A Privacy Impact Assessment (PIA) is required under GDPR for data-intensive projects, and is a living document which must be made accessible to all involved with a project. It is the process by which we discuss, audit, inventory, and mitigate the privacy risks inherent in the data we collect and process.

Like all GDPR documentation, a PIA can be requisitioned by a data protection regulator in the event of a privacy concern or data breach. 

This document was last updated March 2018
 

1. Data collection and retention

1. What personal data is processed?
   We collect the following data during signup: Name (first and last), Address, City  and Zipcode, Country of residence, Email, Phone and VAT ID if applicable. In addition we log the IP address of the user.
    
2. How is that data collected and retained?
   Data is collected using HTML forms and transmitted via an encrypted (SSL) HTTPS connection to a central Webdock server. Here the data is stored in a MySQL database. The user password is encrypted and not known by us.
    
3. For how long is data stored, and when is the data deleted?
   Data is stored for as long as customers have an active account. If a customer deletes their account, all personally identifiable information is deleted with the exception of certain network and traffic logs which may persist for up to a year. Third party services such as Google Analytics may store data such as IP addresses and website interactions for much longer. Please see our Third Party Information sharing page for details on which services we share data with.
    
4. Is the data collection and processing specified, explicit, and legitimate?
   Yes.
    
5. What is the process for granting consent for the data processing, and is consent explicit and verifiable?
   Consent is a pre-requisite for signing up with Webdock.
    
6. Is the data minimized to what is explicitly required?
   We do not gather any more data than required in order to comply with EU law and for the purposes of billing.
    
7. Is the data accurate and kept up to date?
   We can only verify certain information and do so rarely. Information is kept up to date by the customer themselves.
    
8. How are users informed about the data processing?
   Users are informed about the data processing through our data protection and privacy policies and notices available on our website.
    
9. What controls do users have over the data collection and retention?
   Absolute. At any time a user can delete or modify their information.

2. Technical and security measures

1. Is the data encrypted?
   All data is encrypted during transit, but only passwords are encrypted at rest.
    
2. Is the data anonymized or pseudonymized?
   No.
    
3. Is the data backed up?
   Yes. Daily.
    
4. What are the technical and security measures at the host location?
   Stringent security protocols protect the server and running services. Server is continuously kept up to date. Passwords are very secure. Firewall is stringent and tools such as Fail2Ban are implemented. We continuously monitor all activity on the central server.

3. Personnel

1. Who has access to the data?
   All Webdock support staff and engineers.
    
2. What data protection training have those individuals received?
   Basic GDPR training. Most employees are highly technically proficient and have deep insight into IT security.
    
3. What security measures do those individuals work with?
   Network and systems monitoring, encryption and more.
    
4. What data breach notification and alert procedures are in place?
   Automated alerts are set up for unusual activity as seen in system logs. Unusual traffic is logged and flagged to Webdock engineers.
    
5. What procedures are in place for government requests?
   Standard procedures are in place for such requests, and we have a published Warrant Canary

4. Subject access rights

1. How does the data subject exercise their access rights?
   By contacting Webdock support at info@webdock.io
    
2. How does the data subject exercise their right to data portability?
   By contacting Webdock support at info@webdock.io
    
3. How does the data subject exercise their rights to erasure and the right to be forgotten?
   By deleting their account, or contacting Webdock support
    
4. How does the data subject exercise their right to restrict and object?
   By contacting Webdock support at info@webdock.io

5. Legal

1. Are the obligations of all data processors, including subcontractors, covered by a contract?
   Yes.
    
2. If the data is transferred outside the European Union, what are the protective measures and safeguards?
   Webdock utilises several companies to provide us with web analytics services, these companies may store data in the USA.  These data sets will have very limited amounts of personal data in them, namely IP addresses.  Please see our page on Third Party Information Sharing

6. Risks

1. What are the risks to the data subjects if the data is misused, mis-accessed, or breached?
   Data listed in section 1.1 could be exploited. As we only gather otherwise publicly accessible information, our assessment of the privacy impact is that it is moderate.
    
2. What are the risks to the data subjects if the data is modified?
   None personally. Malicious 3rd parties may, by virtue of hacking their account, gain access to servers and information therein which is outside the purview of Webdock.
    
3. What are the risks to the data subjects if the data is lost?
   They may loose access to their account. Unless all backups and duplications of our control backend is lost as well, we will always be able to re-construct a user account. If a user actively deletes their account, or if a malicious 3rd party does so, user data would be lost in the course of 3 weeks, unless we are made aware of this happening.
    
4. What are the main sources of risk?
   Zero-day exploits of our CMS and/or toolchain which includes but is not limited to: Linux kernel (Ubuntu), Apache/Nginx, PHP, MySQL, SSH and related services.
    
5. What steps have been taken to mitigate those risks?
   As outlined in sections 2.4 and 3.4 we pro-actively and defensively keep our systems up to date, monitor intensively and review security frequently.