European General Data Protection Regulation (GDPR)

PROSTEP is committed to complying with national and international data protection regulations when conducting business and handling data. Our processes and methods are subject to the strict requirements stipulated within the framework of ISO 9001 and 27001 certification, among others.

As of 25 May 2018, the European General Data Protection Regulation (GDPR) introduced new regulations on the processing of personal data by processors. If the processing is performed within the framework of a processing relationship, the regulatory requirements stipulated in Art. 28 GDPR must be observed and implemented. One of these stipulations is that processing by a processor must be governed by a contract.

An agreement between AWS (future cloud provider) and PROSTEP regarding processing by a processor already exists. With this agreement, PROSTEP imposes the same data protection obligations on AWS that arise from the contract between PROSTEP and the controller. Employees at AWS do not at any time have access to the contents of the database and are not able to view the encrypted data.

An additional order processing agreement must be concluded between you and PROSTEP when a GlobalX SaaS contract is concluded.

This enables PROSTEP to ensure that data processing is carried out in accordance with the instructions issued by the customer and that the technical and organizational measures for the protection of the personal data involved pursuant to Art. 32 GDPR and those agreed with the customer are implemented and complied with.

The OpenDXM GlobalX software used is developed by PROSTEP AG. Every major version of OpenDXM GlobalX is subject to penetration testing performed by an independent external service provider. This enables us to ensure that we can identify possible security gaps early on and, of course, close them.