May 2018

1. Data security.

Wherewolf leverages hardware and software infrastructure within the Amazon Web Services (AWS) cloud and as such benefit from their rigorous adherence to the provisions of the GDPR. This infrastructure is used for all application servers, transactional data and backup. Wherewolf does not operate any on site, self administered hardware.

Amazon ensures suitable establishment and configuration of the infrastructure that runs all of the services offered in the AWS cloud. This infrastructure is comprised of the hardware, software, networking, and facilities that run AWS services, and utilised by Wherewolf.

Wherewolf builds on top of this foundation, configuring the server and database systems in use to serve the Arrival Application and Dashboard services following up to date best practice. Wherewolf operates an aggressive policy of security patch installment and system configuration in terms of known security risks.

The physical storage location of the data collected on the Wherewolf platform is the AWS Europe – Frankfurt Datacenter. The AWS infrastructure puts strong safeguards in place to help protect customer privacy and all AWS data centers are highly secure.

Wherewolf’s guest record database is fully encrypted through the excellent services offered by AWS to ensure data privacy even in the unlikely event of a data breach. This encryption is compliant with best practice using the Advanced Encryption Standard (AES) and a 256 bit key length.

All guest data is automatically backed up and stored in a physically separate data centre within the Europe Region ensuring that we are able to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.

AWS as a service provider have been audited and certified for GDPR compliance, and have demonstrated an ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.

As a Processor, Wherewolf ensures that data access is restricted within Wherewolf to authorised staff only, and any access activity monitored and recorded on an individual basis ensuring complete transparency. This is achieved through the granular access controls offered by AWS where each staff member maintains their own set of credentials.

Each staff member with access to the personal data stored on the database may only undertake processing activity on the data with review and approval of the Chief Technical Officer (also Wherewolf’s Data Protection Officer (DPO)).

Finally, when Clients as Data Controllers access guest data collected in the course of their business activity via the Wherewolf Dashboard, this is transferred in an encrypted form using Transport Layer Security (more commonly known as the HTTPS protocol).

It is important to note that it is the Client’s responsibility to maintain security of access credentials associated with the Arrival Application and Dashboard. These services can provide access to all guest data stored for the business depending on the level of access afforded each user login.

2. Monitoring and Reporting

Wherewolf monitors all requests made to its application servers in real time, and logs each request. As such, the access and subsequent data movement or change for each server request is able to be audited with a high degree of accuracy.

In the event that an unauthorised access is made that exposes guest data, Wherewolf will notify all affected parties with in 72 hours of the breach detection. This notification will include the scope of the breach, and the status of all services.

3. Individuals right of access and removal.

In the event that any Wherewolf Client has a guest who requests either access or deletion of their data under this legislation, this can be simply achieved in the following way:

1. Provide details that will enable identification of the guest:
   1. We will need the guest record identity field that can be obtained from the guest record on the Dashboard (utilise the search function to find the guest by name and find the contents of the ID field)
   2. Full name
   3. DOB if present
   4. Email address
   5. The latest date that they checked in (Last Visit field)
2. We will permanently remove their data from our servers and send confirming details, or retrieve all data stored relating to the individual and transfer it to the Client as the Data Controller.

4. Controller Responsibilities.

Consent to gather and store personal data.

The way that that consent to gather and store data is achieved is largely up to each individual Client, and will vary depending on the nature of information being gathered. In general terms, the Client as the Data Controller, must advise Wherewolf clearly how they want this achieved within the constraints of the platform.

Our recommendation is to add explicit terms and conditions that address the requirements of the GDPR, that are acknowledged by each guest.

It may be necessary to add a separate terms page to your app that addresses this alone to avoid any issues of ambiguity.
It is possible to conditionally show these terms only to guests who identify that they are from Europe (provided that the guests home country is an input in the application).

Marketing communication.

Where Clients seek to leverage an integration with MailChimp for the purposes of email marketing campaigns, we have the ability to control the addition of guest records based on guest consent.

To do this we add a separate question to the Arrival Application seeking approval for follow-up communications. Only those guests who answer in the affirmative will have their data automatically sent to any integrated MailChimp account.