Processing Operation(s)

The objective of Processing of Personal Data by data importer is the performance of the Services pursuant to the Agreement.

• Processing of Personal Data to deliver its core functionalities required: ☒ yes  ☐ no
• Optional features processing Personal Data:  ☒ yes  ☐ no
  • The optional features are deactivated by default:  ☒ yes  ☐ no ☐ n/a*
• Processing of sensitive Personal Data: ☒ yes **   ☐no ☐ n/a*
• Profiling of individuals based on personal characteristics: ☐ yes ** ☒no ☐ n/a*
• Automated decision making that produces legal or other significant impacts on individuals:  ☐ yes  ☒ no ☐ n/a*

Processing Operation(s)

The objective of Processing of Personal Data by data importer is the performance of the Services pursuant to the Agreement.

• Processing of Personal Data to deliver its core functionalities required: ☒ yes  ☐ no
• Optional features processing Personal Data:  ☒ yes  ☐ no
  • The optional features are deactivated by default:  ☒ yes  ☐ no ☐ n/a*
• Processing of sensitive Personal Data: ☒ yes **   ☐no ☐ n/a*
• Profiling of individuals based on personal characteristics: ☐ yes ** ☒no ☐ n/a*
• Automated decision making that produces legal or other significant impacts on individuals:  ☐ yes  ☒ no ☐ n/a*
• Processing through the use of an AI tool available with the Product: ☐ yes ☒ no
  • The AI feature is deactivated by default: ☐ yes ☒ no
  • The AI feature processes Personal Data: ☐ yes ☒ no
  • The AI feature processes sensitive Personal Data: ☐ yes ☒ no
  • The Customer can control what data the AI tool processes: ☐ yes ☒ no
• Automated decision-making that produces legal or other significant impacts on individuals: yes no n/a*
  * (n/a = not applicable)
  ** (optional; depends on the Customer’s Drupal application)

Details of Personal Data being processed

Privacy Enhancements

Certifications

• SSAE16/ISAE 3402: SOC 1 Type II
• SOC 2 Type II
• ISO 27001:2013
• FedRAMP

Data Subject Rights

Through the Product’s administration console and through the Customer’s own Drupal application, the Customer may manage, update, retrieve, and erase individual Personal Data.

(Personal) Data Retention CyclesThe retention of data in the Product is managed by the Customer and may be stored during the entire term of the Services. Latest 90 days after the end of the contractual term of the Services, Acquia will purge any customer data in the Services including personal data from its systems.

Sub-Processing

The specific list of sub-processors is available from: Acquia Sub-processors.

Any current Acquia customer with a data processing agreement in place with Acquia may subscribe to receive notifications of new or changed sub-processors through above website.

Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached)

Data importer has implemented and will maintain appropriate administrative, physical, and technical safeguards for the protection of the security, confidentiality and integrity of Personal Data uploaded to the Services, as described in the Acquia Security Annex (available from Acquia & GDPR Compliance) applicable to the specific Services purchased by data exporter, as updated from time to time, and made available by data importer upon request. The data exporter is wholly responsible for implementing and maintaining security and data administration within any data exporter applications, configuration settings, or log settings used by data exporter in conjunction with the Services.