Data Processing Agreements
Recently, we have updated all our agreements, terms and privacy policy to reflect the GDPR requirements. We have made these updated agreements and information available to our partners, and customers for their compliance assessment and GDPR readiness when using our Cloud Services.
Processing based on Instructions
Any data that a customer and its users put into our systems will only be processed in accordance with the customer’s instructions, as described in our current as well as our GDPR-updated data processing agreements and Service Specifications.
Personnel Confidentiality Commitments
Our employees are required to sign a confidentiality agreement and have completed multiple mandatory confidentiality briefings of data protection for our customers. The briefing specifically addresses responsibilities and expected behaviour with respect to the protection of all personal information.
Most of the time, CumulusPro manages the majority of data processing activities required to provide the Cloud BPM Platform services. When required, we do engage third-party vendors in supporting our Cloud Services. Each vendor goes through a rigorous selection process to ensure it has the required technical capabilities to deliver the appropriate level of security and privacy.
CumulusPro may engage third party sub-processors to assist us in relation to the Cloud Services. Our third-party sub-processors provide technologies and services in the area of data entry and validation, automated document classification, automated data extraction, Optical Character Recognition (OCR), facial recognition, API connectivity, and communication platform services.
With effect from 25th May 2018, GDPR regulates that the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
CumulusPro is committed to a robust implementation of Information Security Management in the delivery of our Cloud Services. Management, employees and contractors of CumulusPro are committed to apply the appropriate confidentiality, integrity and availability of data when delivering CumulusPro Services to the Customers.
From software design, development to delivery, CumulusPro Services security policies are aligned with the ISO/IEC-27001-ISMS scope and Information security policy of ISO/IEC-27001 Standard for Security Policy. Visit ISO/IEC 27001 Information security for more information on ISMS.
User creation procedure
User account creation follows a strict procedure where a system administrator creates new user accounts with the users’ email address from the CumulusPro cloud Admin Panel. Upon the email validation, and clear consent given by the new user would this user account be activated. In the meantime, user access rights and roles are assigned by the system administrator.
User passwords are NOT provided by the system administrator. Upon receiving an email invite that contains a URL link to a set password page would the users create their own passwords. This is to ensure that registered email addresses are verified, and passwords are only known to the users and clear consent is given. For added security, the user may be requested to register for a 2FA authentication with Google authenticator app.
As a rule of thumb, CumulusPro employees do not have access to customers business data. Personnel with DevOps roles only have access to the hosted servers and Application Services to manage the running of the services, administration of the operating environment, modification of user accounts and business processes. Through the implemented MS Azure Application Level encryption, all images and data stored in Azure BLOB storage are encrypted. Therefore even if DevOps are logged in, customer business content is only managed through the application security framework, which means they need to be granted privilege and access rights to the content.
Service logging and monitoring rights
There are a few levels of monitoring and logging for CumulusPro Services.
| DevOps |
CumulusPro Application services and MS Azure Services that are responsible to deliver CumulusPro Services customers are closely monitored by CumulusPro DevOps 24x7. In the event of services that has gone offline, the service will automatically trigger a notification to CumulusPro Devops by email and/or SMS. |
| Process Monitoring |
Only available to process owners or user accounts with sufficient rights. Process Monitor allows the identification and resolution of process bottlenecks by the managing of tasks in active processes. |
| User Activities |
All user activities are logged in active customer workflow processes, only users granted with access rights can view these detailed logs for each transaction. Logged information reviews process activities like field modifications, date time stamp of an action, user response to a decision and so on. |
At any time CumulusPro or our sub-processors are in possession or processing your personal data, we recognise your rights as a data subject in the following requests:
| Right of access |
Your right to request for the details of personal information that we have of you. |
| Right of rectification |
Your right to amend data that is inaccurate or incomplete. |
| Right to be forgotten |
Your right to request that your data are removed from our records in accordance to Article 17 GDPR. |
| Right to restriction of processing |
Your right to restrict the processing if applicable Article 18 GDPR. |
| Right of portability |
Your right to have the data we hold about you transferred to another organisation. (Article 20 GDPR) |
| Right to object |
Your right to object to certain types of processing such as direct marketing. (Article 21 GDPR) |
| Right to object to automated processing, including profiling |
Your right not to be subject to the legal effects of automated processing or profiling. (Article 22 GDPR) |
To protect your personal data, CumulusPro will only accept the following forms of identifications when you request for information: a copy of your driving licence, passport, birth certificate and a utility bill not older than three months. Minimally, we will require one piece of photographic ID listed above and a supporting document. If you cannot be positively identified from your submitted identification proof, we will seek further information before we can proceed with your request.
Request can be made via gdpr@cumuluspro or leave us a message here.
The GDPR provides for several mechanisms to facilitate transfers of personal data outside of the EU. These mechanisms are aimed at confirming an adequate level of protection or ensuring the implementation of appropriate safeguards when personal data is transferred to a third country. Except for the sole purpose of transferring data to our sub-processors, your data does not leave our Azure data centres in their entire lifespan till the end of the retention period when they are automatically purged.
