附件 II​​ 

技术和组织措施​​ 

G-P has been certified and attested to confirm compliance with SOC 2 and ISO 27001 standards, by independent auditors. Such certifications demonstrate our commitment to securing Customer Data. G-P’s security program is designed to:​​ 

Protect the confidentiality, integrity, and availability of Customer Data in G-P’s possession or to which G-P has access;​​ 

防止客户数据的保密性、完整性和可用性受到任何预期的威胁或危害；​​ 

防止未经授权或非法访问、使用、披露、更改或销毁客户数据；​​ 

防止客户数据意外丢失、损毁或损坏；以及​​ 

按照G-P可能受监管的任何法规规定，保护信息安全。​​ 

以下描述了G-P为确保客户数据处理安全而采取的功能、流程、控制措施、系统、程序和措施：​​ 

1) TECHNICAL MEASURES TO ENSURE DATA PRIVACY AND PROTECTION​​ 

Privacy by Design and Default:​​ 

G-P takes the requirements of Article 25 GDPR into account in the conception and development phase of product development. Processes and functionalities are set up in such a way that the data protection principles such as legality, transparency, purpose limitation, data minimization, etc. as well as the security of processing are considered at an early stage.​​ 

b) Encryption of Personal Data:​​ 

Ensuring that personal data are only stored in the system in a way that does not allow third parties to identify the data subject.​​ 

Database and storage encryption:​​ 

On all databases used by G-P an encryption "at rest" according to the state of the art is used so that the data from the database can only be read after proper authentication on the respective database system.​​ 

Encryption of mobile data media:​​ 

The use of mobile data carriers for storing customer data is not permitted.​​ 

Encryption of data carriers on laptops:​​ 

Appropriate state-of-the-art hard disk encryption is installed on all employees' laptops.​​ 

Encrypted exchange of information and files:​​ 

In principle, the exchange of information and files is directly encrypted via a special application. If personal data or confidential information must be transferred to servers which cannot be sent via TLS-encrypted HTTPS uploads, these will be transferred using Secure File Transfer Protocol (SFTP), encrypted envelope service or another encrypted mechanism according to the state of the Art.​​ 

E-Mail Encryption:​​ 

In principle, all e-mails sent by employees of G-P are encrypted with TLS. Exceptions may be if the receiving mail server does not support TLS. The Customer shall ensure that the corresponding mail servers used within the scope of the order support TLS encryption​​ 

c) Admission Control​​ 

Admission controls are intended and put in place in order to prevent the use and processing of data which is protected by data protection laws by unauthorized persons.​​ 

Use of authentication methods​​ 

Access to personal data is always via encrypted protocols: SSH, SSL/ TLS, HTTPS or comparable protocols. Authentication procedure for IT system: Multifactor authentication log-in to IT system.​​ 

Automatic blocking in case of inactivity​​ 

Laptops used by G-P employees locked with password or PIN protection when not in use by the user. In addition, an automatic screen lock with password protection is set up after 15 minutes of inactivity.​​ 

Use of anti-virus software​​ 

Laptops used by G-P employees are equipped with state-of-the-art anti-virus software that is kept up to date on all operational or business IT systems. As a matter of principle, no computers may be operated without resident virus protection unless other equivalent state-of-the-art security measures have been taken or there is no risk. Default security settings must not be deactivated or circumvented.​​ 

"Clean Desk Policy"​​ 

Employees of G-P are instructed not print out or locally store personal data of data subjects, not to leave work materials in a location where they may be viewed by third parties, and to store all work materials properly. Documents which G-P is required by law to hold in hard copy are stored in locked cabinets.​​ 

d) Access Controls Within the Platform​​ 

Access controls ensure that persons authorized to use a processing system have access only to the personal data covered by their access authorization.​​ 

角色和授权​​ 

Roles and Authorization Platform – Customer Access Customer users can view and edit customer account information.​​ 

Roles and Authorization Platform – Professional Access Professional users can view and edit their own professional information.​​ 

Professionals can also gain Customer access role upon requirement + approval​​ 

Roles and Authorization Platform – Internal Access​​ 

Internal access users have varied roles. They have varied access to create, view, edit, and approve the following:​​ 

客户信息​​ 

账单信息​​ 

合作伙伴信息​​ 

专业人事档案信息​​ 

通常只有经过培训的客户支持和产品开发领域的员工才能访问管理系统。​​ 

e) Firewall as a Service​​ 

G-P uses use an external firewall as a service that allows it to grant or block access to websites to make sure systems can’t access malicious content and to restrict access to inappropriate content.​​ 

f) Record of Log-In to the Platform​​ 

G-P maintains a record of all login activity.​​ 

g) Separability​​ 

Ensuring that personal data collected for different purposes can be processed separately and are separated from other data and systems in such a way that unplanned use of these data for other purposes is excluded.​​ 

Separation of development, test and operating environments​​ 

Data from the operating environment may only be transferred to test or development environments if it has been made completely anonymous before transfer. The transfer of the anonymized data must be encrypted or via a trustworthy network.​​ 

Software to be transferred to the operating environment must first be tested in an identical test environment ("staging"). Programs for error analysis or the creation/compilation of software may only be used in the operating environment if this cannot be avoided. This is especially the case if error situations depend on data that would be falsified due to the requirements for anonymization when transferring to test environments.​​ 

Separation in networks​​ 

G-P separates its networks according to tasks. The following networks are used permanently: operating environment ("Production"), test environment ("Staging", “Sandbox”), development environment (“Dev”) office IT staff. In addition to these networks, further separate networks are created as required, e.g., for restore tests and penetration tests. Depending on the technical possibilities, the networks are separated either physically or by means of virtual networks.​​ 

h) Availability control​​ 

G-P takes the following steps to ensure that personal data is protected against accidental destruction or loss.​​ 

Data protection procedures/ backups​​ 

To ensure adequate availability G-P implements daily snapshots of its database with replication to a different region. Measures are also taken to ensure employees with job-based need to review data are granted access only to replica datasets.​​ 

生产数据和备份服务器基础设施的地理冗余性​​ 

IT incident management ("Incident Response Management")​​ 

There is a concept and documented procedures for handling incidents and safety- relevant events. This includes the planning and preparation of the response to incidents, procedures for monitoring, detecting and analyzing security- relevant events and the definition of corresponding responsibilities and reporting channels in the event of a violation of the protection of personal data within the framework of the legal requirements.​​ 

2) ORGANIZATIONAL MEASURES TO ENSURE DATA PRIVACY AND PROTECTION​​ 

G-P已采取以下组织措施，以确保本组织以符合数据隐私和保护要求的方式运作。​​ 

a) Organizational Instructions​​ 

G-P has developed and is developing a data governance program including policies, procedures, and guidelines for employees to follow. Documentation includes how to identify and manage data privacy issues, best practices for ensuring privacy compliance, and policies for addressing privacy incidents.​​ 

b) Commitment to confidentiality and data protection​​ 

G-P has developed and is developing a data governance program including policies, procedures, and guidelines for employees to follow. All employees and contractors are bound in writing to confidentiality and data protection as well as other relevant laws. All employees receive privacy & security training. Internal audits on data protection and information security are conducted regularly. Audits are carried out on the basis of common test criteria/schemes. The employees and contractors of G-P are instructed to process personal data for lawful reasons only, pursuant to applicable contracts with the customer and professional, with due consideration to any express consent given or withheld by the data subject, and in keeping with any lawful duty of the organization.​​ 

c) Data protection training​​ 

All employees receive privacy & security training which remains available for review at any time in G-P training platform.​​ 

d) Physical Access Controls​​ 

G-P has the following physical controls in place to deny unauthorized persons access to IT systems equipment used for processing.​​ 

Electronic door protection​​ 

The entrance doors to the premises of G-P offices are always locked and electronically secured. The doors are opened via a personal electronic transponder.​​ 

Controlled distribution of keys​​ 

A central, documented allocation of keys to the employees of G-P takes place. These electronic transponders/keys could be deactivated centrally by each office manager or the People Resources department.​​ 

Supervision and accompaniment of external persons​​ 

External service providers and other third parties may only be granted access to the premises via prior authorization or when accompanied by an employee of G-P. G-P applies its written Visitor’s Policy when visitors are invited to the premises.​​ 

Securing of premises with increased need for protection​​ 

Premises or cabinets with increased protection requirements, such as legal offices and certain Operations locations, are equipped with locking cabinets and drawers. Cabinets and drawers where legal documents, contracts, and confidential documentation are held are to be locked at all times except when they are in use.​​ 

Closed doors and windows​​ 

Employees are organizationally instructed to keep windows and doors closed or locked outside office hours.​​ 

e) Recoverability​​ 

G-P ensures that systems in use can be restored in the event of physical or technical failure.​​ 

Regular tests of the data recovery ("Restore-Tests")​​ 

Regular full restore tests are carried out to ensure recoverability in the event of an emergency/disaster.​​ 

Emergency plan ("Disaster Recovery Concept")​​ 

There is a concept for the treatment of emergencies/disasters and a corresponding emergency plan. G-P ensures the recovery of all systems on the basis of the data backups / backups, usually within 48 hours.​​ 

Review and evaluation measures​​ 

Presentation of the procedures for regular review, assessment and evaluation of the effectiveness of the technical and organizational measures.​​ 

f) Privacy Team​​ 

The organization has a Global Data Privacy Office tasked with planning, implementing, evaluating and adapt measures in the field of data protection.​​ 

g) Risk Management​​ 

There is a process for analyzing, evaluating, and allocating risks and for deriving measures on the basis of these risks.​​ 

3) INDEPENDENT REVIEW OF INFORMATION SECURITY​​ 

Performance of audits​​ 

Internal audits on data protection and information security are conducted regularly. Audits are carried out on the basis of common test criteria/schemes.​​ 

b) Review of compliance with security policies and standards​​ 

Compliance with the applicable security guidelines, standards and other security requirements for the processing of personal data is checked regularly. Where possible, these checks are carried out on a random and unexpected basis.​​ 

c) Verification of compliance with technical specifications​​ 

Regular automated and manual vulnerability scans are performed by the IT department or other qualified personnel to verify the security of the applications and infrastructure, as well as the regular development of the product. Detailed penetration tests are carried out by an external service provider to specifically examine the applications and infrastructure for vulnerabilities.​​ 

d) Processing on instruction​​ 

The employees of G-P are instructed to process personal data for lawful reasons only, pursuant to applicable contracts with the customer and professional, with due consideration to any express consent given or withheld by the data subject, and in keeping with any lawful duty of the organization.​​ 

e) Careful supplier selection​​ 

G-P adheres to its Supplier Prequalification Process when selecting vendors and suppliers who may encounter protected data. This process includes feedback from the Finance and Legal/Privacy Departments and incorporates risk assessment, security prequalification and documentation certification steps. Suppliers who will process protected data will be required to demonstrate their adherence to applicable data privacy laws, including Article 28 GDPR for covered data​​