Documentation of The Processing Activity

Information about the person responsible

Responsible body (according to Art. 4 No. 7 GDPR)
icigai1 GmbH, Moritz-von-Rohr-Str. 1a , 07745Jena

Legal representative (= management)
Jan Oertel, Moritz-vor-Rohr- Strasse 1a 07745 Jena.

Data Protection Officer
Jan Oertel, Moritz-vor-Rohr- Strasse 1a 07745 Jena

Basic Information on Processing

Name of processing activities:

  1. Contractual performance 1 – Field – Licenses
  2. Payment processing

Responsible contact person (including specialist department, telephone number and email address):

  1. Jan Oertel, Moritz-vor-Rohr- Strasse 1a 07745 Jena.

Status:

Type of processing:

  • Existing customer managment

General Data Protection Requirements GDPR

Intended use

Processing activity “Existing customer management”

  • The purpose is to support and contact our customers in accordance with the contract and to fulfill our contractual services.

Lawfulness of processing, Art. 6 GDPR

Art. 6 Para. 1 lit. a, Article 7

Is there a high risk to the rights and freedoms of natural persons under Article 35?

The email address, as the only directly personal information, is only used to contact the relevant employees in our customer’s company by email. The collection of information by creating groups in Game 1 is entirely voluntary and only by players of 1. The connection to the person cannot be established by players or outsiders within the game. From today’s perspective, the risk is considered to be low.

Collection of Data

Circle of affected groups of people

Customers / Field – License holder of icigai1 GmbH

Type of data or data categories stored:

Company data and contact persons in the company

Origin of the data

Voluntary deployment in the game by a player as an employee of a corporate customer.

Recipients or categories of recipients to whom the data may be communicated

Internal recipients (within the responsible body)

  • Accounting Department
  • “Customer Support” Department

External recipients and third parties:

  • No

Standard Deadlines for Deleting Data

Storage period

  • Existing customer data: Unlimited
  • Former customer data: The data will be deleted 8 weeks after termination of the contractual relationship

Assessment of Technical Adequacy and org. Measures (TOM)

General description of the technical and organizational measures (Art. 30 Para. 1 lit. g, Art. 32 Para. 1 GDPR)

Customer data and contact person data are stored and queried in a secure system, outside of our own online offering

  • To offer a higher level of protection, as the service provider “plentymarkets GmbH” can currently offer a higher level of protection measures, which are used by us and the overall service in order to offer our customers the highest possible protection.
  • To prevent ourselves and our/future/former employees from stealing customer data from the company in printed form, on a USB stick or via a file transfer service.
    • The customer data is located in an area with no access for employees or personnel.
    • employees of icigai1 GmbH who need this data, for example to provide support or billing for our customers, may access this data

Our customer data is kept pseudonymized and encrypted in the databases

The game data is encrypted in our databases, so even people working on our databases cannot read customer data

If our databases are stolen, outsiders cannot decode the system because the data is unreadable in encrypted form.

The system with databases is subject to automated testing mechanisms that test the functionality of the security mechanisms every 1-2 minutes.

In the event of failures (hacker attacks, overload, etc.), a system alarm is triggered, which immediately informs those responsible via smartphone

In exceptional cases, the database can be immediately put into a protection mode that deactivates the accessibility of the server

Statement from The Data Protection Officer

Review by the data protection officer

Taken on September 7th, 2018

Is there a need for further action?

Not for now

Open measure

No

Date of documentation

09/05/2018

Review by management

Taken on September 7th, 2018

Date, signature

Jena, September 7th 2018, Signature Jan Oertel