eCAP Privacy Policy

eCAP (ELEKS Compliance Automation Platform) - a strategic solution automating the Information Security (IS) compliance workflows for organizations from various domains, especially heavily regulated ones, such as Finance, Healthcare, Insurance. eCAP analyzes the controls within the organization, maps them against the relevant regulatory requirements, as well as produces reports that allow to estimate current level of compliance and identify potential areas of improvement.

eCAP On-premises instance – eCAP version hosted on Client environment or in cloud on Client request. This version has full functionality and may be connected to Client data sources.

eCAP SaaS instance – eCAP version hosted in cloud environment on Eleks request. This version has limited functionality and no connection to Client data sources.

eCAP Services – services including eCAP installation assistance, technical support, customization, release of new versions and content updates.

ELEKS - Eleks Holding OÜ, an Estonian Company with Reg. No. 12995761, having its principal place of business at: Viru Sq. 2, Kesklinna district, Tallinn, Harju county, 10111, Estonia. You can find more information about Eleks on the website https://eleks.com/. Eleks is the sole owner of all right, title, and interest in or to eCAP.

Client – legal entity granted the right to use eCAP based on the terms prescribed by separate agreement with ELEKS. Client is the only controller of Users’ personal data processed with eCAP.

User – Client’s representative using eCAP to perform their duties.

ecap.privacy@eleks.com – ELEKS contact email you can reach any time you have questions concerning this Privacy Policy.

We at ELEKS respect your personal data and want to be GDPR friendly. That is why, we have tried to make information in this Privacy Policy understandable and clear, while boring only to the extent, required by the law. This Privacy Policy describes eCAP practices regarding the collection, use and disclosure of the information ELEKS collect from and about Users of eCAP.

ELEKS process Users’ personal data based on the agreement signed with a Client to provide and improve eCAP services. We will not use or share information with anyone except as described in this Privacy Policy.

eCAP SaaS instance collects the following data about the Users: name (optional), login, corporate email, location (country), position (optional), User IP address. Client saves Users’ personal data in eCAP data base.

In case of eCAP On-premises instance Client alone determines the categories, purposes and the means of personal data processing. ELEKS has no access to Users’ personal data processed with eCAP On-premises instance, unless Client specifically authorized access for selected ELEKS specialists to perform additional services.

eCAP SaaS instance is hosted in a highly secure ELEKS Private Cloud environment situated in EU data center.

Data centers have solid physical security and service continuity controls. It includes 24x7 monitoring, surveillance, and on-site security guards to prevent intruders gaining physical access to the equipment. ELEKS private cloud and infrastructure back-ups are distributed among independent locations in Eastern Europe to ensure the continued service and protection of your data from natural disasters and other disruptive events.

ELEKS has established efficient Information Security (IS) controls in line with ISO27001 and SOC 2 standards in order to protect the ELEKS Private Cloud environment. Those controls include firewalls controlling network perimeter, collection/analysis of logs using SIEM solution, presence of anti-malware tools on all endpoints, periodical vulnerability scanning, etc.

eCAP On-premises instance is deployed on Client infrastructure along with all the Client data. By default, ELEKS has no access to Client data unless Client specifically authorized access for selected ELEKS specialists to perform additional services.

eCAP is using KeyCloack (https://www.keycloak.org/) Identity and Access Management solution to provide secure and convenient user authorization and authentication services. KeyCloack supports Single Sign On and able to integrate with OpenID Connect, SAML 2.0 and Kerberos (Active Directory) Identity Providers.

eCAP development is performed in line with ISO 27001 compliant ELEKS Secure Software Development Life Cycle (SSDLC). Periodical security testing of eCAP solution includes Static Application Security Testing (SAST, code review), Dynamic Application Security Testing and Penetration Testing activities.

ELEKS conducts Data Protection Impact Assessment (DPIA) and Information Security Risk Assessment of eCAP annually or whenever major update of eCAP occurs. The aim of these assessments is to identify and proactively mitigate the risks related to data privacy, confidentiality, integrity and availability.

ELEKS Group is ISO-27001 and SOC 2 certified organization. On organizational level ELEKS has implemented the principles and controls of ISO 27001, an information security management system (ISMS) standard. The core ELEKS information security principles are:

• Management commitment to information security
• Security is part of our company culture
• Proactive response to information security threats
• Continuous information security education
• Lead the research and innovations in Information Security domain

ELEKS defines, implements and continuously improves ISMS Policies, which are mandatory and applies to the whole organisation. ELEKS specialists, as well as consultants, contractors, and all other persons who can have authorized access to information resources are familiar with and obliged to follow ELEKS ISMS Policies. The aforementioned policies apply to all information stored on physical or electronic data carriers, as well as any software and hardware that data processor possesses or temporarily uses. ISMS related documents are reviewed at least annually.

1. The right to be informed
2. The right of the access
3. The right to rectification
4. The right to erasure (“right to be forgotten”)
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Your rights in relation to automated decision-making and profiling
9. The right to withdraw your consent
10. The right to lodge a complaint with a supervisory authority

You have the right to complain either to a supervisory authority in the Member State where you live/work or to the Estonian Data Protection Authority.

For more information about your rights and how to exercise them we recommend visiting this perfect resource from the European Commission, which is available in many languages.

ELEKS Group
We may disclose your information to our affiliates or subsidiaries, which may be engaged in the data processing activities.

Service Providers
We may disclose your data to third party vendors, service providers, contractors or agents who perform functions on our behalf, such as hosting, technical support, legal and professional advisers. We’ll make sure that they treat it as protective as we do.

Your data will be processed and stored in the EU and may be accessed from Ukraine or the US by Eleks specialists, affiliates, etc. Nevertheless, your data will always be safe and under GDPR protection, despite where it is processed.

We treat your data as protective as the GDPR requires from the moment we’ve received it. If we transfer your data inside or outside ELEKS Group, we’ll use appropriate safeguards for personal data not to get outside of the GDPR scope.

ELEKS will not store or otherwise process Users’ data for “unlimited period”. Users’ data will be kept as long as we are in a business relationship with the Client and plus 1 year after their end.

eCAP may contain links to third-party websites/systems, which are owned and operated independently of ELEKS. Therefore, any information you provide to those websites/systems will be governed by their own privacy policy principles and data collection practices. ELEKS assume no responsibility or liability for information handling procedures and/or policies of such independent sites and systems.

We reserve the right to change this Privacy Policy at any time. We will post these changes here along with the date of the last change. Changes become effective as soon as they are posted. We advise you regularly check this page to be aware of policy updates.

You can reach us at ecap.privacy(at)eleks.com, if you:

1. Want to know more about privacy of your information
2. Want to make any kind of claim or request with regard to your personal data
3. Want to say that we are wrong in any privacy issue
4. Want to share your thought how we could make our privacy practices better
5. Just bored and want to talk about privacy

We promise that we’ll reply. At least once if you are just bored.