6 new Data Protection Principles have been introduced:

1. Lawfulness, fairness and transparency
2. Purpose limitations
3. Data minimisation
4. Accuracy
5. Storage limitations
6. Integrity and confidentiality

Opentracker has raised awareness and made sure that key decision makers are aware that the law is changing and identified areas that could cause compliance problems under the GDPR. COMPLETED

Opentracker employees who handle personal data of other employees or customers have received training in order to ensure that they handle changes in accordance with GDPR. Opentracker keeps a record of training and provides update and refresher training on an annual basis. COMPLETED

Through this, Opentracker defined new Policies and Procedures, the most common are:

1. Generic Policy Framework
2. Data Management Policy
3. General Data Protection Policy
4. Data Classification Procedure
5. Staff Data Protection Training Policy
6. Data Access Request Procedure
7. Personal Data Breach Escalation Policy
8. Emergency Management Plan

COMPLETED

Lawfulness of processing: conditions that must be satisfied for the processing of personal data to be lawful.

1. Consent from individual
2. Contract with individual
3. Compliance with a legal obligation
4. ital interests
5. Public task
6. Legitimate interest

Opentracker has:

1. An audit of the use of personal data to assess what lawful processing ground(s) it currently relies on and whether they remain valid under the GDPR
2. Trained staff so that they are aware of legal processing grounds.

COMPLETED

New legislation around the consent of the individual for the organization to hold his/her personal data. Several aspects need to be addressed:

1. Unbundled
2. Actie opt-in
3. Granular
4. Named
5. Easy to withdraw
6. Documented
7. No imbalance in the relationship

Our main plan has been to review methods for seeking, obtaining and recording consent to ensure compliance.

Opentracker will implement explicit and affirmative consent through check boxes and clear Privacy policies. Opentracker works together with lawyers to craft policies and terms based on your needs and data processing.

In addition, Opentracker will track all the actions that users take, from the signup to account deletion, and ensure that each step complies with new laws of consent.

Finally, Opentracker has these questions to answer when the new consent is applied:

1. 1. Was the consent freely given?

Is the consent presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language?

1. Can Opentracker demonstrate that the data subject gave their consent?
2. Does the data subject have the ability to withdraw their consent?

COMPLETED

Opentracker does not keep such data. Data that people enter into Opentracker app cannot later be used to discriminate against them due to their identity, expression or behavior, thereby restricting the enjoyment of their rights.

In the future, in case it is needed, Opentracker will only keep special category data for as long as it needs it, once it is no longer needed will securely remove it from its systems in an auditable way. COMPLETED

Expanded individual’s’ Rights:

1. access their information;
2. have inaccuracies corrected;
3. have information erased;
4. prevent direct marketing;
5. prevent automated decision making and profiling;
6. data portability.

Opentracker will enable employees and customers to request their personal data processed by Opentracker. COMPLETED

Trained personnel will respond to requests within the 1 month timeframe. COMPLETED

Several guidelines will be applied during the software development circle:

1. Training ( developers will be trained on Privacy and Security aspects)
2. Design (all data oriented and process oriented design requirements will be driven by GDPR)
3. Coding ( developers will use approved tools and frameworks, disable unsafe functions and modules, and regularly carry out static code analysis and code review)
4. Testing (test whether data protection and security requirements are implemented properly will be conducted)
5. Before every release, an Incident Response Plan will be established, and a full security review of the software will be carried out. Release will then be approved and all relevant data from the entire development process will be archived.
6. Maintenance (Opentracker should be prepared to respond to incidents, personal data breaches, faults and attacks, and be capable of issuing updates, guidelines, and information to users and those affected by the software)

COMPLETED

Privacy Impact Assessment (PIA): If you are using “new technologies” which process personal data which is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall carry out an assessment of the protection of personal data.

Prior Consultation: Data controllers should consult the supervisory authority eery time a PIA identifies an inherently high risk processing activity.

Opentracker will find the appropriate Codes of Conducts and Certifications and comply with them. The most “popular” are:

1. ISO 27001 (Information Security Management)
2. ISO 27017 (Cloud Security)
3. ISO 27018 (Cloud Privacy )
4. SSAE16 / ISAE 3402 (SOC 2/3)
5. PCI-DSS
6. ISO 9001 (Quality Management)
7. https://cispe.cloud/code-of-conduct/

COMPLETED