Web1on1 & GDPR FAQ's
- Frequently Asked Questions about Web1on1's GDPR compliance
- Is Web1on1 a data controller or a data processor?
- What data does Web1on1 process?
- What is the basis for personal data processing? Is customers consent required?
- Am I a data controller or a data processor?
- Do I need to enter into a Data Processing Agreement/Addendum?
- Do you have a GDPR compliant Data Processing Agreement for us to sign?
- How are my personal data used / processed in Web1on1? How can I execute my right to be forgotten?
- What can I do to become GDPR compliant using Web1on1’s services? How to prepare my service for GDPR?
- Where does Web1on1 store personal data? Are personal data processed outside the EU?
- Does Web1on1 share any personal data with any sub-processors (other entities)?
- How does Web1on1 choose and verify sub-processors?
- Has Web1on1 appointed a Data Protection Officer?
- What security measures does Web1on1 implement to protect the data? Are the data encrypted and if so, to what standards?
- Does Web1on1 carry out external penetration tests on the application? If so, how frequently?
- How long do you hold the personal data for?
- Does Web1on1 have an incident management process in place?
- What are your processes for identifying and remediating vulnerabilities in your application and the underlying software and infrastructure?
- What process should we follow if we suspect that a security breach has occurred?
- Have you had any information security breaches in the last 12 months?
- Who is responsible for Information Security?
- Do you have a Disaster Recovery plan? How quickly could you restore from a data backup if you suffered a major loss and what is the maximum amount of data that might be lost?
- Are we able to take a full copy of our data in a standard format (e.g. CSV)? Is it possible to export all chats and tickets using your API in a JSON format, that can be easily converted to CSV?
- Is the application a single tenant or multi-tenant? If multi-tenant, what steps have been taken to secure the data from being accessed by other tenants?
- Cookies at Web1on1
Frequently Asked Questions about Web1on1's GDPR compliance
The General Data Protection Regulation (GDPR) is the result of many years of work by the European Union to unify and strengthen data protection for all EU citizens. Taking care of your and your customers’ privacy is a priority to us.
GDPR gives consumers (us) more control over how our data is used, while to Web1on1, it will clear in which legal environment we can operate. That makes sense for both parties!
GDPR, the new regulation, came into effect on the 25th May 2018 and since then Web1on1 has fulfilled all the required regulations to become fully GDPR compliant.
Below you will find a list of frequently asked questions regarding GDPR compliance. If miss anything, please let us know by writing to firstname.lastname@example.org we will reply as soon as possible and update this document.
Is Web1on1 a data controller or a data processor?
What data does Web1on1 process?
What is the basis for personal data processing? Is customers consent required?
This is why a separate consent for your data processing by Web1on1 is not required. However, you may need to gain consent for data processing and transferring from your customers/ users/ visitors. It depends on whether you need to be a GDPR compliant or not if you collect your customers/users/visitors data, and what are your data processing basis. To help you comply with the GDPR requirements, we have created a tool (working with Web1on1 service) which helps you gain such consent. If you think you need it, please refer to point 9. If you use the service other than Web1on1 you may need to at least notify your customers about using Web1on1’s services.
Am I a data controller or a data processor?
Firstly, you need to figure out if you process or provide personal data of EU citizens. For instance, if you are an Australian company and you only process Australian citizens data, GDPR does not apply to you. However, if you process personal data of the European citizens, you need to comply with this regulation. You or your company (organization) may then act as a data controller. It happens when you are a natural or legal person, public authority, agency or other body, and you, alone or jointly with others, determine the purposes and means of the processing of personal data. You may also act as a data processor. It happens when – as a natural or legal person, public authority, agency or other bodies – you process personal data on behalf of the controller. Simply, when you do not determine the purposes of the processing but use data according to the controllers’ instructions.
Do I need to enter into a Data Processing Agreement/Addendum?
Regardless of being a data controller or a data processor, when you transfer the personal data to us (and you do so using our services) you may need to enter into DPA with us if you transfer any EU citizens personal data. You can do this in the App.
By navigating to: Settings (left menu) > Configuration > GDPR Section
Do you have a GDPR compliant Data Processing Agreement for us to sign?
Yes, we have prepared this document for our customers. You can review and sign a copy of Web1on1s Data Processing Addendum in Web1on1 under Organisation configuration > GDPR. Instructions for execution are set out in the Addendum. If you have any questions about its contents you can email: email@example.com
How are my personal data used / processed in Web1on1? How can I execute my right to be forgotten?
Web1on1 also stores the data you inserted into the service via the system (i.e. the chat history, forms content, ChatBot scenarios, files depending on the service you use as well as your customers’ personal data if supplied by you). It allows you to have constant access to the history of your conversations and other content. However, if you intend to delete any of your chat, form, chatbot scenario, article, or other content you can check the GDPR section within the App to get information on how to do it. You can also freely decide whether you want to have your data and content permanently deleted from a system.
What can I do to become GDPR compliant using Web1on1’s services? How to prepare my service for GDPR?
Web1on1 also stores/process personal data of your customers, visitors (end users of the service you use). Especially we store data provided in the pre-chat survey, chat content, your client’s email address and form content, chatbot scenarios as well as your knowledge base articles. Thus, if you collect your visitors / end-users / clients personal data and process them to us, you may need to gain their consent and/or notify them you use Web1on1’s services. You can find the instructions on how to customize your pre-chat survey (applies for Web1on1 service) to comply with this rule here. If you wish and if they meet your company’s requirements, you can use one of (or more than one) the clauses we have prepared for you. The clauses can be found here.
Where does Web1on1 store personal data? Are personal data processed outside the EU?
Web1on1 stores its customers’ data in data centers in the EU (Belgium and The Netherlands). Your data storage location depends on which service you use. When you sign up and create an account in Web1on1 your data are automatically collected and stored in our EU data center (regardless you are signing up from the EU, the US or other parts of the world). Additionally, similarly to many SaaS providers, we use a top-tier, third-party data hosting providers (Google Cloud Platform, and MongoDB) to host our online services.
Does Web1on1 share any personal data with any sub-processors (other entities)?
To make our services work properly we use other companies’ services (generally software). We do so to maintain the services, improve our tools, enable, and simplify its usage. If there is a necessity to give processors access to a part of your data, firstly, we make sure that this company will gain only necessary data (i.e. only an email address for the email service provider). Secondly, we enter into an agreement with such company to make sure they provide at least the same level of protection as we do. You can find more information about rules of sub-processing in our DPA and under the following link you can find a current list of our sub-processors.
How does Web1on1 choose and verify sub-processors?
We are committed to comply with GDPR and accordingly to transfer personal data lawfully. This is why we work only with third party service providers from Europe (EOG) or countries recognized by the European Commission as providing an adequate level of protection of personal data (mostly the United States). We have verified all the sub-processors we cooperate with currently. Besides the above ‘location requirement’ we made sure they are GDPR compliant and – if based in the US – Privacy Shield certified (or – if based in another country recognized as secured – are the subject of a similar agreement and adequate obligations due to the data protection). Also, before appointing a new sub-processor, we make sure the data will be securely and lawfully transferred. We choose providers only based in EOG and the US (or another secure country such as Canada, Switzerland, New Zealand). We verify if the provider is GDPR compliant and Privacy Shield certified. Only if we are sure your data will be transferred and stored securely we will work with the provider. If the data transfer was not secured by the mentioned measures we would apply additional measures (i.e. Standard Contractual Clauses), to transfer data in line with the GDPR.
Has Web1on1 appointed a Data Protection Officer?
What security measures does Web1on1 implement to protect the data? Are the data encrypted and if so, to what standards?
Does Web1on1 carry out external penetration tests on the application? If so, how frequently?
Web1on1 uses external auditors to verify the adequacy of its security measures, including the security of the physical data centers. This audits are performed at least annually and include penetration tests.
How long do you hold the personal data for?
Additionally we allow you to set you own data retention period in the GDPR section of the App.
Does Web1on1 have an incident management process in place?
Yes, we have it in place. In case of any management incident, we are ready to take a reaction immediately to protect your data from unjustified disclosure or any other infringement.
What are your processes for identifying and remediating vulnerabilities in your application and the underlying software and infrastructure?
a) Running an external audit, fixing all found vulnerabilities, testing the implemented fix and iterating this procedure until the issue is fixed;
b) Periodic systems scanning with tools for automatic issue recognition.
What process should we follow if we suspect that a security breach has occurred?
Contact support via firstname.lastname@example.org or chat on our websites.
Have you had any information security breaches in the last 12 months?
No, we haven’t any. You can follow the website https://status.web1on1.chat where we report about any security issues and incidents.
Who is responsible for Information Security?
Do you have a Disaster Recovery plan? How quickly could you restore from a data backup if you suffered a major loss and what is the maximum amount of data that might be lost?
We do have a DR plan, each part of the system can be restored from 24 to 48 hours (considering a complete disaster). Moreover, each instance of the whole infrastructure is multiplied, so losing a single instance will not cause service degrading. Provided time refers to a flood scale of the disaster.
Are we able to take a full copy of our data in a standard format (e.g. CSV)? Is it possible to export all chats and tickets using your API in a JSON format, that can be easily converted to CSV?
Regardless of the service you use, you can get a copy of your data through our API.
Is the application a single tenant or multi-tenant? If multi-tenant, what steps have been taken to secure the data from being accessed by other tenants?
The application is multi-tenant, data for each license is accessible only to accounts assigned to the license, so the person that wants access to a license data, needs a corresponding login and password. This is the basic logic behind the whole application infrastructure, it’s not possible to access other users’ data, as the access request without needed credentials will be considered unauthorized call and denied. Also, one set of credentials (login + password) can be used for one license only.
Cookies at Web1on1