Privacy Statement

I. Description of the measures that ensure that only authorized personnel have access to the Processing of Personal Data:

TPV uses an authorization policy to determine who should have access to which data. Employees do not have access to more data on the basis of this system than is strictly necessary for their job.

II. Description of the measures to protect personal data against unintentional or unlawful destruction, accidental loss or alteration, unauthorized or unlawful storage, processing, access or disclosure:

Organization of information security and communication processes

• TPV has established an information policy plan in which an information security coordinator has been appointed who identifies risks relating to the processing of personal data, promotes security awareness, checks facilities and takes measures to ensure compliance with the information security policy.
• Information security incidents are documented and used for optimization of the information security policy.
• TPV has set up a process for communication about information security incidents (databreach procedure).

Staff members

• With employees, confidentiality statements are agreed and information security agreements are made.
• TPV stimulates awareness, training including training with regard to information security.
• Employees do not have access to more data than is strictly necessary for their job based on an authorization system.

Physical security and continuity of resources

• Personal data are only processed in a closed, physically secure environment with protection against external threats.
• Personal data are only processed on equipment where measures have been taken to physically secure the equipment and to ensure the continuity of the service.
• Periodic backups are made for the continuity of the service. These backups are treated confidentially and stored in a closed environment.
• The locations where data are processed are secured by means of locks, alarm systems and video surveillance and are periodically tested, maintained and periodically assessed for safety risks. TPV maintains business continuity plans that include contingency locations.

Network, server and application security and maintenance

• The network environment in which data is processed is strictly protected. Traffic flows are separated and measures are implemented against abuse and attacks.
• The environment in which personal data are processed is monitored.
• The digital services and products in which personal data are processed are established on the basis of system planning, security control and acceptance. Changes in applications are tested for vulnerabilities before they are taken into production.
• On systems, the latest (security) patches are periodically installed on the basis of patch management.
• Data processed within applications are classified according to risks.
• Penetration tests and vulnerability assessments are performed periodically.
• Information that is no longer used is removed.
• Cryptographic measures have been applied to passwords to store these data securely.
• Encrypted connections are used for log-in processes. The exchange of personal data to third parties takes place encrypted.

III. Description of the measures to identify weak points with regard to the Processing of Personal Data in the systems:

The systems of TPV are periodically checked for safety. In addition, the security policy of TPV provides internal processes to identify vulnerabilities.