Privacy policy — Penneo

Cited by

Facts read from this source

• Entity Report an error

  “At Penneo A/S (hereinafter “Penneo”, “we”, “us”, or “our”)”

• Address Report an error

  “PENNEO A/S - Gærtorvet 1-5, DK-1799 København V - CVR: 35633766”

• No sale Report an error

  “Penneo does not sell, trade, or otherwise attempt to monetise personal data that is processed through any of the processes mentioned in this privacy policy.”

• Job applicant recipient Report an error

  “Recipient: Personio – hosting in the EU.”

• Job application retention Report an error

  “Penneo will automatically delete job applications after 6 months unless the job applicant revokes consent earlier.”

• Newsletter recipient Report an error

  “Recipient: Salesforce with data being hosted in the EU.”

• Whistleblower recipient Report an error

  “Recipient: Whistlelink AB – hosting in the EU.”

• Analytics processors Report an error

  “Recipient: Amplitude and Visma Software International AS with data hosted in the EU.”

• Analytics retention Report an error

  “The collected data is stored for 2 years.”

• Support recipient Report an error

  “Recipient: Zendesk with hosting in the EU.”

• Support retention Report an error

  “Penneo will automatically delete support requests after 2 years.”

• AI chatbot Report an error

  “Our Help Center includes an AI-powered chatbot for fast assistance, utilizing only the information available in the Help Center.”

• Billing recipient Report an error

  “Recipient: Younium, e-conomic, Likvido. All data is hosted within the EU.”

• Archive hosting Report an error

  “Recipient: Penneo production environment. Hosting provider: Amazon Web Service with data hosting in the EU.”

• Archive Report an error

  “Penneo Archive refers to an End User’s personal storage space on the Platform for managing documents signed using the Platform.”

• Trust service provider Report an error

  “Penneo, in its capacity as Trust Service Provider, to (i) verify the identity of the natural person to whom the certificate is issued, (ii) issue, manage and revoke the certificate and (iii) maintain a certificate database.”

• Platform modules Report an error

  “Penneo processes personal data in the Platform for the use of Penneo Sign and Penneo Collect.”

• DPA available Report an error

  “The Agreement includes a data processing agreement that covers the use of the Platform by the Customer and its employees. Data Processing Agreement can be found here: https://penneo.com/terms/.”

• Platform retention Report an error

  “Penneo will delete Customer’s data 90 days after the expiration of an Agreement with the Customer.”

• Processed types Report an error

  “Penneo users and end-users: Name, email address, IP address Penneo users and end-users- optional depending on the signing method selected: Job title, phone number, electronic ID information, national identification number”

• ISO 27001 Report an error

  “following best practices in accordance with ISO 27001 and ISO 27701 standards”

• Certification requirement Report an error

  “e.g. ISO 27001 certification, SOC 2 reports or similar”

• 2FA Report an error

  “Penneo ensures 2FA is activated on all systems that store any of the data, as described above, to prevent unauthorized access.”

• Encryption Report an error

  “The Customer’s data processed in the Platform is encrypted in transit using TLS 1.2 or higher and at rest.”

• Access management Report an error

  “Access to Penneo’s Platform production environments is further restricted by additional technical measures, such as two factor authentication, VPN and role-based access, and unique user accounts. Access rights are reviewed at least annually.”

• Data location Report an error

  “Customer data processed in the Platform is stored in data centers in the EU.”

• Backups Report an error

  “Penneo takes daily backups of storage and databases as part of its business continuity planning. Penneo has a disaster recovery plan, tested at least annually”

• Development practices Report an error

  “This includes defined measures such as forced peer review on code changes in production. Logically separated environments and micro-segmentation ensure that development and testing occur in non-production environments.”

• Penetration testing Report an error

  “Penneo also engages external security penetration testers, at least annually, to test for vulnerabilities in the Platform.”

• Subprocessor monitoring Report an error

  “At least once a year, Penneo will request and review relevant compliance documentation from the sub-processors.”

• Policy review frequency Report an error

  “Penneo’s information security and privacy policy has been approved by the management and is reviewed at least once a year.”

• Whistleblowing Report an error

  “Penneo complies with EU’s whistleblowing directive (Directive (EU) 2019/1937), as implemented in Denmark in Lov om beskyttelse af whistleblowere, no. 1436.”

• Cookie policy Report an error

  “Penneo uses both functional, analytical and advertising cookies. Penneo will only set analytical and advertising cookies based on a website visitor’s consent.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Data Protection Officer eIDAS levels & trust services
• The Data Protection Officer Signer identification
• The Data Protection Officer Evidence, validation & retention
• The Data Protection Officer European sovereignty
• The Data Protection Officer eIDAS levels & trust services
• The Data Protection Officer European sovereignty
• The HR Operations Lead eIDAS levels & trust services
• The HR Operations Lead Signer identification
• The HR Operations Lead Evidence, validation & retention
• The HR Operations Lead European sovereignty
• The HR Operations Lead eIDAS levels & trust services
• The HR Operations Lead Signer identification
• The HR Operations Lead European sovereignty
• The Integration Engineer Signer identification
• The Integration Engineer Evidence, validation & retention
• The Integration Engineer European sovereignty
• The Integration Engineer eIDAS levels & trust services
• The Integration Engineer Signer identification
• The Integration Engineer Evidence, validation & retention
• The Integration Engineer European sovereignty
• The Legal Counsel Signer identification
• The Legal Counsel Evidence, validation & retention
• The Legal Counsel European sovereignty
• The Legal Counsel eIDAS levels & trust services
• The Legal Counsel Signer identification
• The Legal Counsel European sovereignty
• The Revenue Operations Lead Signer identification
• The Revenue Operations Lead Evidence, validation & retention
• The Revenue Operations Lead European sovereignty
• The Revenue Operations Lead eIDAS levels & trust services
• The Revenue Operations Lead European sovereignty
• The Skeptic eIDAS levels & trust services
• The Skeptic Signer identification
• The Skeptic Evidence, validation & retention
• The Skeptic European sovereignty
• The Skeptic eIDAS levels & trust services
• The Skeptic Signer identification
• The Skeptic European sovereignty