TECHNICAL AND ORGANISATIONAL MEASURES (TOMs)

1. Access control

BuzzKiez restricts access to systems and data based on the principle of least privilege.

• Access to production systems is limited to authorised personnel.
• Strong, unique passwords are required for all administrative accounts.
• Access is removed immediately when personnel no longer require it.
• Multi factor authentication is enabled for all critical services where available.
• No external parties have access to production systems unless strictly required and authorised.

2. Authentication and authorisation

• Business users authenticate to the BuzzKiez dashboard using email and password.
• Passwords are stored as secure, salted hashes.
• Role based access controls limit what actions business users may perform.
• Session management prevents unauthorized reuse of authentication tokens.

3. Logging and monitoring

• System events and application level actions are logged to support debugging, security monitoring and operational integrity.
• Logs may include timestamps, request identifiers, device information and error traces.
• Logs are stored securely and retained for up to twelve months unless needed for security investigations.

4. Encryption

• All data transmitted between clients, servers and infrastructure is encrypted using TLS.
• Data stored within DigitalOcean managed services is encrypted at rest according to DigitalOcean's platform defaults.
• Secrets and environment variables are stored securely and never committed to version control.

5. Separation of environments

• Production and development environments are kept separate.
• Development and testing activities do not use personal data.
• Only authorised personnel may deploy changes to the production environment.

6. Data minimisation and purpose limitation

• BuzzKiez processes only the personal data necessary to operate the loyalty program.
• No sensitive categories of data under Art. 9 GDPR are processed.
• No real time location data of end customers is collected.
• Static business coordinates are used only to enable location based updates.
• Personal data is not used for profiling outside of the loyalty program functions.

7. Backup and restore

• Regular automated backups of production databases are performed.
• Backups are encrypted and stored within the EU.
• Restore procedures are tested periodically to ensure availability of data.

8. Hosting and physical security

• BuzzKiez is hosted exclusively on DigitalOcean data centres located in the European Union.
• Physical security, redundancy, environmental controls and network protections are provided by DigitalOcean.
• DigitalOcean maintains industry standard certifications and independent audits.

9. Incident response and breach notification

• BuzzKiez maintains an internal process for identifying, assessing and responding to potential security incidents.
• Processor will notify the Controller without undue delay if a personal data breach affecting the Controller's data is detected.
• Investigations are carried out promptly and information is provided as it becomes available.

10. Availability and resilience

• DigitalOcean provides infrastructure redundancy and availability protections.
• Monitoring is in place for key platform components.
• Regular updates and security patches are applied to supported systems in a timely manner.

11. Sub processors

BuzzKiez uses sub processors only where necessary to provide the service.

Current sub processor:

• DigitalOcean LLC (hosting and infrastructure, EU data centres)

Any changes in sub processors will be communicated to Controllers in advance.

12. Data deletion

• End customer loyalty data is deleted or anonymised when requested by the Controller or when the Controller deletes its account.
• Business account data is deleted at the end of the contract unless legal retention periods require continued storage.
• Backups containing personal data are automatically removed after expiry of their retention period.