Intro to GDPR

The GDPR (General Data Protection Regulation) is a new European privacy law adopted by the European Commission in 2016 designed to strengthen, modernize and unify the data protection laws for ALL individuals within the European Union.

GDPR will replace the prior EU privacy directive (95/46/EC) as well as all the local nation-state laws relating to it. This directive has been the basis of European data protection law since 1995.

The GDPR will be enforceable starting with the 25th May 2018.

There's a rather high chance GDPR will apply to you too as GDPR applies to:

• all organizations established in the EU
• organizations not established in the EU that are targeting & offering goods or services to individuals located in the EU or monitoring their behaviour in the EU.

This means GDPR could apply to any organization anywhere in the world and thus it sets a high bar for privacy rights and compliance GLOBALLY.

Anyone can read the GDPR legislation at https://gdpr-info.eu/. It's quite an easy read as it's written in common language, not in legalese.

Pipe is excited about the GDPR and the strong data privacy principles and rules that it establishes and we actively preparing our business for the GDPR.

We've thoroughly read the EU documentation on the GDPR, ran through most material available on the GDPR, and discussed with our legal counsel to understand its impact on Pipe and our customers. We are now at a stage where we understand the regulation, the key concepts and what needs to be done moving forward.

Pipe will be fully compliant with the regulation by 25th May 2018 in respect to:

1. the data we collect FROM individuals signing up for Pipe accounts, as data controller
2. the data we collect FROM individuals visiting our website, through Apache logs, as data controller
3. the data we receive FROM our reseller, Paddle.com Market Ltd, about customers, when subscribing, as data controller
4. the data we process FOR our clients in their use of the Pipe service as data processor.

Our compliance work does not stop on the 25th of May 2018, we'll continue to take appropriate technical and organizational measures such that processing meets the requirements of the GDPR and ensure the protection of the rights of the data subject.

Compliance as data controller

Here are some of the changes we are making to be compliant as data controllers in regards to the personal data we process for our purposes.

DONE:

• Pipe accounts can view & edit all the personal data we collect & store (name, email).
• Pipe accounts can now be instantly deleted together with all the related data (recording files & metadata, logs, credentials, etc.).
• Since accounts can now be deleted, we’re now collecting the IP and user agent during sign up and sign in with a data retention period of 1 year past the account deletion date.
• Deleted old data we were storing (ICE candidates from our discontinued WebRTC recording client, old email lists on MailChimp, etc.).
• Set up a retention policy for our website's Apache logs (1 month). Apache logs contain the IP, visited page, GET parameters and the user agent.
• With all of the above in place, we've updated our Privacy Policy to include all the information needed to be provided when data is collected.
• All personal data is stored in the EU hosted by EU organizations (EmailOctopus) or US organizations (Amazon Web Services, DigitalOcean) for which there's an "adequacy decision" like participating in the EU-US Privacy Shield.
• Educated all staff on the GDPR.
• We've also reviewed our relation with Paddle.com Market Ltd, our reseller, in terms of data they pass on to us, data we used as controllers, to show clients where their invoices will be sent by Paddle.
• Updated our sign up process to include a separate checkbox for being added to our "News & Product Updates" email list
• Set up a retention policy for personal data associated with expired trial/subscription accounts, data that we collect as a controller (1 year), and remove old data.
• Re-collect consent & proof of consent from the existing emails on our News & Product Updates email list.
• Review the use of non-essential cookies on the Pipe website and blog

IN PROGRESS:

• Celebrate 🎉

We've made the above changes so that Pipe is compliant with the GDPR as a data controller in regards to the personal data it collects from its account holders (email, name) and website visitors but we're also making changes towards being compliant as a data processor in relation to the data we process for you (audio & video files, snapshots, device names, IPv4, user agents, referer, etc. ).

Do you need to comply with the GDPR?

You should consult with legal counsel regarding the full scope of your compliance obligations but generally speaking, if you are an organization established in the EU or that processes personal data of EU citizens, you have to comply with GDPR.

If you're selling to businesses your EU customers might have a hard requirement for you to comply with GDPR depending on the nature of your business.

What happens if you do not comply?

Non-compliance with GDPR can result in fines:

1. as high as 20 Million Euros or 4% of annual global turnover for blatant violations of the individual's rights, the basic principles for processing including consent rules and the rules for data transfers to international organizations set forth in the GDPR legislation
2. as high as 10 Million Euros or 2% of annual global turnover for blatant violations of your obligations as a data controller or processor.

Controller or Processor?

In the context of the Pipe platform and the data we collect and process for you as our customer, you are a controller and we are a processor for your data.

What we're doing to help you achieve compliance

DONE:

• September 2021: Introduced the EU2 region which is fully hosted with providers in the EU. Details in the blog post.
• June 2021: Made changes to the list of sub-processors in our DPA. A new DPA document has been made available containing the new list.
• October 2020: Rolled out a new lifecycle feature which allows you to automatically delete recordings and associated PII after a number of days.
• Highlighted all personal metadata (collected with the recordings) in the Pipe account's recordings list to help you with awareness.
• Reviewed code for deleting recordings (through the REST API, UI, account deletion and on trial/subscription expiration) to make sure all files are deleted together with any (personal) metadata gathered with the recording.
• Set up a tight retention policy for the recording files and metadata we collect as a processor once the trial/subscription expires (28 days).
• Updated our REST API and webhooks to make sure it transmits all (personal) metadata we collect with the recordings.
• All your personal data is processed in the EU or in the US with US organizations that are participating in the EU-US Privacy Shield (Amazon Web Services, DigitalOcean). The European Commission has reconized US companies participating in the EU-US Privacy Shield as providing adequate level of protection (source).
• Set up a tight retention policy for our media server logs and Apache client delivery logs (28 days). Media server logs contain the IP of the recording device.
• Removed the HTTP referer data from all but the 1st of our webhooks that fires to make sure we're not keeping the data for longer than necessary.
• Implemented a Do Not Store (Personal) Metadata - along with the existing Do Not Store (Files) - to make it easier to comply with GDPR's data storage limitation principle.
• Update our Terms of Service to stipulate all clauses under Art.28 (3) of the GDPR (the Data Processing Addendum).

IN PROGRESS:

• Announce GDPR Compliance