Where does Fotoware store data?

Fotoware Veloz is currently available in the following Microsoft Azure Regions:

• US East
• EU West
• Germany
• Australia East

Data will not be moved outside these regions.

Note: Under the General Data Protection Regulation, the EU/EEA is defined as a single zone, which means that a data center within the EU is sufficient to meet the GDPR requirements. However, German law dictates that certain businesses must host their data in a German data center, in which case data can be stored in a German Azure data center.

How does Fotoware safeguard customer data in its operational systems?

Fotoware stores all data from its operational systems on Fotoware's own servers in the Azure cloud or on Azure PaaS Services.

More information on Azure security can be found in Microsoft's documentation: https://www.microsoft.com/en-us/trustcenter/security/azure-security

We also use several subprocessors to provide supportive services for our SaaS offering, including email services and the services used to operate our customer support center. Your rights of access, erasure, and portability under GDPR are maintained through your contract with Fotoware.

We are also in the process of implementing a complete security review routine, which will be reviewed and updated regularly to keep us on top of security matters.

How does Fotoware secure customer and user data in the SaaS offering?

Fotoware Veloz runs on the Microsoft Azure cloud platform. Fotoware Veloz customers who upload data to the tenant can rest assured that the data is encrypted in transit and at rest.

If a customer wishes to assign a custom domain name to the tenant, we will assist in installing a trusted certificate on the server infrastructure for secure, encrypted client-server connections. In addition, data is encrypted on the Azure Cloud when it is committed to storage. When the data is requested, it is decrypted on demand.

Additional information on encryption for data at rest can be found in the Microsoft Azure documentation.

Is data replicated?

Yes, all data that is stored on the Azure cloud is made redundant. The data you upload to your Fotoware Veloz site is, therefore, replicated in multiple copies to prevent data loss in the event of hardware failure.

Can anyone at Fotoware see my data?

Fotoware support personnel have access to the server infrastructure and, as such, can access your data from a technical standpoint. However, Fotoware has strict routines and enforces auditing and logging of access to prevent unauthorized access. In cases where the customer has approved such access, for example, in a troubleshooting scenario, explicit consent will be obtained. Fotoware enforces strict access control to both its internal systems and its customers' cloud tenants. We maintain administrative, physical, and technical safeguards to protect our customers' data security, confidentiality, and integrity. These include, but are not limited to, measures for preventing access, use, modification, or disclosure of customer data except for the purpose of providing Fotoware's services and preventing or addressing technical problems.

The Data Discipline Declaration signed by all employees states that data must only be used for the purpose for which they were collected and only for purposes for which users have been given consent by the customer/partner. Fotoware will ensure that access to systems that expose customer data is limited, logged, and audited so we can tell who accessed the server, at what time, and for what purpose. In the event of infrastructure maintenance, Fotoware will inform all affected customers by email about the allotted service window in advance.

The main takeaway is that we always ask for consent before accessing your personal data.

What happens to my data if I cancel my Fotoware Veloz subscription?

We would be sorry to see you go, naturally. But we'll do our best to make your data migration as smooth as possible. We will help you move your data to a server of your choice. Typically, this involves setting up an FTP connection or other means of transfer. After transferring your data, we will delete the tenant and erase all the data you had on our servers.

Will Fotoware help me delete data when a user wants to be erased?

Yes, and we have an obligation to do so under GDPR. That said, customers can easily retrieve data in the SaaS tenant themselves by searching for, retrieving, and deleting content. Typically, one would ensure that data fed into the system has sufficient metadata governance to facilitate easy retrieval. This is the nature of a Digital Asset Management system such as Fotoware. By default, data can only be deleted by archive managers (members of the FotoWeb DAM Managers group). Fotoware can also assist in retrieving data by offering guidance on search methods, given that the metadata stored with the assets is sufficient to retrieve them. Fotoware support engineers, who will typically be involved in such an undertaking, will not access your data or modify or delete it without your explicit prior consent.

Typically, though, Fotoware will assist the customer in implementing a metadata governance scheme at the time of deployment of the service so that customers can themselves perform data retrieval and deletion without requiring the assistance of Fotoware.

What does Fotoware do to prevent a potential data breach?

No organization ever wants to face a data breach, but we recognize the importance of having clear guidelines in place should one occur. Protecting our customers' privacy is at the core of our business. For this reason, we design all our solutions with privacy in mind - following the principle of Privacy by Design - to ensure that the impact of any potential breach is kept to an absolute minimum. When we design new features, data privacy protection is a central part of the planning and development process.

We also continuously refine our routines to respond effectively to the possibility of a breach. While we already have data security assessment procedures in place, we are aligning these with GDPR by implementing a fully compliant security review. 

While we currently have data security assessment routines in place, we are bringing these in line with GDPR by implementing a fully GDPR-compliant security review. This ensures we remain proactive and aware of areas where further improvements can be made.