ‘customer’. In this respect, with the activation of the 'account' by the ‘user’, the 'user' becomes responsible for the personal data originally collected by the ‘customer’.

The protection of natural persons with regard to the processing of personal data is a fundamental right. The GDPR considers this as well.

“Futura Solutions” fully implements the regulations of the GDPR as “processor” towards “customer” and “user”. “Futura Solutions” maintains a list of processing activities in accordance with Art. 30 GDPR (see Appendix 03).

“Futura Solutions” ensures that data and in particular personal data is stored within the European Union (EU) and that there is no transfer of this data to third countries.

As a “processor”, “Futura Solutions” also guarantees that personal data is protected and that the rights of the data subjects are observed if they fall within the area of responsibility of a “processor”.

2.      Definition of terms (GDPR) – Art. 4 (excerpt)

For the purposes of the Regulation, the terms “personal data” or “data subject”, “controller” and “processor” are defined as follows:

(1)  “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(2)  “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

(3)  “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

(4)   “consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

3.      Acknowledgement and confirmation process

These privacy notices must be acknowledged by “user” in the course of the activation of their user account (hereinafter referred to as “account”). In addition, "user" must confirm the General Terms of Use. The acknowledgement as well as the confirmation must be made prior to the initial registration or prior to a registration after a possible change of the privacy notices or the General Terms of Use.

The acknowledgement and confirmation are logged. Without this acknowledgement and confirmation, registration and ultimately the usage of the FUTURA^® cloud service is not possible.

Upon activation of the “account” by “user”, the user himself becomes the “controller” of the personal data originally collected by “customer”.

4.      Rights of data subjects

4.1      Information concerning the protection of personal data

The following passage contains information about the protection of personal data of the data subject as laid down in Articles 13 and 14 (GDPR):

4.2      Automatic erasure of personal data

4.2.1        Erasure of personal data of “users” who have never participated in a business transaction or activity

In the event that an account with personal data has been created for a “user” (“data subject”) for the purchasing and procurement platform FUTURA^®, if the “user” does not take note of the privacy notices provided there and at the same time does not agree to the  Terms of Use provided in the same place and/or also objects to the processing of personal data, or if the “user” does not respond to the "controller's” invitation to complete the registration process and activate the account within a certain period of time, this account with the personal data collected by the “controller” will be automatically deleted. The deadline for this is 90 days after the “controller” has sent the invitation

About the procedure: The initiator or “controller” of a business transaction or business activity creates a new “user” (“data subject”) in the purchasing and procurement platform FUTURA^® and collects personal data for this purpose. FUTURA^® then automatically generates an account and sends the access data to the registered e-mail address. The access data is sent via e-mail

“User” now has 90 days to react or register. They will be reminded of this within the 90 days and will be informed about the consequence, namely that the created “account” will be automatically deleted after this period.

4.2.2        Erasure of personal data of “users” who have participated in a business transaction or activity at least once

“Account”, including all personal data of “user” who has participated at least once in a business transaction or activity will be deleted automatically after expiration of the statutory retention period following their last participation in a business transaction or activity.

The statutory storage obligations are regulated in contracts between “customer” and “Futura Solutions”.

The rights, in particular the right to information of “data subjects” in accordance with the GDPR are unaffected by this.

Appendix 01 – Technical and organizational measures (TOM)

1. Confidentiality (Art. 32 para. 1 lit. b GDPR)

• Equipment access control
  No unauthorized entrance to data processing facilities, e.g.: magnetic or chip cards, keys, electric door openers, plant security or gatekeepers, alarm systems, video systems;

• Login control
  No unauthorized system usage, e.g.: (secure) passwords, automatic locking mechanisms, two-factor authentication, encryption of media;

• Data access control
  No unauthorized reading, copying, modification or removal within the system, e.g.: Authorization concepts and customized access rights, logging of hits;

• Separability
  Separate processing of data collected for different purposes, for example: multi-client capability, sandboxing;

• Pseudonymization (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR)

The processing of personal data in such a way that the data can no longer be assigned to a specific data subject without the inclusion of additional information, provided that this additional information is kept separately and is subject to appropriate technical and organizational measures, e.g.: the replacement of the name and other identifying features with a mark for the purpose of excluding or significantly complicating the identification of the data subject.

2. Integrity (Art. 32 para. 1 lit. b GDPR)

• Disclosure control
  No unauthorized reading, copying, modification or removal during electronic transmission or transport, e.g.: encryption, Virtual Private Networks (VPN), electronic signature;

• Input control
  Determining if and by whom personal data in data processing systems has been entered, modified or removed e.g.: Logging, document management;

3. Availability and resilience (Art. 32 para. 1 lit. b GDPR)

• Availability control
  Protection against accidental or willful destruction or loss, e.g.: Backup strategy (online/offline; on-site/off-site), uninterruptible power supply (UPS), virus protection, firewall, reporting channels and emergency plans;

• Resilience

Data processing systems must be so resilient that their functionality is guaranteed even under intensive traffic and heavy workloads e.g.: reducing the error-proneness of individual system components, increasing agility through virtualized system components and resources;

• Fast restorability (Art. 32 para. 1 lit. c GDPR)

The ability to restore the availability of and access to personal data quickly in the event of a physical or technical incident. For example, implementing a contingency management with the description of the strategic approach, via e.g., a contingency management guideline and/or policy, the as-is analysis of business impacts and risks and a corresponding implementation plan as well as a contingency prevention concept, business continuity planning, a restart plan and the execution of multi-stage contingency tests.

4. Procedures for regular review, assessment and evaluation (Art. 32 para.1 lit. d GDPR; Art. 25 para. 1 GDPR)

• Data protection management system (DSMS)

Procedures for regular review, assessment and evaluation, e.g.: implementation of a data protection management system (DSMS) with the description of the strategic approach, for example, by means of a data protection management guideline and/or policy, creation of lists of processing activities (in accordance with Art. 30 para. 2 GDPR), preparation of privacy notices, elaboration of erasure concepts as well as regular auditing of the planned and taken measures by an external data protection officer.

• Incident-response-management

Firewalls, spam filters as well as virus scanners are used, which are updated regularly. Furthermore, IDS and IPS systems are used.

• Privacy-friendly presets (Art. 25 para. 2 GDRP)

Measures are in place to ensure privacy-friendly presetting. The exercise of the right of withdrawal can be carried out by technical means.

• Processing control
  No commissioned processing within the meaning of Art. 28 GDPR without corresponding instructions from the client, e.g.: clear contract design, formalized order management, strict selection of the service provider, obligation to convince in advance, follow-up checks.

Appendix 02 – List of processing activities in accordance with Art. 30 EU-GDPR

I.       General

‘Futura Solutions’, in the role of a “processor”, has drawn up a list of processing activities in accordance with Article 30 paragraph 1 of the GDPR, with the following content:

1. The name and contact details of the “processor” and the data protection officer.

2. The purposes of the processing.

3. A description of the categories of data subjects and the categories of personal data

4. The categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations.

5. Where appropriate, transfers of personal data to a third country or international organization, including an indication of the third country or international organization concerned, and, in the case of transfers referred to in the second subparagraph of Article 49 para. 1, the documentation of appropriate safeguards

6. If possible, the deadlines specified for the erasure of the various categories of data.

7. If possible, a general description of the technical and organizational measures referred to in Article 32 para. 1.

The information in section 1 shall precede the contents of the individual processing operations.

II.            List of processing activities

a.      Contact details

Below you will find the contact details of ‘Futura Solutions’ as "order processor" as well as the contact details of the external data protection officer of ‘Futura Solutions:

b.      Description of processing

The purpose and category of processing operations carried out on behalf of a customer are listed below: