PeopleSpheres' GDPR Policy

The GDPR or General Data Protection Regulation, also known as European Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, came into force on 25 May 2018. 

This text pursues the objective of strengthening the protection of citizens’ data. andUropeans and standardize legislation on the subject for different European countries.

This text therefore complements or strengthens various points of our national legislation, such as the logic of responsibilities, the involvement of subcontractorss or strengthening the rights of individuals with regard to their data.  

New tools for Framework for data protection are also highlighted by this textAmong them we can mention the register of treatments. and Privacy impact analysis.

One of the main contributions of the GDPR is its scope of application. Thus, You are affected by this regulation if you meet one of the two conditions below :  

• You traitez Data of European citizens  

• Your organization is established in the European Union 

Moreover, only professional activities are concerned. This refers to the term “professional” in its broadest sense. We are referring here to what the CNIL calls “the ‘domestic exception.” This exception applies when you process data for purely personal purposes, such as your contact directory of friends and family or the storage of holiday photographs.  

As well as you represent a company (GE, ETI, SME, SME or VSE), an association, a local authority or an administration in the public or private sector as a controller or subcontractor ; if you can answer “‘yes ” to one of the two conditions specified above, you are subject to the GDPR.  

As such, PeopleSpheres is also subject to the various obligations of the GDPR.

A revised chain of responsibility

The GDPR redesigns the chain of responsibility by assigning a specific place and a share of responsibilities to the subcontractor.  

Today, with the European regulation, the data controller a the responsibility for the elements that it is capable ofQ(including the selection and supervision of its subcontractorss), the subcontractor takes part of the responsibility for the elements of which it has control (e.g. technical elements of development, selection and supervision of subsequent subcontractors) and finally the subsequent subcontractors also have responsibility for the elements of which they are masters.  

This division of responsibilities must be clearly established in the contract that frames the customer/supplier relationship.  

As such,, PeopleSpheres has revised its General Terms and Conditions of Sale. 

The framework for the outsourcing of personal data processing

As a data controller, you need to supervise your subcontracting. The term “subcontractor” includes your suppliers, service providers and sometimes even your partners.
The framework for this subcontracting will primarily be contractual. Indeed, it is essential to contractually define certain elements such as the distribution of responsibilities, transfers to third countries not recognized by the EU, subsequent subcontractors, the deletion of data once it is no longer needed…

On the other hand, you cannot limit yourself to contractual supervision, especially if your contractor has access to sensitive data. The second measure of supervision is control, it can take several forms: a self-assessment questionnaire, a collection of documentation, a direct exchange with the subcontractor to discuss the security measures put in place.

Audit and Design

This mapping allowed us to identify all the treatments that needed to be audited.

We then built audit guides by cross-referencing the obligations of the following AFAQ data protection standards, the CNIL Governance Label, the G29 recommendation, and the text of the GDPR.

This audit guide was deployed across all treatments, allowing us to identify non-conformities and areas for improvement.

Then, based on these findings, we designed an action plan and prioritized the elements related to our clients’ compliance.

Application

The application phase is the only phase whose end date is not announced because it is a dynamic of continuous improvement. On the other hand,  PeopleSpheres  is already compliant and continues to improve its practices according to the recommendations of the CNIL and ANSSI.

Technical security of PeopleSpheres

Our hosting provider is certified ISO27001, ISO 50001, TIERS III by the Uptime Institute, PCI-DSS and HDS, so it offers the necessary measures regarding the technical and physical security of servers and physical storage sales.

To ensure an additional level of security,  PeopleSpheres  has a two-tier disaster recovery plan:

• In the event of an incident on the main server or in the main storage room within the data center,  PeopleSpheres replicates the database daily to another instance located in a separate room.
• In the event of a major incident within the data center, the database is replicated in real time to other servers in France. This allows the application to be connected directly to this database in the event of an incident instead of having to wait for the data to be restored to the production base to restart the services.

In any case, we guarantee the following :

• RPO (Recovery Point Objective) :1h
• RTO (Recovery Time Objective): 24h

The availability of the servers is controlled by passive and active probes. The availability rate is 99.5% annually.

All databases are encrypted with an AES key. These are the APIs that decrypt and encrypt the data at the time of recovery and backup in the database.  The connection to the database is done via TLS.

All accesses and actions are recorded and recorded  with unique identifiers  in event logs. The roles represent logical constraints of supervision and restriction of visibility.

When adding a field to a form, each client can define for the different roles if they have the right to modify, view the field, or if it needs to be marked.

When creating a field, it is also possible to set a sensitivity level of the field.

Data Protection Governance at  PeopleSpheres

The entire PeopleSpheres  IT park is equipped with an antivirus that is updated automatically and synchronously.

All computers have an automatic locking system lasting up to 10 minutes. Additionally, the  PeopleSpheres  policy requires the computer to be locked in case of absence. Each employee is made aware of the risks associated with data processing and computerized workstation work upon arrival and throughout their contract.

The use of nomadic storage space other than those controlled and delivered by  PeopleSpheres  is prohibited. The use of this type of storage method is limited to cases of necessity.

With the aim of continuously improving its practices,  PeopleSpheres  has implemented frequent awareness-raising actions.

In particular, a strong awareness during the onboarding process of a new employee as well as a policy regarding the protection of data handed over to each new employee.

In addition, recurring awareness-raising actions are organized at least monthly around data protection.

PeopleSpheres  annually organizes an internal audit campaign on compliance with procedures and general policies regarding the processing of personal data.

PeopleSpheres  has also created a register of processing as a processor and as a data controller, which is updated regularly and at least monthly.

All contractual clauses have been revised and adapted to the new obligations, as well as our GTC.

Our compliance is as important as our customers’ compliance, but it is not everything. In order to better support companies that use PeopleSpheres, we have created operational guides to support them in their own compliance.  We offer the following aids :

• Operational guide for respecting the right to information throughout an employee’s career.
• Guide to support the creation of the processing register as part of the use of MyPortalRH
• Explanation of the legal bases for processing

You can find articles on these topics in our blog posts.

We also offer a pre-filled impact analysis and a compliance support offer.

Finally, our clients can count on our consultants to advise them on good practices in data protection.