BOOK A CALL

Privacy Regulations Compliance (GDPR)

Updated: 04/15/2022

The data privacy regulatory landscape is undergoing a lot of change. You probably have heard about the EU General Data Protection Regulation (GDPR) that went into effect on May 25, 2018. There are also other regulations in effect or in the works around the world. We’ve written up this reference document to put helpful information regarding our products and privacy regulations in one place. Please also view our full Privacy Policy.

If you have any questions, comments, or concerns about our Privacy Policy, your data, or your rights with respect to your information, please email us at [email protected] 

European Union General Data Protection Regulation (GDPR)

SJW Group, Inc. is an American company and our data infrastructure is currently based in the US. That means if you are in another country in the world and you use our products, your data is transferred to the US. The EU has stronger privacy laws than the US and a core tenet of the GDPR is that if you transfer any personal data of EU residents out of the EU, you must protect it to the same level as guaranteed under EU law. There are two factors to this:

  1. The practices that businesses take handling personal data; and
  2. The laws of the countries where you transfer the EU personal data to

Practices We Have at Review Avenger

We’re serious about treating our customers fairly.

  • We never have and never will sell customer data.
  • We don’t run ads for other services in our products.
  • We limit the data we collect: if we don’t need it, we don’t ask for it.
  • We limit the permissions our apps request on your devices.
  • We put a lot of security measures into place including in-transit encryption, encryption at-rest, and requiring employees and contractors to sign non-disclosure agreements.
  • When you email us, you are always speaking with a human! No bots.

We do work with sub-processors. We’ve listed links to our current sub-processors at the end of this page. With each vendor, we assess their commitment to privacy and we sign a data processing addendum with them that include the controller-processor Standard Contractual Clauses.

Relevant US Laws

The US does not have a national consumer privacy law akin to GDPR.

There are national US security laws that are relevant to GDPR. Chief amongst them are: the Foreign Intelligence Surveillance Act (FISA) and Executive Order 12-333. FISA establishes ways for US law enforcement and intelligence agencies to gather information within the US about non-US entities suspected of espionage or terrorism. Executive Order 12-333 sets out how US intelligence agencies can gather information, including outside the borders of the US.

Virtually every American software service is subject to FISA. That includes all the American big tech companies you can think of as well as any European service that uses cloud infrastructure from Amazon Web Services, Microsoft Azure, or Google Cloud Computing. It also includes small tech American companies like us. However, to date, Saastic has never been served a FISA order or National Security Letter.

Even so, these laws are relevant for why extra mechanisms need to be in place to allow the legal transfer of personal data from the EU to the US. Since GDPR went into effect in 2018, Saastic has offered two such mechanisms: a data processing addendum; and voluntary participation in the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework. Currently, the data processing addendum is the primary mechanism as the Privacy Shield frameworks were invalidated in July and September 2020 respectively.

Data Processing Addendum

Processing EU personal data must be governed by a GDPR-compliant contract. We provide a standard Data Processing Addendum (DPA) to extend GDPR privacy principles, rights, and obligations everywhere personal data is processed. This addendum is in effect when the General Data Protection Regulation applies to your use of our Services to process Customer Data as defined in the DPA. The DPA includes the European Commission’s Standard Contractual Clauses to extend GDPR privacy principles, rights, and obligations.

To execute the DPA.

A Note About Privacy Shield

Since our establishment, we have also voluntarily participated in the EU-US and Swiss-US Privacy Shield Framework. The same Schrems II ruling from the Court of Justice of the European Union invalidated the EU-US Privacy Shield program as a mechanism for data transfer from the EU to the US. On September 8, 2020, Switzerland’s Federal Data Protection and Information Commissioner also invalidated the Swiss-US Privacy Shield program.

We are still certified under, and follow, both Privacy Shield Frameworks. However, they no longer serve as legal mechanisms for the transfer of EU personal data to the US.

California Consumer Privacy Act (CCPA)

In the CCPA, there is an important distinction between what are referred to as “service providers”, “businesses”, and “third parties”. You can see how the regulation defines these words by visiting the California Attorney General’s website: https://www.oag.ca.gov/privacy/ccpa.

Under the CCPA, Review Avenger is a “service provider.” That means when we process data you provide, we do so solely for the purpose you signed up for. Our business model is simple: we charge a recurring subscription fee to our customers. We do not sell personal information or use your data for any other commercial purposes unless with your explicit permission.

The CCPA also grants residents of California with additional rights related to their information. We grant those rights to all of our customers and detail them in our Privacy Policy. Our Privacy Policy also explains the information we collect in order to provide our services and clearly lists the only times we access or share your data.

US Health Insurance Portability and Accountability Act (HIPAA)

Our products are currently not HIPAA-compliant and we do not have immediate plans to become so.

Sub-processors

Review Avenger uses third party subprocessors, such as cloud computing providers and customer support software, to provide our services. We enter into data processing agreements including GDPR Standard Contractual Clauses with each subprocessor, and require the same of them.