Joisto Group and Joisto Quertum GDPR readiness and compliance statement

1. Both Joisto Group and Joisto Quertum (hereinafter “JG and JQ”) operate in an industry in which access and processing of personal data is essential to perform the defined services. JG and JQ take the appropriate processing of personal data very seriously.
2. Both companies have nominated a Data Protection Officer (DPO).
3. As a part of the Integrated Management System (IMS) a data protection related set of documentation has been developed including privacy policy, instructions and templates for records of data processing activities and assessments.
4. As a part of the risk management process, Data Protection Impact Assessments (DPIA) and Privacy Impact Assessment (PIA) for products and services were performed and documented accordingly. Due to the limited scope of personal data processing (mainly as Processors) there are no adverse threats for the privacy of persons.
5. Technical and organisational measures (TOM) were defined, implemented, and have been confirmed by ISO27001:2022 Certification for both JG and JQ.
6. Several aspects of privacy by design and privacy by default were applied in order to maintain the services we offer.
7. Training related to data protection is actively being arranged – a basic one as part of the induction process and an advanced one for employees who are involved in data processing.
8. JG and JQ have established their own Security Incident Response Team (SIRT) and Security Operation Center (SOC) for handling any security incidents, including data breaches more effectively.
9. Records of Processing Activities (ROPA) are maintained, including the processing of sub-contractors.
10. Detailed instructions regarding personal data processing are specified in Data Protection Agreements (DPA).

In the case of any data related concerns, incidents or should further information be required – please contact Miroslaw Blaszczak, our Data Protection Officer (DPO) at [email protected]