GDPR charter
Summary
This charter summarises the commitments of Clarify Consult Partner Europe regarding personal data protection, in accordance with the GDPR (EU 2016/679), the Belgian law of 30 July 2018, and any equivalent European or national legislation. It complements the Privacy Policy.
1. Company commitment
The Company commits to respect the principles of article 5 GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.
2. Privacy by Design and by Default
In accordance with article 25 GDPR, data protection is integrated from design and guaranteed by default. Each major evolution undergoes prior review.
3. Records of processing activities
The Company maintains records in accordance with article 30 GDPR, listing all operations under its responsibility and as processor.
4. Roles
4.1. Controller for directly collected data (prospects, clients, suppliers, candidates, visitors, employees).
4.2. Processor within the meaning of article 28 GDPR for data deposited by Clients on the Services.
5. Technical measures
- TLS 1.3 encryption, EV certificates
- AES-256 encryption at rest
- Pseudonymisation for testing, development, analysis
- Encrypted backups every 6 hours, 90-day retention, EU geographic replication
- Strict multi-tenant isolation
- Robust authentication, mandatory MFA for admins, rotation
- RBAC access control (least privilege)
- Logging of personal data access, logs kept for 1 year
- Annual external penetration testing
- CVE monitoring and diligent patching
6. Organisational measures
- Mandatory annual employee awareness
- Confidentiality undertaking signed by each employee
- Equipment usage policy
- Formal onboarding/offboarding procedures
- Continuity and recovery plans tested annually
- Formal incident management procedure
7. DPO
The Company has appointed a DPO in accordance with articles 37 to 39 GDPR. Contact: [email protected].
8. Notification of breaches
- To supervisory authority within 72 hours (Art. 33)
- To data subjects if high risk, without undue delay (Art. 34)
- To Clients when acting as processor, without undue delay (Art. 33.2)
The Company documents all breaches and measures taken.
9. DPIA
In accordance with article 35 GDPR, the Company conducts a prior impact assessment for any processing likely to result in high risk. Reviewed at each substantial evolution, at least every 3 years.
10. International transfers
- Adequacy decision (Art. 45)
- Standard contractual clauses (decision 2021/914)
- Binding Corporate Rules (Art. 47)
- Codes of conduct or certifications (Art. 40 and 42)
- Strict derogations of article 49
11. Targeted certifications
The Company pursues ISO/IEC 27001 certification and ANSSI SecNumCloud compliance for sensitive deployments.
13. Periodic review
The charter undergoes annual review by Management, under the control of the DPO. Any substantial modification is communicated by appropriate means.