Sembi Affiliates Data Processing Terms

(for the Customer-Facing DPA)

Details of Processing of Ranorex DesignWise

1. Address: –

   4001 W Parmer Ln Suite #125 Austin, Tx 78727

2. Type of Services provided by Ranorex DesignWise involving the Processing of Customer Personal Data –
   1. Ranorex DesignWise provides the best-in-class test case design software that allows for customized use cases and applications. Ranorex DesignWise thoughtfully suggests and builds different combinations of testing conditions that allow customers to identify inefficiencies, mitigate risk, and determine the optimal testing mix for their business needs. The platform uses applied statistics-based optimization methods to deliver measurable results to users. Ranorex DesignWise integrates and transitions effortlessly into a broad range of test automation tools in various environments.
3. Data Protection Officer (DPO) Details: –

   VeraSafe, LLC

   [email protected]

   100 M Street S.E., Suite 600, Washington, D.C . 20003 USA

4. EU Data Protection Representative: –

   VeraSafe Ireland Ltd.

   Unit 3D North Point House North Point Business Park New Mallow Road, Cork T23AT2P Ireland

   Contact form: https://verasafe.com/public-resources/contact-data-protection-representative

5. UK Data Protection Representative: –

   VeraSafe United Kingdom Ltd.

   37 Albert Embankment London SE1 7TL United Kingdom

   Contact form: https://verasafe.com/public-resources/contact-data-protection-representative

6. Subject matter and duration: –

   The subject matter and duration of the Processing of Customer Personal Data are set forth in the Main Agreement and all amendments, exhibits, schedules, task orders, addenda, SOWs, purchase orders and other documents associated therewith and incorporated therein.

7. Nature and Purpose of Processing: –

   The nature and purpose of the Processing of Customer Personal Data are set forth in the Main Agreement and all amendments, exhibits, schedules, task orders, addenda, SOWs, purchase orders and other documents associated therewith and incorporated therein.

8. Further Processing: –

   No further Processing of Customer Personal Data beyond the Processing necessary for the provision of the Services is allowed.

9. Categories of Data Subjects: –

   Data subjects may include Customer’s representatives, such as employees, contractors, collaborators, partners. Data subject may also include individuals attempting to communicate or transfer Customer Personal Data to users of the Services.

10. Categories of Customer Personal Data: –

    The Categories of Customer Personal Data that Customer authorizes and requests that Ranorex DesignWise Processes include but are not limited to: Personal contact information such as full name, company, email address, and IP addresses.

11. Special Categories of Customer Personal Data to be Processed (if applicable) and the applied restrictions to the Processing of these Special Categories of Customer Personal Data: –

    n/a

12. Categories of third-party recipients to whom the Customer Personal Data may be disclosed or shared by Sembi: –

    Subprocessors; and other Sembi Affiliates, if applicable.

13. Frequency of the Transfer of Customer Personal Data: –

    The frequency of the transfer of Customer Personal Data is determined by the Customer. Customer Personal Data is transferred each time that the Customer instructs Ranorex DesignWise to Process Customer Personal Data.

14. Maximum data retention periods, if applicable: –

    The retention period of the Customer Personal Data is generally determined by the Customer and is subject to the term of the DPA and the Main Agreement, respectively, in the context of the contractual relationship between Ranorex DesignWise and the Customer.

15. The basic Processing activities to which Customer Personal Data will be subject include, without limitation: –

    Collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction for the purpose of providing the Services to Customer in accordance with the terms of the Main Agreement.

16. The following is deemed an instruction by the Customer to Ranorex DesignWise to Process Customer Personal Data: –
    1. Processing in accordance with the Main Agreement.
    2. Processing initiated by Data Subjects in their use of the Services.
    3. Processing to comply with other reasonable documented instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Main Agreement.
17. List of Ranorex DesignWise’s Subcontractors available at https://www.ideracorp.com/Legal/Ranorex/Subprocessors
18. Description of technical and organizational security measures implemented by the Ranorex DesignWise: –
    1. Measures of pseudonymization and encryption of Customer Personal Data:
       1. Encryption of the transferred Customer Personal Data in transit using the Transport Layer Security (TLS) protocol version 1.2 or higher with a minimum of 128-bit encryption;
    2. Measures for ensuring ongoing confidentiality, integrity, availability and resilience of Processing systems and services:
       1. Restriction of logical access to IT systems that Process transferred Customer Personal Data to those officially authorized persons with an identified need for such access;
       2. Active monitoring and logging of network and database activity for potential security events, including intrusion;
       3. Regular scanning and monitoring of any unauthorized software applications and IT systems for vulnerabilities of Ranorex DesignWise;
       4. Firewall protection of external points of connectivity in Data Importer’s network architecture; and
       5. Expedited patching of known exploitable vulnerabilities in the software applications and IT systems used by Ranorex DesignWise.
    3. Measures for ensuring the ability to restore the availability and access to Customer Personal Data in a timely manner in the event of a physical or technical incident:
       1. Services are hosted on Amazon Web Services to ensure high availability and scalability;
       2. Monitoring checks are made in order to detect performance and availability issues; and
       3. Full database backups are made every eight hours and there is documentation to restore systems
       4. Database snapshots occur every minute
    4. Processes for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the Processing
       1. Compliance program to track security controls;
       2. Vulnerabilities are being addressed as they are being discovered.
    5. Measures for user identification and authorization:
       1. The Applications are using one way encrypted salted hash password authentication; and
       2. Access controls are guaranteed by Atlassian permissions and custom application permissions when authenticating via OAuth
    6. Measures for the protection of data during transmission:
       1. Connections from public networks to Ranorex DesignWise services are encrypted using TLS 1.2 with a minimum 128-bit encryption.
    7. Measures for the protection of data during storage:
       1. Data is stored using a leading service that ensures high performance, scalability, availability and security by default; and
       2. Access is role based and reviewed regularly.
    8. Measures for ensuring physical security of locations at which Customer Personal Data are processed:
       1. Restriction of physical to IT systems that Process transferred Customer Personal Data to those officially authorized persons with an identified need for such access; and
       2. Physical security is part of the service provided by Amazon Web Services and DigitalOcean.
    9. Measures for ensuring events logging:
       1. Active monitoring and logging of network and database activity for potential security events, including intrusion.
    10. Measures for ensuring system configuration, including default configuration:
        1. Applications are using standard configurations and they are scanned against best practices and vulnerabilities.
    11. Measures for internal IT and IT security governance and management:
        1. Users are created with only required permissions and access roles;
        2. Permissions are reviewed and removed regularly; and
        3. Users are required to use MFA and secure services.
    12. Measures for ensuring data minimization:
        1. Data minimization is guaranteed during the design and implementation processes.
    13. Measures for ensuring data quality:
        1. Customer is responsible for data quality and accuracy since the data is provided by the Customer; and
        2. Form validations are made to validate some fields.
    14. Measures for ensuring limited data retention:
        1. Each authorized access is unique and traceable.
        2. Authorized access is reviewed quarterly.
    15. Measures for ensuring accountability:
        1. Documentation about how personal data is processed.
    16. Measures for allowing data portability and ensuring erasure:
        1. Customer data is stored on AWS.
        2. Customers have the option to export their data.
        3. Customers can delete their data.
    17. Other:
        1. Internal policies establishing that
           1. Where Ranorex DesignWise is prohibited by law from notifying Data Exporter of an order from a public authority for transferred Customer Personal Data, Ranorex DesignWise shall take into account the laws of other jurisdictions and use best efforts to request that any confidentiality requirements be waived to enable it to notify the competent Supervisory Authorities;
           2. Ranorex DesignWise must require an official, signed document issued pursuant to the applicable laws of the requesting third party before it will consider a request for access to transferred Customer Personal Data;
           3. Ranorex DesignWise shall scrutinize every request for legal validity and, as part of that procedure, will reject any request Data Importer considers to be invalid; and
           4. If Ranorex DesignWise is legally required to comply with an order, it will respond as narrowly as possible to the specific request.