General Data Protection Regulation (GDPR) →

GDPR Compliance

CloudAMQP and GDPR

Introduction

The General Data Protection Regulation (GDPR) is an EU regulation on data security and privacy related to personal data. GDPR applies to all organizations operating within the EU as well as to non-EU organizations offering goods or services or monitoring the behavior of data subjects in the Union. The definition of personal data under GDPR is defined as any information relating to an identified or identifiable person. The purpose of GDPR is to coordinate the data protection laws across all EU member countries to strengthen the integrity of an individual’s data.

DATA CONTROLLER VS. DATA PROCESSOR

GDPR applies to both Data Controllers and Data Processors. A Data Controller is the party that determines the purpose and the manner in which personal data is processed. A Data Processor is a third-party that processes personal data on behalf of the Data Controller. This means that CloudAMQP acts as both a Data Controller and a Data Processor.

CloudAMQP is a Data Controller as we store personal data of our customers, such as email addresses, billing addresses, etc. Nevertheless, as a cloud hosting company providing a service (SaaS) and handling data, our main responsibility is as a Data Processor.

CLOUDAMQP AS A DATA CONTROLLER

CloudAMQP follows GDPR’s rules for proper storage of personal data, and we honor the rights of individuals such as the right to be informed, the right of access, the right of rectification, and the right to be forgotten. Our ambition is to constantly work with integrity, honesty, transparency, and responsibility towards our customers. We have a Privacy Policy where we state how information in our care is handled.

CLOUDAMQP AS A DATA PROCESSOR

CloudAMQP is compliant with GDPR and has executed Data Processing Agreements (DPAs) with our subprocessors (including cloud infrastructure providers) and other suppliers when applicable. We also include a DPA as an exhibit to our Terms of Service, meaning that if your business is covered by the GDPR, you’re enrolled in our DPA by default when signing up to our service. This makes it easy to continue to lawfully transfer EU personal data when using CloudAMQP. You can find our DPA here. Customers from other providers (Heroku, AWS Marketplace, Azure Marketplace, etc.) should email us to request access to our DPA.

CloudAMQP doesn’t physically host any of the servers involved in our cloud hosting service. Instead, we use data centers provided by external cloud platforms (e.g. Amazon Web Services, Azure, and Google Cloud Platform). Customers are in full control as to where their data is hosted by choosing the region for the data center.

How CloudAMQP handles your data

All data that 84codes holds about its customers is encrypted both at rest and in transit. All data that the Data Controller inserts to the service is encrypted at rest by default on 84codes’ side (at the cloud platforms that support it). Data in transit can be encrypted by the Data Controller for additional security.

Further, CloudAMQP has no knowledge of what kind of data is being handled by customers using the service. Employees of CloudAMQP do not look at customer data nor do they copy data to a server other than the one chosen. All data stored in the service is stored until the customer removes the data, either manually or by policies. Backups (where applicable) are deleted after 30 days. Therefore, CloudAMQP doesn’t (and will not) “manage” personal data. Meaning that if customers use our service for processing personal data - we will not know.