What is GDPR, and how does it affect Karbon Customers?
GDPR stands for General Data Protection Regulation, a comprehensive data protection law enacted by the European Union (EU) to protect the personal data and privacy of EU and UK citizens. It applies to any organization that processes the personal data of EU/UK residents, regardless of where the organization is located.
How does Karbon Comply with GDPR?
Karbon takes GDPR compliance seriously and has implemented robust measures to ensure the protection of personal data. These measures include encryption of data, regular security audits, access controls, and ongoing employee training on data protection practices.
Additionally, we have implemented internal privacy policies and practices to adhere to data privacy principles outlined within GDPR requirements.
What is a Data Processing Agreement (DPA), and why is it important?
A Data Processing Agreement (DPA) is a legally binding contract between Karbon and its customers that outlines the terms and conditions of data processing activities. It ensures that both parties understand their responsibilities concerning GDPR compliance and provides assurances that personal data will be processed in accordance with GDPR requirements.
What are the key points a DPA should cover?
The GDPR outlines specific requirements for DPAs, but key points typically include:
The nature and purpose of the processing: This specifies what type of personal data is processed, for what purpose, and for how long.
Security measures: This details the technical and organizational measures in place to protect personal data from unauthorized access, disclosure, alteration, or destruction.
Data subject rights: This outlines how the controller and processor will facilitate the rights of data subjects (individuals whose data is being processed) to access, rectify, or erase their data.
Sub-processors: This clarifies whether the processor can engage sub-processors (other companies that process the data on their behalf) and the requirements for doing so.
Data breach notifications: This specifies the process for notifying the controller and relevant authorities in case of a data breach.
Why does Karbon need a DPA?
Karbon utilizes third-party services like cloud storage, marketing platforms, and payment processors that all process (i.e., collect, use, store, or otherwise interact) personal data of EU and UK citizens and collect and process personal data of EU and UK citizens directly through our web application software.
As a result of these data processing activities, GDPR requires that we communicate specific roles and responsibilities related to these data processing activities to our customers, and the DPA is a useful method for doing so.
Does Karbon offer a Data Processing Agreement (DPA)?
Yes, Karbon offers a comprehensive Data Processing Agreement (DPA) to all its customers who process personal data subject to GDPR. Our DPA outlines the specific roles and responsibilities of both parties regarding data processing, security measures, data breaches, and compliance with GDPR requirements.
How can I obtain a copy of Karbon's Data Processing Agreement (DPA)?
if you are a customer, you can request a copy of our Data Processing Agreement (DPA) by contacting your Customer Success Manager or emailing support@karbonhq.com. You will then recieve the necessary documentation to ensure you have a DPA in place for your service relationship with Karbon and the use of the Karbon product and services.
Is Karbon certified under GDPR or any other data protection standards?
While Karbon does not hold an official certification under GDPR, Karbon adheres to GDPR principles and continuously evaluates its processes to ensure compliance. Karbon is certified under AICPA SOC 2 Type 2 compliance, which includes an independent, objective, evaluation of our privacy practices. Our SOC 2 certification does not provide direct assurance or certification that Karbon complies with GDPR; however, it does provide assurance that we have implemented privacy practices to safeguard personal information processed by our web application product.
What steps should our organization take to ensure GDPR compliance when using Karbon's services?
To ensure GDPR compliance when using Karbon's services, your organization should:
Review and sign the Data Processing Agreement (DPA) to establish clear responsibilities and obligations.
Implement appropriate technical and organizational measures to protect personal data processed through our services.
Provide necessary transparency to individuals regarding the processing of their personal data.
Implement your own policies and procedures for information security and data privacy within your organization, and regularly review and update these policies and procedures to align with security standards and GDPR requirements.
Train employees who handle personal data on GDPR compliance and data protection best practices.
Consider hiring consultants or specialists who can assist with your information security and data privacy compliance program.
What should I do if I have further questions about GDPR compliance or our Data Processing Agreement (DPA)?
If you have any further questions regarding GDPR compliance or our Data Processing Agreement (DPA), please reach out to your Customer Success Manager or email support@karbonhq.com
We are committed to assisting our customers in understanding GDPR compliance and its impact on the use of our services.
Where can I find more information about the GDPR?
The official website of the European Commission provides comprehensive information about the GDPR: https://gdpr.eu/.
Remember, this FAQ is for informational purposes only and should not be taken as legal advice. It's crucial to consult with legal professionals to ensure your software company complies with the GDPR and properly implements DPAs.