On top of the functional and technical measures and configuarations as part of the solutions (see article aboves), Piano offers contractual commitments as follow:
Purpose limitation and Data ownership
The GDPR states that a processing of Personal Data is lawful only if the data is "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes" (art. 5.1.b).
|
Solution |
Purpose |
Data ownership |
|---|---|---|
|
Piano Analytics |
The main purpose is audience measurement, producing statistical audience data and analysis (art. 6.2 of the Analytics DPA). The customer, as data controller, may pursue other purposes linked to its business needs, within the limits defined in article 8 of the DPA. |
Data collected, processed and stored on behalf of the customer remains its entire property, until deleted at the end of the contract. |
|
Piano Subscriptions, Piano Audience |
Purposes are determined by the Client and derived from the functionality of the Software: audience experiences (subscription performance, user trends, preferences, segmentation), billing and accounting, and any other purpose foreseen by the Software's functionality (standard Piano Subscriptions and Audience DPA). |
The Client owns and retains all rights in and to the Client Data (standard Piano Subscriptions and Audience DPA). |
Data Processing Agreement (DPA)
As required by the GDPR (art. 28), the supply of Piano's solutions to a customer must be governed by a subcontracting agreement.
|
Solution |
DPA coverage |
|---|---|
|
Piano Analytics |
The standard DPA covers description and lawfulness of processing, limitation of purpose and retention, confidentiality, and security of data, and a point of contact. Processing operations applicable by default: collection; recording, organizing, structuring and keeping; consultation and use; limitation, deletion or destruction. |
|
Piano Subscriptions, Piano Audience |
Governed by the standard Piano Subscriptions and Audience DPA, which covers the nature and purpose of processing, the types of personal data and categories of data subjects concerned, confidentiality, and a comprehensive set of technical and organisational security measures (access controls, encryption, incident response, breach notification within 24 hours, regular security testing and audits). Processing operations applicable by default: collection; recording, organizing, structuring and keeping; consultation and use; limitation, deletion or destruction. |
Sub-Processors
To provide its solutions, Piano uses sub-processors (rank 2 with respect to the customer/data controller), across all its products.
The list of sub-processors is available and maintained over time on: https://www.piano.io/legal/privacy-policy#piano-sub-processors.
Piano concludes a data processing agreement with each Piano sub-processor, ensuring the same level of protection as required within the signed DPA.
Transfers
A data transfer is defined by the GDPR as processing taking place in a third country, or an international organization outside the European Union (art. 44). In that event, the GDPR requires transparency about where data is transferred (art. 14.f) and appropriate guarantees to ensure continued compliance (chapter 5).
General international data transfers principles are defined within the SaaS platform Privacy Policy availalbe on https://www.piano.io/legal/privacy-policy#international-data-transfers, with, among others Binding Corporate Rules (BCR) validated by the EDP that applied to all Piano affiliates.
Regarding product specificities:
|
Solution |
Guarantees |
|---|---|
|
Piano Analytics |
All customers' audience measurement data is processed and stored by default within the European Union, guaranteeing no physical or active transfer of data outside the EU. Appropriate technical measures (Data Minimization and Anonymization, encryption) are applied. Appropriate safeguard are applied in case of potential remaining transfers via access. The GDPR-Europrivacy Certification demonstrates appropriate safeguards. |
|
Piano Subscriptions, Piano Audience |
Data processing and storage option in the EU is available. Appropriate technical measures (Data Minimization and Anonymization, encryption) are applied. Appropriate safeguard are applied in case of potential remaining transfers via access. |