Data processing agreement (dpa) — Jottacloud Business

Cited by

Facts read from this source

• DPA effective date Report an error

  “EFFECTIVE DAY 27 DECEMBER 2022”

• DPA entity Report an error

  “Name: Jotta AS (Org. nr: 992 603 615)”

• DPA audit rights Report an error

  “At the controller's request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance.”

• Subprocessor list URL Report an error

  “The processor has the controller's general authorisation for the engagement of sub-processors from an agreed list, which can be found here: https://docs.Jotta.com/en/articles/1937299-general-data-protection-regulation-gdpr-at-Jotta#sub-processors.”

• Subprocessor change notice Report an error

  “The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 30 days in advance”

• Processing duration Report an error

  “The duration of the processing lasts until the controller terminates their Jottacloud useraccount, and up to a maximum of 90 days therafter.”

• Stored in norway Report an error

  “All customer data is stored in Norway.”

• Data centers location Report an error

  “Jottacloud’s data centers are located in Norway.”

• Self owned infrastructure Report an error

  “All of Jottacloud’s services run in our own data centers. We run our own routers, load balancers and physical servers.”

• Encryption at rest Report an error

  “All data is encrypted at rest on server”

• Encryption in transit Report an error

  “All data sent to or from Jottacloud is encrypted in transit using AES256 bit encryption or by industry best practices as supported clientside”

• Ssl labs rating Report an error

  “Jottacloud’s API and application endpoints are TLS/SSL only and score an "A+" rating on SSL Labs' tests.”

• Https only Report an error

  “Jottacloud is served 100% over https.”

• Two factor authentication Report an error

  “Jottacloud has two-factor authentication (2FA) and strong password policies to ensure access to cloud services are protected.”

• Audit logs Report an error

  “On an application level, Jottacloud produce audit logs for all activity”

• Permission controls Report an error

  “Jottacloud enables permission levels to be set for any employees with access to Jottacloud admin tools.”

• GDPR compliance Report an error

  “Jottacloud complies with European and Norwegian privacy laws and GDPR.”

• Stripe payments Report an error

  “Jottacloud is not subject to PCI obligations. All payment instrument processing is outsourced to Stripe.”

• Microsoft office Report an error

  “Provision of editing services delivered by Microsoft Office Online services related to Jottacloud’s storage services as determined by the Controller when and if setting up the optional editing services provided.”

• No individual datastores Report an error

  “Jottacloud does not have individual datastore for each customer. However strict privacy controls exist in our application code to ensure data privacy and prevent one customer from accessing another customers data.”

• Data breach notification Report an error

  “In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach.”

• Scc annex Report an error

  “Pursuant to the COMMISSION IMPLEMENTING DECISION (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679”

• Personal data categories Report an error

  “Name Email Address Telephone number (optional) Personal data included in stored files”

• Address Report an error

  “Address: Øvre Slottsgate 5, 0157 Oslo, Norway”

• Group entity Report an error

  “Jotta Group AS Øvre Slottsgate 5 0157 Oslo, Norway Org. nr. 992 603 615”

Scores citing this record

• The Agency Producer European sovereignty
• The Architecture Practice Partner European sovereignty
• The Data Protection Officer European sovereignty
• The IT Lead European sovereignty
• The Skeptic Administration, audit & governance
• The Skeptic European sovereignty
• The Tax Adviser European sovereignty