Self-Assessment Sheet

Evaluation of VERCOM S.A. as a personal data processor. This document has been prepared in response to the most frequently asked questions by Vercom S.A. clients regarding information security and the processing of entrusted personal data.

Address:
Wierzbięcice 1B, 61-569 Poznań, Poland

VAT ID

7811765125

REGON

300061423

KRS (National Court Register)

535618

LEI

259400P9VT804CUH6G16

EUID

PLKRS.0000535618

Scope of Services

Vercom develops global cloud-based communication platforms (CPaaS) that enable companies to build and cultivate lasting relationships with their audiences across multiple communication channels, including SMS, EMAIL, PUSH, and OTT. Our solutions help our clients and partners overcome communication complexities, enabling them to automate and scale operations while maintaining high deliverability and efficiency. All of this is achieved in a fast, secure, and reliable manner.

circle-exclamation

FREQUENTLY ASKED QUESTIONS (FAQ)

Data Protection Officer (DPO)

chevron-rightHas the Processor appointed a Personal Data Protection Officer?hashtag

Yes, VERCOM S.A. has appointed a Data Protection Officer.

chevron-rightPlease provide contact details for the Personal Data Protection Officer.hashtag

Marika Rybarczyk - [email protected]

chevron-rightAre the activities of the Data Protection Officer (the person responsible for the personal data protection area) documented?hashtag

Yes, the DPO's activities are documented.

Data Controller

chevron-rightHave procedures been implemented for the exercise of data subject rights (right to information, access to data and copies thereof, rectification or completion, erasure, restriction of processing, data portability, objection, and not being subject to automated profiling)?hashtag

Yes, to the extent that these obligations rest upon Vercom S.A. as the Data Controller.

chevron-rightDoes the processing entity maintain a registry of requests from data subjects?hashtag

As a processor, we do not maintain a registry of requests from data subjects, as these matters are the responsibility of the Data Controller.

chevron-rightAre there designated persons responsible for maintaining contact with the Controller entrusting the processing?hashtag

Yes.

Entrustment and Sub-processing of Personal Data

chevron-rightHow many sub-contractors does the processor use and to what extent?hashtag

The list of processors may vary depending on the service provided. Details are regulated by the concluded Data Processing Agreement (DPA).

chevron-rightWhat is the subject matter, nature, and purpose of the personal data processing?hashtag

Processing takes place for the purpose of providing the Service to the Client based on the Main Agreement and to fulfill Vercom's obligations under this Data Processing Agreement, particularly regarding data security, including ensuring its integrity and availability.

chevron-rightWhat is the duration of the processing?hashtag

The data processing period shall be the same as the period of Service provision under the Main Agreement, with the proviso that the Data Processing Agreement remains in force until the data is deleted in accordance with its provisions.

chevron-rightWhat categories of natural persons does the agreement cover?hashtag

The processed personal data concerns the following categories of natural persons:

End users – natural persons who are recipients of electronic communication sent by the Client under the Main Agreement.

chevron-rightWhat types of special categories of personal data are covered by the agreement?hashtag

The processed special categories of personal data include the following categories: Not Applicable.

chevron-rightAre there established mechanisms for storage, deletion, and anonymization of personal data?hashtag

Yes.

chevron-rightHave all sub-contractors used during service provision been vetted to ensure an appropriate level of personal data protection?hashtag

Yes, sub-contractors are subject to annual assessment.

chevron-rightIs a record kept of suppliers to whom you entrust or sub-entrust personal data processing?hashtag

Yes, a detailed list of Vercom S.A. sub-processors is maintained (last update 12 August 2025), as well as a Record of Processing Activities at VERCOM S.A.

chevron-rightHave internal regulations been prepared and implemented regarding supervision and monitoring of personal data processing?hashtag

Yes. Periodic internal and external audits are conducted. Testing takes place at least once every 12 months, or more frequently if necessary.

chevron-rightWhere is the entrusted data stored?hashtag

All operations performed on personal data take place within the IT system. Data entrusted for processing is not stored on employee computers. Vercom does not process personal data in paper form within the scope of the provided services. All personal data entrusted to us for processing is stored in an external server facility that meets the highest security standards and is subject to multi-level security measures there.

chevron-rightHow does the entity ensure the separation of data entrusted by the Controller from data of other entities, including its own data?hashtag

Logical data separation is applied in the Vercom systems made available as part of the provided services.

chevron-rightDoes the Processor apply an approved code of conduct as referred to in Article 40 of the GDPR?hashtag

No.

chevron-rightIs a Record of Processing Activities maintained?hashtag

Yes.

chevron-rightIs a Record of Categories of Processing Activities maintained?hashtag

Yes.

chevron-rightDoes storage and processing of data take place only within the EEA?hashtag

Yes.

chevron-rightDo you have procedures regarding backups of the processed data?hashtag

Yes.

Implementation of the Information Security Management System (ISMS)

chevron-rightHave an Information Security Policy and regulations regarding personal data processing and protection been implemented?hashtag

Yes.

chevron-rightHas an IT systems management instruction for personal data processing or other internal regulations regarding IT infrastructure management been implemented?hashtag

Yes.

chevron-rightHave the implemented Information Security Policy and regulations regarding personal data protection been approved by senior management?hashtag

Yes.

chevron-rightDo you ensure the ability to continuously ensure the confidentiality, integrity, availability, and resilience of processing systems and services?hashtag

Yes.

chevron-rightAre the Information Security Policy and regulations regarding personal data protection published and available to Personnel (employees/contractors)?hashtag

Yes.

chevron-rightDoes the processor implement the principle of Data Protection by Design?hashtag

Yes.

chevron-rightDoes the processor implement the principle of Data Protection by Default?hashtag

Yes.

Risk Assessment

chevron-rightIs there an implemented methodology for assessing the risk of infringing upon the rights or freedoms of natural persons?hashtag

Yes.

chevron-rightIs there an implemented methodology for Data Protection Impact Assessment (DPIA)?hashtag

Yes.

chevron-rightIs risk assessment performed periodically? Please provide the date of the last risk assessment.hashtag

Yes, 8 August 2025.

Business Continuity

chevron-rightAre mechanisms applied to monitor and detect activities that may impact information security and business continuity?hashtag

Yes, a range of solutions has been deployed to monitor system events and alert on detected anomalies. Additionally, the company maintains an in-house cybersecurity team that conducts regular tests of the implemented solutions.

chevron-rightHas a Business Continuity Plan (BCP) and/or Disaster Recovery Plan (DRP) been implemented?hashtag

Yes.

chevron-rightIs regular testing and assessment of the effectiveness of implemented technical and organizational measures ensuring the security of processing applied?hashtag

Yes, as part of annual BCP testing.

Management of Security Incidents and Personal Data Breaches

chevron-rightHas the provider established procedures for handling personal data protection breaches (security incidents)?hashtag

Yes, a formal process for handling all personal data breaches and security incidents exists and has been implemented; all personal data breaches and security incidents are reported to senior management, registered, and handled by designated personnel.

chevron-rightIs a register of breaches maintained?hashtag

Yes, we maintain a Security and Personal Data Breach Register.

chevron-rightWhat is the number of breaches reported to the Personal Data Protection Office (UODO) within the last 12 months?hashtag

None.

chevron-rightHas a breach of personal data protection by the provider ever been established by a final decision of a supervisory authority or a final court judgment?hashtag

No.

Information Classification

chevron-rightIs an information classification and categorization scheme based on sensitivity implemented in the organization?hashtag

Yes.

chevron-rightDo regulations regarding processed information cover: secure processing, storage, transmission, transport, destruction, and reclassification of information?hashtag

Yes.

chevron-rightAre employees informed about the classification methods and information processing procedures in force within the organization?hashtag

Yes.

Personnel

chevron-rightHave employees/collaborators been obligated to maintain the confidentiality of personal data?hashtag

Yes. Upon employment, every employee and collaborator signs a confidentiality statement (NDA).

chevron-rightAre authorizations issued for employees involved in the personal data processing process?hashtag

Yes. Access to data is granted only to duly authorized employees. Access is granted on a strict "need-to-know" basis – solely to the extent necessary to perform duties at a given position.

chevron-rightDo employees receive ID badges and are they required to wear them?hashtag

Every employee possesses an access control card and is required to carry it. Each badge is assigned to a specific user and serves to gain access to office premises. Every use of the badge is logged in the system.

chevron-rightIs training organized for newly hired employees before undertaking personal data processing activities?hashtag

Yes, the ISO Representative conducts basic training for the newly hired Employee regarding personal data processing in the company and workplace rules (Job Instruction), and familiarizes them with the Information Security Policy.

chevron-rightDoes the organization ensure ongoing improvement of its employees'/collaborators' knowledge through cyclical training and other activities aimed at raising awareness regarding personal data protection?hashtag

At least once a year, the IMS Representative (Integrated Management System) organizes mandatory training for Employees regarding personal data processing in the Company and workplace rules. Employees participate in training in accordance with procedures PBI 04 Annex 1 "Access and Resource Management Instruction". Last training: 29 December 2025.

chevron-rightIs pre-employment screening conducted?hashtag

Yes. A system of employee verification procedures (background checks) has been implemented and is applied.

chevron-rightDoes the company collect statements of no criminal record from employees?hashtag

Yes, employees sign relevant statements and are obliged to inform the employer in the event of any changes.

chevron-rightIs a Clear Desk Policy applied?hashtag

Yes.

chevron-rightIs a Clear Screen Policy applied?hashtag

Yes.

Access Control and Management

chevron-rightDoes the company have a regulated password policy?hashtag

Yes, a consistent password policy has been implemented.

chevron-rightIs there an access and identity management procedure?hashtag

Yes, in accordance with PBI - 04 Annex 01 "Access Management Instruction at Vercom S.A."

chevron-rightDo you ensure accountability of persons using IT resources and data through digital identity management and logging of activities assigned to these identities?hashtag

Yes.

chevron-rightDoes the procedure ensure securing, blocking, or deleting default accounts such as generic accounts (built-in accounts), non-personalized accounts, and guest accounts?hashtag

The system does not allow the creation of generic, non-personalized, or guest accounts.

Remote Access

chevron-rightIs remote access to organizational resources regulated by internal procedures?hashtag

Yes, in accordance with the documented and implemented Procedure: "Use of IT Resources by Users".

chevron-rightIs remote access authorized by senior management for each individual employee or group of employees?hashtag

Yes.

chevron-rightAre security requirements applicable within the organization taken into account for remote access?hashtag

Yes.

chevron-rightAre employees informed about the risks associated with work utilizing remote access?hashtag

Yes. Every newly hired employee and collaborator undergoes mandatory training in this area.

chevron-rightIs an encrypted "end-to-end" connection required between the organization and the end-user?hashtag

Yes.

chevron-rightIs two-factor authentication (2FA) required for remote access?hashtag

Yes.

Portable and Mobile Devices

chevron-rightAre rules for the use of portable devices described, documented, and implemented?hashtag

Yes, in the Procedure: "Use of IT Resources by Users".

chevron-rightIs the use of private portable devices regulated in internal instructions?hashtag

Yes. The use of private portable devices is regulated, described, documented, and implemented in internal instructions: PBI - 04 "Use of IT Resources by Users".

chevron-rightAre portable devices protected by virus/malware detection software? Is this software and its updates centrally managed?hashtag

Yes, in accordance with implemented procedures regarding mobile devices used by employees. Mobile devices have access control configured; they are protected by anti-malware and anti-virus software. This software and its updates are centrally managed.

chevron-rightAre all portable devices used in the organization registered in a central registry?hashtag

Yes, a hardware register is maintained.

chevron-rightAre cryptographic techniques applied to mobile devices?hashtag

Yes, we have a documented and implemented Procedure for Security and Cryptographic Key Management, which also relates to the security of mobile device usage.

chevron-rightAre only administrator-authorized portable media allowed for use within the organization?hashtag

In accordance with our Procedure "Use of IT Resources by Users," there is a strict prohibition on the use of external information storage media. External drives may only be used by selected IT department employees and System Administrators, following the prior consent of the DPO and the IMS Representative. They are subject to detailed guidelines, their number is strictly limited, they are logged, encrypted, and subject to annual reviews. No personal data may be stored on them.

chevron-rightAre rules for the destruction of portable data media, as well as data stored on these media, regulated in internal instructions?hashtag

Yes. Everything is conducted in accordance with the documented and implemented Vercom Data Retention Procedure and the IT System Management Instruction, in a manner appropriate to the data category.

Document Destruction

chevron-rightAre printouts managed appropriately within the organization, and does a management procedure exist?hashtag

Yes. Handling of printouts is described in the implemented and documented procedure: DO - 02 "IT System Management Instruction". Unnecessary documents are destroyed in a manner that prevents their reading, e.g., using shredders with an appropriate security level (recommended for destroying documents containing personal data such as name, surname, email address, etc.) and by a specialized external company dedicated to document destruction.

chevron-rightHave employees been obligated to immediately collect printouts containing personal data or other confidential information from printers?hashtag

Yes. In accordance with the implemented and documented procedure: DO - 02 "IT System Management Instruction".

Server Security

chevron-rightIs access to servers restricted to authorized administrators only?hashtag

Yes.

chevron-rightAre servers located exclusively in a data center?hashtag

Yes.

chevron-rightDoes the data center possess appropriate security measures?hashtag

The facility meets the requirements of the international Tier III standard. The data center is equipped with, among other things, an air conditioning system, an Uninterruptible Power Supply (UPS) system, and a fire suppression system. Redundant power supply systems (e.g., in servers) are utilized. Air conditioning and UPS systems are regularly tested.

chevron-rightAre server resources monitored (e.g., CPU usage, RAM, disk space)?hashtag

Yes.

chevron-rightAre servers protected by a Firewall system?hashtag

Yes.

Network Security

chevron-rightIs the internal network separated from the Internet by Firewall/IPS/IDS devices?hashtag

Yes.

chevron-rightDo only authorized persons have access to network devices?hashtag

Yes.

chevron-rightDo contingency plans exist and are they implemented for network devices?hashtag

Yes.

chevron-rightDo you provide measures for filtering/blocking inbound and outbound network traffic to protect data and resources against intentional or accidental breaches of confidentiality, integrity, or availability?hashtag

Yes.

chevron-rightIs access to the wireless network restricted exclusively to authorized devices?hashtag

Yes.

chevron-rightIs access to the wireless network monitored for unauthorized access?hashtag

Yes.

chevron-rightWhat security measures are implemented at the interface with the public network?hashtag

The wireless network is separated from the internal LAN via Firewall rules. Access to the local network and remote networks (e.g., the Internet) is granted based on a request from the employee’s supervisor, submitted via an email ticket to the System Administrator requesting IT resource access and system privileges (login, password, email), or directly by the Department Head. URL Filtering: The organization defines which URLs are blocked and designates those that are permitted.

Physical Security

chevron-rightAre physical security measures implemented in the building (e.g., camera system, secure locks, ID badges, access control)?hashtag

Access to the building is granted exclusively to authorized personnel. Security measures include locks on all entrances operated via personalized keycards, CCTV monitoring, and security gates/turnstiles.

chevron-rightBased on risk analysis, have adequate organizational and technical measures been implemented to ensure an appropriate level of security for the confidentiality, integrity, availability, and resilience of systems and services?hashtag

Yes.

chevron-rightIs access to premises at the disposal of the Processor impossible for third parties after working hours, and is access for cleaning staff and security detailed and supervised?hashtag

Access is restricted to authorized persons only, with personalized keycard locks on all entrances. Personal data entrusted to us for processing is NOT stored in the office buildings where we work. All personal data entrusted to us for processing is stored in an external Data Center that meets the highest security standards and is subject to multi-level security measures there – SOC 2 certification. After working hours, cleaning staff may be present in the office building, or in emergency situations, building security may also have access. This is foreseen in our procedures related to the implemented ISO 27001 standard. We have signed Non-Disclosure Agreements (NDAs) with every individual, including cleaning staff working after hours. However, the specific locations where data is stored are NOT accessible to third parties after working hours.

Cloud Computing

chevron-rightWill personal data entrusted for processing be processed in cloud computing?hashtag

Yes. Our service constitutes a specific form of public cloud computing, entirely created and managed by Vercom S.A. – we do not utilize a third-party cloud service provider; we are the provider ourselves. This is understood in the sense that cloud computing is not merely commonly perceived "resources" or "virtual space," but also services, infrastructure, and application development platforms. It should be defined as a hybrid solution, i.e., a combination of service, platform, and infrastructure. The term CPaaS (Communications Platform as a Service) has also become common, denoting a solution dedicated to communication between businesses and their customers via a dedicated platform that organizes this communication process.

chevron-rightAre external audits of provided cloud services conducted?hashtag

Yes, a security audit based on OWASP TOP 10 (Open Web Application Security Project TOP 10 vulnerabilities) and the OWASP ASVS methodology. Additionally, an audit is conducted in connection with ISO 27001 and ISO 27018 certification.

Data Protection Measures

chevron-rightPlease indicate the method of securing premises.hashtag

Refer to the "Security Measures" section.

chevron-rightPlease indicate the organizational measures for Personal Data protection.hashtag

Refer to the "Security Measures" section.

chevron-rightPlease indicate hardware measures regarding IT and telecommunications infrastructure.hashtag

Refer to the "Security Measures" section.

chevron-rightPlease indicate protection measures within software tools and databases.hashtag

Refer to the "Security Measures" section.

Last updated