The subject, nature, and the purpose of processing under the DPA

For communication and interaction with customers in digital salesrooms and meeting rooms in the tool Meetric. Personal data is saved for 12 months by default. This can be changed in settings.

Duration of the data processing

Meetric will process Personal Data solely for the period during which the Services are provided under the Services Agreement, including any additional period agreed in writing or required by applicable law. Upon termination or expiration of the Services Agreement, personal data will be returned or, where technically feasible, securely deleted in accordance with Meetric's retention policies and legal obligations.

The categories of personal data

Meetric processes personal data as part of delivering its services. The specific categories of personal data include, but are not limited to:

1. Customer Data: Information provided by The Customer during account setup and subsequent interactions (e.g., account details, transactional records).
2. Behavioral Data: Data generated from user interactions, such as engagement metrics, and data that support the optimization of operational, marketing and sales efforts. Behavioral data may include, but is not limited to recordings of conversations, transcriptions from conversations, insights from processes transcriptions, meeting data such as meeting time and participant engagement.

The categories of data subjects

The determination of which individuals' personal data is processed rests with The Customer and its authorized Users. Accordingly, Meetric processes personal data for the following categories of data subjects:

1. Customer Contacts: Individuals whose details are provided by The Customer, including first name, last name, address, phone number, email, and country of residence.
2. Meeting Participants: Individuals whose participation in video and audio meetings results in the capture of recordings and associated metadata.

Processing activities

In alignment with the Services Agreement, Meetric undertakes the following detailed activities concerning the Included Personal Data, which may include, but is not limited to:

1. CRM Integration: Establishing connections and enriching data between our platform and the client's Customer Relationship Management (CRM) and other internal systems.
2. Marketing Outreach: Engaging in targeted marketing strategies and campaigns to promote services.
3. Marketing Automation: Implementing and managing automated marketing processes to streamline and optimize customer outreach.
4. Email Management: Conducting specific email campaigns, which includes sending, tracking, and analyzing the performance of these campaigns.
5. Meeting Management: Utilizing personal data during client meetings and handling any post-meeting data processing requirements.
6. Data Analysis: Conducting in-depth analysis and generating statistics related to client meetings, as well as evaluating the effectiveness of sales materials.

1. Data Protection Officer (DPO)

Meetric has appointed a dedicated Data Protection Officer responsible for overseeing our data protection strategies, conducting regular compliance audits, and managing data subject requests. The DPO also serves as our primary liaison with regulatory authorities. For any data protection inquiries, please contact: dpo@meetric.com.

2. Data encryption

• Data in Transit: We secure all data transmitted over our networks using TLS 1.2/1.3 protocols to prevent interception and unauthorized access.
• Data at Rest: Sensitive data is encrypted using AES-256. Key management practices include the use of Hardware Security Modules (HSMs), regular key rotation, and strict access controls to ensure keys are handled secure.

3. Secure development practices

We maintain a robust security posture from the earliest stages of development by integrating a comprehensive suite of security tools directly into our CI/CD pipelines.

Our pipelines include:

• Static Application Security Testing (SAST): Scanning our codebases to identify potential vulnerabilities early in the development process.
• Interactive Application Security Testing (IAST): Continuously monitoring running applications to detect vulnerabilities in real time.
• Software Composition Analysis (SCA): Analyzing third-party components to manage and mitigate risks associated with open-source software.

4. By embedding these automated security measures into our development lifecycle, we proactively address potential risks and ensure that security remains a foundational element of our software delivery process.

5. Access control

• The Data Processor implements zero trust network access, replacing traditional VPN infrastructure. All access to internal resources requires identity verification and device posture checks through a secure client application.
• We enforce role-based access control (RBAC) and implement multi-factor authentication (MFA) to ensure that only authorized personnel can access sensitive data.
• Access rights are assigned based on the principle of least privilege and are reviewed periodically.
• Comprehensive logging and monitoring mechanisms are in place to detect and respond to any unauthorized access attempts.

6. Data backup and recovery

• Regular backups are performed daily and stored securely in geographically diverse locations to safeguard against data loss.
• Our backup strategy is underpinned by clearly defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
• We conduct periodic disaster recovery drills to ensure rapid restoration of data and continuity of service in the event of an incident.

7. Network security

• Our network infrastructure is protected by industry-leading firewalls, intrusion detection/prevention systems (IDS/IPS), and strategic network segmentation.
• We perform regular vulnerability assessments and penetration tests to proactively identify and mitigate potential security weaknesses.

8. Regular updates and patch management

• A robust patch management process ensures that all software and systems are kept up to date.
• Critical updates are tested and deployed promptly to address any vulnerabilities.
• An up-to-date inventory of software and systems supports comprehensive and timely patching across the infrastructure.

9. Employee training and awareness

• All employees receive regular training on data protection, security best practices, and GDPR compliance.
• Training programs include periodic refresher courses and simulated phishing exercises to maintain a high level of security awareness.
• We assess training outcomes continuously, ensuring that our team remains informed about evolving threats and compliance requirements.

10. Data Protection Impact Assessments (DPIAs)

• Prior to introducing new processing activities or making significant changes, we conduct DPIAs to identify and mitigate potential risks to personal data.
• DPIAs are thoroughly documented and reviewed periodically, ensuring that risk management remains an ongoing process.

11. Incident response and monitoring

• Meetric maintains a comprehensive incident response plan that outlines clear procedures for detecting, containing, and mitigating security incidents.
• We employ a Security Information and Event Management (SIEM) system for centralized logging and real-time monitoring, enabling rapid identification and response to anomalies.

12. Security and Data Protection Policies

• Device Security: Workstations shall automatically lock after 5 minutes of inactivity. Re-authentication is required to regain access.
• Data Destruction: Employees must use secure erasure methods for personal data on devices, ensuring data cannot be recovered through standard recovery tools or forensic methods.
• Visitor Management: All visitors must be escorted by authorized personnel at all times within company premises. Visitor access logs are maintained.