Trust Center — Data Privacy

Data Privacy Compliance in IBS SaaS

This page outlines the approach to ensuring Data Privacy compliance of IBS SaaS services.

In this section, ‘Customer’ refers to the organization that has subscribed to IBS SaaS services. Please refer to Official Journal of the European Union for definitions of roles and expectations of GDPR.

Roles

Customer will be the Data Controller, and IBS will be the Data Processor.

Responsibilities to Address Rights of Data Subjects

Consent – Customer shall capture and maintain consent from Data Subjects. It will be assumed that Customer has obtained consent from Data Subjects for all personal data transferred to IBS for processing, including past data already shared with IBS.
Rectification – Customer shall rectify inaccurate/incomplete personal data. For those SaaS services where a user profile is also provided, Customer shall rectify the profile using ‘update’ functionality of the SaaS service.
Erasure – Personal data which are processed in business transactions, such as PNR, will be retained till the completion of retention period agreed with Customer. IBS shall be ready with technical measure to delete personal data and provide a certificate of deletion to the Customer upon request.
Restrict Processing – Customer shall validate requests from Data Subjects to stop processing his/her personal data. If IBS receives any request directly from Data Subject, it will be forwarded to Customer for validation and required action.
Data Portability – Not applicable for current SaaS
Access – Customer shall authenticate Data Subjects who request access to personal data. On authentication of the Data Subject, IBS will provide information on personal data held in its systems and the location.

Approach to manage privacy

1) Inventory of Personal Data

Customer and IBS shall agree on an inventory of personal data that will be transferred to IBS for processing. This inventory shall indicate:

Description of data element
Classification - whether the personal data is sensitive
Purpose for processing
Duration of processing

2) Transfer of Personal Data outside of country

Customer and IBS shall agree on hosting locations for primary and DR sites, location from where the environment will be accessed for providing support and use of any sub-processors and their respective locations.

3) Handling data in Production/DR site

Personal data shall be stored encrypted in production/DR environment. Personal data that is classified as ‘sensitive’ will be stored in a form that will be agreed with the Customer.

4) Transfer of data to Staging/Training environments

All personal data shall be suitably masked before being transferred to non-production environments. Specific details of the data transfer are agreed between Customer and IBS using the Standard Contracting Clauses (SCC).

5) Access by Support Personnel

Access to personal data in production environment shall be limited to named employees of IBS or its sub-processors who will be responsible for maintenance of the production environment.

6) Training on Data Privacy

All employees of IBS who process personal data shall be provided with adequate awareness trainings on their obligations related to Data Privacy.

7) Data Protection Office

IBS has put in place a Data Protection Office that will be responsible for managing the DP Compliance. Contact details shall be published on the corporate website and provided in agreements.

8) Compliance