We provide GDPR and IT Security trainings, so we feel we are quite strong in our protection of the data. Therefore, we made a list, which gives you some direction. However, note that this list is not cumulative, and subject to change, based on the day to day operations.

• We are very clear in our data collection points and do not want to collect or process more data than we need. We do this by looking carefully to each feature of our service and understand which tool is used, what data is being collected by that tool, and where it is stored and how it is protected.
• We use our trainings effectively also in our own business and go through our weekly checklists for IT security, look monthly at our laptop and device security settings, and to our service platform security checks.
• We have implemented market-standard forms of virus protections, malware protectors, and other relevant firewalls.
• We look at where data is stored and kept by us, as well as by our subprocessors to minimise risks of illegitimate transfers. If there is a transfer necessary we will only do so based on European Standard Contractual Clauses, and update this policy concerning such transfers. At this moment our subprocessors are processing data in Europe.