edoobox is GDPR compliant

What is GDPR?

The General Data Protection Regulation (GDPR) is a regulation of the European Union. It serves to harmonize personal data by private companies and public bodies in the EU.

The GDPR pursues the following objectives:

Protection of individuals with regard to the processing of personal data in the EU and the free movement of such data within the European internal market
Protection of fundamental rights and freedoms of natural persons, specifically protection of personal data
To ensure that the free flow of personal data within the EU is neither restricted nor prohibited for reasons connected with the protection of individuals with regard to the processing of personal data

Link to Regulation (EU) 2016/679

Do I have to be GDPR compliant and do I have advantages?

As soon as you process personal data of a natural person from the EU, you must use a GDPR compliant booking system. This is based on Regulation (EU) 2016/679.

This creates the following benefits for you:

Your customers have control over their data and can have it cleansed
Your customers consent to the processing of the data
You improve your customer service
You increase your trust and improve your reputation

Is edoobox GDPR compliant?

Yes, edoobox is GDPR compliant. How do you have to proceed?

Cooperation with third party providers
edoobox cooperates with various third party providers. All third party providers with whom edoobox processes personal data are GDPR compliant. The necessary agreements have been signed.

Hosting
edoobox is hosted on the servers of Nine Internet Solutions AG in Zurich, Switzerland. Nine can demonstrably guarantee end-to-end information security in accordance with ISO 27001:2013 and is ISO 9001 (quality management) certified.

How do I have to proceed to make my edoobox account GDPR compliant?

If a branch of your company is located in an EU member state or you offer edoobox offers to persons in the EU, you are subject to the GDPR.

As soon as you choose an edoobox subscription after the test phase, you will be asked to digitally sign the order data processing contract.

Order data processing contract according to Art. 28 (3) DSGVO and confidentiality agreement
Privacy Policy

Proceed as follows:

Select the first box in the edoobox settings My edoobox subscription from
Click under the paragraph "Data protection basic regulation GDPR" on the button "Capture / Edit".
Click on the button "Sign order data processing contract".
You will receive an email with a link to the contract, which you can sign online
Sign the contract on the last page
The signed contract will be sent to you by e-mail

We recommend that you check your privacy policy / data protection statement and your terms and conditions (T&Cs) and adjust them if necessary (in the edoobox settings, in the Legal texts box).

For existing customers we recommend this action as soon as possible. According to DSGVO we are obliged to mutually sign a commissioned data processing contract according to Art. 28 para. 3 DSGVO.

What services does edoobox provide to help you comply with the General Data Protection Regulation (GDPR)?

edoobox has extended the following functions for you, so that we as a contractor and you as a client can meet the requirements of the General Data Protection Regulation.

What does edoobox do?

Access control: Only authorized administrators, users and applications have access to the edoobox resources.
Multi-Factor Authentication (MFA)
Authentication of API requests
Tracking and logging of accesses
Regular compliance review and security analysis
Filtering and tracking HTTP access to applications
Encrypted data
Modern framework with high security standard
We have clearly regulated in the order data processing contract in accordance with Art. 28 Para. 3 GDPR which tasks lie with us, as the contractor, and which tasks lie with you, as the client.

What functions are available to you?

Access control: Only administrators, super-admins and managers authorized by you have access to their edoobox account.
Authentication of API requests
Download all personal data from edoobox at any time
Editing and deleting customer data
Control of customer data via the personalized user fields
Customize all designs in the Design Manager and view information related to personal data
Create your own privacy policy / data protection statement (in the edoobox settings, in the Legal texts box)
Bookers must (optionally) accept your privacy policy aligned with the GDPR
Bookers must (optionally) accept your terms and conditions (GTC) aligned with the GDPR

What are the subcontracting relationships at edoobox?

Hosting of the booking system edoobox
Nine Internet Solutions AG, 8047 Zurich, Switzerland

Hosting of the website edoobox.com
Amazon Europe Core S.à r.l., L-2338 Luxembourg, Luxembourg

Subcontracting relationship for the website edoobox.com
Online chat and edoobox support *1 - Zendesk, Dublin, Ireland
Cookie Consent Tool *1 - Cookie-script.com, Lithuania
Translation of the website *1 - Weglot, Paris, France
Construction of the website *1 - Webflow, San Francisco, USA

Hosting of the booking system edoobox V2 - Sandbox
Google Cloud Zurich (europe-west6)

Communication (SMS, e-mail, letter or phone)
E-mail dispatch via Mailjet *1/2 - Mailjet SAS, 75012 Paris, France
Letter dispatch via pingen.com *1/2 - Pingen GmbH, 8005 Zurich, Switzerland
SMS dispatch via Twillio *1/2 - Twilio Germany GmbH, 80337 Munich, Germany
Realtime notifications via Pusher *1/2 - Pusher Inc., London EC2A 4R, England *1/2
ADV contract signing via Signable *2 - Signable, Bristol BS1 3PR, England

Advertising and Cookies:
Ad serving, Analytcis/TagManager, Social Widget, Google Maps integration Google *1/2 - Google Ireland Limited, Dublin 4, Ireland
Ad serving or social widget integration from Facebook *1/2 - Facebook Germany, 20355 Hamburg, Germany
Ad serving via Bing *1/2 - Microsoft Corporation, Dublin 18, Ireland

API:
Interface connection to Zapier *1 - Zapier Inc. , Sunnycale, CA 94086, USA
Interface GenderAPI *1 - Gender API, 81825 Munich, Germany

*1 If you use this feature in edoobox
*2 Used internally by edoobox team