VeraSafe's Privacy Program Certification Criteria

1. The VeraSafe Privacy Program Certification Criteria establish a baseline of data protection controls and fair information practices that must be implemented by Participants of the VeraSafe Privacy Program. The Program Criteria are based on prominent privacy legislation and various related frameworks, such as the EU General Data Protection Regulation (GDPR), the Data Privacy Framework and its extensions, the National Institute of Standards and Technology Cybersecurity Framework, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the California Online Privacy Protection Act, the APEC Cross Border Privacy Rules, and the FTC Fair Information Practice Principles.
2. For a Participant to become certified in the Program, it must be a private body (i.e., not a government agency), and must satisfy these Program Criteria, pass the Verification Process as described in these Program Criteria, and attest to its compliance with these Program Criteria. Statements that a Participant publishes regarding its data governance and data security practices are enforceable by law in the United States and may be enforceable by relevant data protection or consumer protection authorities in other jurisdictions.
3. VeraSafe will issue its Privacy Seal to a Participant of the Program that successfully passes the Verification Process, attests to its compliance with these Program Criteria and is in good standing in the Program. Any Data Subject who believes that a Participant has failed to abide by these Program Criteria, can send a complaint to VeraSafe per the terms of the applicable VeraSafe dispute resolution procedure.

The following definitions apply to these Program Criteria:

1. “Basis for Processing” means those grounds, as applicable, that are described in Section 3.1 and Section 3.2.
2. “Commercial Email Message” means an email message that advertises or promotes a commercial product or service, including content on a website operated for a commercial purpose.
3. “Consent” means a freely given, specific, and informed indication of authorization by the Data Subject (which, in the context of this definition, shall mean the parent or legal guardian of a Data Subject where the Data Subject is under the age of thirteen), either by a statement or by a clear affirmative action by the Data Subject, ensuring that the Data Subject is aware that they give their consent to the Processing of PII, including by ticking a box or by any other statement or conduct which clearly indicates, in the context, the Data Subject’s agreement to the proposed Processing of their PII.
   1. Silence or inactivity of the Data Subject does not constitute valid Consent.
   2. The Data Controller must document the Consent provided by the Data Subject in sufficient detail to confirm the validity of the Consent and the specific purposes of Processing for which the Consent was provided by the Data Subject.
   3. It must be as easy for the Data Subject to withdraw Consent as it was for the Data Subject to give Consent.
   4. If the Data Subject’s Consent is obtained in the context of a written document which also concerns other matters, the request for Consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear language that a reasonable person would comprehend.
4. “Data Breach” means the accidental, unlawful, or otherwise prohibited destruction, loss, alteration, unauthorized disclosure of, or access to, PII undergoing Processing.
5. “Data Controller” means a natural or legal person, public authority, agency, or any other body that, alone or jointly with others, determines the purposes and means of the Processing of PII.
6. “Data Privacy Framework” means the Data Privacy Framework and its approved extensions, which is a binding framework for data protection promulgated by the U.S. Department of Commerce and participating jurisdictions like the EU that regulates how participating U.S. companies Process PII.
7. “Data Privacy Framework List” means the publicly available list, maintained by the U.S. Department of Commerce, of organizations that have notified the U.S. Department of Commerce that they comply with the EU-U.S. Data Privacy Framework.
8. “Data Privacy Framework Principles” means the list of requirements necessary for compliance with the Data Privacy Framework as set forth at: https://www.dataprivacyframework.gov/
9. “Data Processor” means a natural or legal person, public authority, agency, or any other body that Processes PII on behalf of a Data Controller.
10. “Data Subject” means a natural person that is described by PII.
11. “Information Society Service” means any data Processing service provided upon request, by electronic means, and without the need for the service provider and requestor to be simultaneously physically present in a single location.
12. “IT System” means any electronic data Processing equipment, system(s), or subsystem(s) within the Scope of the Certification.
13. “Participant” means the natural person, business, or other private legal entity that has entered into an agreement with VeraSafe to participate in the Program and certify its compliance with these Program Criteria.
14. “PII” means any data, information, or combination of data and information that can be used to identify or locate a specific individual natural person. This includes names, contact information, Social Security numbers and other national identification numbers, precise location data, and other individually identifiable data. PII does not include data or information that is manifestly made public at the will of the Data Subject.
15. “Privacy Notice” means the fair processing information provided by the Participant to Data Subjects, particularly pursuant to Section 2 of the Program Criteria. A compliant Privacy Notice may be provided in up to three non-contradictory layers, such as:
    1. a single comprehensive notice of the Participant’s data Processing practices that, by and of itself, satisfies the requirements of Section 2 of the Program Criteria; and
    2. a summary notice highlighting the Participant’s data Processing practices, and which provides a link to the comprehensive Privacy Notice; and
    3. disclosure of specific data Processing practices, posted at the point of PII collection.
16. “Privacy Seal” means the VeraSafe privacy seal(s) in digital form, as shown in the VeraSafe user control panel.
17. “Procedure” means the VeraSafe Data Privacy Framework, Privacy Shield, and Safe Harbor Dispute Resolution Procedure or the VeraSafe Dispute Resolution Procedure, as applicable.” (See 1.1 at https://verasafe.com/public-resources/dispute-resolution/dispute-resolution-procedure/).
18. “Process” means any operation or set of operations which is performed on PII, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
19. “Program” means the VeraSafe Privacy Program.
20. “Program Criteria” means these VeraSafe Privacy Program Certification Criteria.
21. “Relationship Message” means an email message, the primary purpose of which:
    1. is to facilitate, complete or confirm a commercial transaction that the Data Subject has previously agreed to enter into with the Participant; or
    2. is to provide warranty or product recall, safety, or security information about a product or service purchased by the Data Subject; or
    3. pertains to subscription, membership, or other types of ongoing relationships; or
    4. pertains to an existing employment relationship; or
    5. pertains to the delivery of goods or services including product upgrades which the Data Subject is entitled to receive based upon a prior commercial relationship with the Participant.
22. “Secured Facility(s)” means the physical premises and the interior of a structure (or structures) to which the physical security controls are applied.
23. “Security Incident” means any attempted or actual Data Breach(es).
24. “Sensitive PII” means PII that describes or pertains to race or ethnic origin, political opinions, religion or beliefs, trade-union membership, genetics or data concerning health, sexual orientation, sex life, or criminal convictions as well as any data received from a Third Party where the Third Party treats and identifies it as Sensitive PII. Sensitive PII does not include data or information that is manifestly made public at the will of the Data Subject.
25. “Third Party” means any entity that is not the Participant or the Data Subject.
26. “Verification Process” means VeraSafe’s observations, automated security scans, manual security evaluations and checks, evaluation of a Participant’s questionnaire and survey responses, VeraSafe’s independent verification of certain questionnaire and/or survey responses, and VeraSafe’s analysis of documents provided by the Participant, which collectively are used to verify a Participant’s compliance with the Program Criteria.
27. “Vital Interests” means matters of life and death.
28. “Workstation” means an electronic computing device and the electronic media stored in its immediate environment, for example, a laptop computer, desktop computer, smartphone, or any other device that performs similar functions, typically for one user at a time, and which Processes or which may be used to Process PII.

1. Scope Of The Certification

1.1. The scope of each Participant’s certification in the Program, to which the Program Criteria will be binding (hereinafter “Scope of the Certification”), must be clearly defined by the Participant.

1.2. The Scope of the Certification shall be foremost defined in terms of specific information system(s).

1. The Program Criteria are, therefore, applicable to the people, processes, hardware, software, and networks that comprise those information systems in the Scope of the Certification.

1.3. Data Controllership. For each information system within the Scope of the Certification, it must be defined whether the Participant is a Data Controller or a Data Processor.

1. If a Participant acts in two separate capacities (i.e., Data Controller and Data Processor) within the same information system, the circumstances of each role must be defined.

2. Notice

2.1 Participants must implement, maintain, and publish a Privacy Notice(s) that complies with these Program Criteria.

1. The Privacy Notice(s) may be provided in a single document, or a series of compatible, layered Privacy Notices.
2. Multiple information systems in the Scope of the Certification may share a single (or a series of layered) Privacy Notice(s), insofar as the Program Criteria are satisfied for every information system contemplated by such Privacy Notice(s).

2.2 Required Privacy Notice Elements for Data Processors. Where the Participant is a Data Processor, that Participant’s Privacy Notice(s) must:

1. be furnished to the Data Subject or be conspicuously displayed by the Participant; and
2. be presented in a legible format; and
3. be materially correct and up to date; and
4. state the date that the Privacy Notice came into effect (or was last materially revised, whichever is later); and
5. be written in clear language that a reasonable person would comprehend; and
6. be made available in the language(s) in which the Participant usually conducts its affairs; and
7. include a title containing the word “privacy” (such as “Privacy Policy,” “Privacy Notice,” et cetera); and
8. state the full legal name of the Participant; and
9. state the information systems to which the Privacy Notice applies; and
10. with regards to the information systems mentioned in point (i) of this Section, state the Participant’s role as defined in Section 1.3 above; and
11. state any subsidiary entities of the Participant that are included within the Scope of the Certification and to which the Privacy Notice also applies; and
12. state the categories of PII that the Participant Processes; and
13. state the categories of ways in which the Participant receives or collects PII; and
14. state the specific, limited purpose(s) for which the Participant does or intends to Process PII; and
15. state the Basis for Processing the PII and, where the Participant Processes PII on the basis of Section 3.1(a)(5), list the specific legitimate interests that are pursued; and
16. provide the categories, or the identities, of Third Parties to which the Participant does or intends to disclose PII; and
17. disclose, if applicable, that the Participant intends to transfer PII onward to a third country; and
18. disclose all applicable Choice, Access, and Privacy of Children rights of the Data Subject as described in Sections 5, 6, and 10 respectively, and how a Data Subject (or the parent or legal guardian of a Data Subject under the age of thirteen) may exercise those rights; and
19. disclose the Participant’s policy for deleting PII after such time as the purpose or Basis for Processing of such PII becomes obsolete; and
20. where the information system(s) disclosed pursuant to 2.2(i) include an Information Society Service and where the Participant collects PII pertaining to a Data Subject’s Internet activities over time and across Third Party Information Society Services, (for example, through the use of HTTP cookies, web beacons, locally shared objects, device recognition technologies, or similar technologies, collectively “Cookies”) disclose how, if at all, the Participant’s Information Society Service responds to web browser tracking preference expressions, such as “Do Not Track”; and
    1. Notwithstanding the foregoing, Participant may alternatively include a clear and conspicuous hyperlink to an Internet website containing a description, including the effects, of any program or protocol the Participant follows that offers Data Subjects the option to prevent such data collection.
21. state that the Participant has implemented and will maintain reasonable security controls to protect the confidentiality, integrity, and availability of PII it Processes; and
22. state that, if the Participant makes PII available to a Third Party, such Third Party will be required to implement and maintain reasonable security controls to protect the confidentiality, integrity, and availability of such PII; and
23. disclose that PII Processed by the Participant may be transferred to Third Parties pursuant to lawful requests by public authorities, including national security and/or law enforcement requests, and that Section 2.2(v) may not apply to such transfers; and
24. state how to contact the Participant with any inquiries or complaints, including at least a current and valid mailing address, email address, toll-free telephone number or toll-free fax number; and
25. state the name or title, and business contact information, of a natural person appointed by the Participant, such as a competent data protection officer, to respond to data protection related inquiries and complaints lodged by Data Subjects; and
26. state the maximum number of days it will take the Participant to respond to data protection related inquiries or complaints received from Data Subjects; and
27. disclose the Participant’s procedure for notifying Data Subjects of a change in the respective Privacy Notice; and
28. disclose any particular consumer protection agency that regulates the Participant’s Processing of PII; and
29. disclose that VeraSafe is designated to address privacy complaints lodged against the Participant and, subject to the terms and conditions of the applicable VeraSafe dispute resolution Procedure, will provide appropriate recourse free of charge to Data Subjects.

2.3 Supplemental Privacy Notice Elements for Data Controllers. Where the Participant is a Data Controller, that Participant’s Privacy Notice must comply with the Privacy Notice requirements for Data Processors in Section 2.2 above, and must also:

1. where the information system(s) disclosed pursuant to 2.2(i) includes an Information Society Service, disclose, if applicable, that Cookies are used by the Participant and/or Third Parties to collect the Data Subject’s PII via the Participant’s Information Society Service, the particular types of Cookies used, and the purposes for which the PII collected by such Cookies is or will be used; and
2. where the Participant receives PII from a source other than the Data Subject, disclose from which source(s) (or categories of sources) the PII was obtained and, if applicable, that the PII was obtained from publicly accessible sources; and
3. where the Participant receives PII directly from the Data Subject, be made available to the Data Subject when the Participant first solicits or receives PII from the Data Subject, or as soon as practicable thereafter, and in any case before the Participant discloses such PII to any Third Party; and
4. where the Participant receives PII from a source other than the Data Subject, be made available to the Data Subject within a reasonable period (not more than thirty days) after receiving the PII.

2.4 Supplemental Privacy Notice Elements for Participants That Adhere to the Data Privacy Framework. Where the Participant is a U.S. entity and intends to certify its adherence to the Data Privacy Framework, that Participant’s Privacy Notice must also:

1. include the Participant’s commitment to adhere to the applicable Data Privacy Framework, as applicable,; and
2. include the Participant’s commitment to apply the Data Privacy Framework, as applicable, to all PII it receives in reliance on the Data Privacy Framework, as applicable; and
3. provide a link to, or the website address for, the Data Privacy Framework, as applicable; and
4. disclose, if applicable, that the Participant has agreed to cooperate and comply with the dispute resolution panel established by the European Data Protection Authorities in addition to the VeraSafe Dispute Resolution Procedure; and
5. disclose the possibility, under certain conditions, for the Data Subject to invoke binding arbitration as described in the Data Privacy Framework, as applicable; and
6. disclose the Participant’s liability in cases of onward transfers to Third Parties.

2.5 Notice Requirements for Changes in Data Processing Procedures. Prior to making any material changes to its Privacy Notice, a Participant must:

1. notify VeraSafe of the proposed change(s); and
2. receive approval from VeraSafe prior to implementing the proposed change(s).

2.6 Subject to the applicable terms of any commercial agreement between VeraSafe and the Participant, the Participant must display the VeraSafe Privacy Seal on or within its Internet-based Information Society Services that are within the Scope of the Certification.

3. Basis For Processing PII

3.1 Where the Participant is a Data Controller that Participant may Process PII

1. only on the basis of:
   1. the valid Consent of the Data Subject; or
   2. the performance of a contract to which the Data Subject is party; or
   3. the necessity to comply with a legal obligation to which the Data Controller is subject; or
   4. the protection of the Vital Interests of the Data Subject or of another natural person; or
   5. the legitimate interests pursued by the Participant or by a third party, except where such interests are outweighed by the interests or fundamental rights and freedoms of the Data Subject which require protection of PII, in particular where the Data Subject is under the age of thirteen; or
   6. the need to erase such PII where the Basis for Processing is otherwise obsolete; and
2. only for the specific, limited purposes disclosed in the Privacy Notice applicable to the collection of such PII and for other purposes which are compatible with those disclosed purposes, or:
   1. for other purposes pursuant to the further Consent of the Data Subject; or
   2. for those purposes strictly necessary to protect the Vital Interests of the Data Subject or of another natural person.

3.2 Notwithstanding the obligations of Section 3.1(a), where the Participant is a Data Controller, that Participant may only Process Sensitive PII on the basis of:

1. the valid Consent of the Data Subject; or
2. the protection of the Vital Interests of the Data Subject or of another natural person; or
3. the need to establish, exercise or defend a legal claim(s); or
4. the need to provide healthcare treatment, subject to all applicable laws regulating the privacy of PII concerning health; or
5. the need of the Participant to carry out its obligations or to exercise specific rights in the field of employment law; or
6. the need to erase such Sensitive PII where the Basis for Processing is otherwise obsolete.

3.3 Where the Participant is a Data Controller, that Participant must not condition the provision of goods or services on the Data Subject providing more PII than what is reasonably necessary for the purposes of Processing.

3.4 Where the Participant is a Data Processor, that Participant may not Process PII beyond as specified in the applicable data processing agreement implemented between the Participant and the Data Controller or between the Participant and another Data Processor acting on behalf of the Data Controller.

4. Onward Transfer

4.1 Subject to the limitations of Section 3:

1. Where the Participant wishes to transfer or make available PII to an entity to which the Program Criteria do not apply, it may do so only where:
   1. the Data Subject has provided Consent to the proposed transfer, after having been informed of the risks of such transfers, such as those arising from the recipient’s inadequate level of data protection; or
   2. the transfer is necessary for the performance of a contract between the Data Subject and the Data Controller; or
   3. the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between the Data Controller and another natural or legal person; or
   4. the transfer is necessary for the establishment, exercise, or defense of important legal claims; or
   5. the transfer is necessary in order to protect the Vital Interests of the Data Subject or of another natural person, and where the Data Subject is physically or legally incapable of giving Consent; or
   6. the transfer is necessary to comply with lawful requests by public authorities, including national security or law enforcement requests.
2. Where none of the circumstances in Section 4.1(a) apply, the transfer shall be permissible if the Third Party recipient is obligated to provide at least the same level of data protection as is required by the Program Criteria (either by way of an enforceable written contract, Binding Corporate Rules as defined by the General Data Protection Regulation of the European Union, applicable law, or participation in a binding self-regulatory scheme).

4.2 Contract for Onward Transfers to Data Controllers. Subject to the limitations of Section 4.1, for a Participant to transfer PII to a Third Party Data Controller, the Participant must first, whenever reasonably possible under the circumstances:

1. enter into an enforceable written contract with the Third Party that restricts the Third Party to Processing the PII only for purposes compatible with the limited and specific purpose(s) for which the PII was originally collected, or with the further Consent of the Data Subject;
2. ascertain that the Third Party is obligated to provide at least the same level of data protection as is required by the Program Criteria, either by way of an enforceable written contract, Binding Corporate Rules, applicable law, or participation in a binding self-regulatory scheme; and
3. obligate the Third Party to notify the Participant if the Third Party becomes unable to satisfy its obligations referred to in Section 4.2(b) above.

4.3 Contract for Onward Transfers to Data Processors. For a Participant to transfer PII to a Third Party Data Processor for Processing on behalf of the Participant, the Participant must, in addition to the obligations in Section 4.2:

1. ascertain that the Third Party employs only staff who have committed themselves to confidentiality or are under a statutory obligation of confidentiality; and
2. take reasonable steps to confirm that the Third Party Processes the PII in a manner consistent with its obligations referred to in Section 4.2(b) and 4.3(a) above; and
3. obligate the Third Party to notify the Participant if the Third Party becomes unable to satisfy its obligations referred to in Section 4.2(b) and 4.3(a) above; and
4. take reasonable steps to stop and remediate unauthorized or noncompliant Processing by the Third Party, upon becoming aware of such Processing.

5. Choice

5.1 Right to Object. Where the Participant is a Data Controller, Data Subjects have a right to object to the Participant’s continued Processing of the Data Subject’s PII where the Basis for Processing such PII is:

1. the Consent of the Data Subject;
2. the Vital Interests of the Data Subject or of another natural person;
3. the legitimate interests pursued by the Participant or by a third party, except in cases where the Participant can articulate that such Processing is lawful, done for explicitly specified and limited purposes, and is based on real and present legitimate interest(s), and that such interest(s) pursued by the Participant or by a third party outweigh the legitimate interests, rights, and freedoms of the Data Subject.

5.2 Notwithstanding the foregoing, where the Participant is a Data Controller and Processes PII for the purpose of direct marketing, the Data Subject shall have the unalienable right to object to such Processing without paying any fee. Where an objection is made by a Data Subject in accordance with this Section, the Participant may no longer Process the Data Subject’s PII for such direct marketing purposes.

5.3 Where an objection is made by a Data Subject in accordance with Section 5.1 points (a) through (c), the Participant in question may no longer rely on the demurred Basis for Processing, and if no other Basis for Processing exists, the Participant may no longer Process such PII except as strictly necessary to comply with and implement the objection of the Data Subject.

5.4 Where the Participant is a Data Controller and Processes PII on the potentially objectable bases identified in Section 5.1 points (a) through (c), that Participant must provide Data Subjects one or more easy to use, conspicuous, readily available, and affordable means to object to such Processing of their PII.

5.5 The Data Subject’s right to object, as established by this Section, is subject to reasonable limits, such as to allow the Participant the opportunity to authenticate the identity of the Data Subject, and to allow the Participant a reasonable amount of time to implement the Data Subject’s wishes.

5.6 Where the Participant is a Data Controller, that Participant is responsible for ensuring the implementation of the Data Subject’s wishes so exercised under this Section, including in the information systems of the Data Processors engaged by the Participant, unless doing so is not reasonably possible, would require disproportionate effort, or where such responsibility is formally assigned to a third party that is, along with the Participant, a joint Data Controller for the Data Subject’s PII.

6. Access

6.1 Right of Access to and Correction of PII. Where the Participant is a Data Controller, Data Subjects have a right to:

1. obtain from the Participant confirmation of whether or not the Participant is Processing the Data Subject’s PII; and
2. have communicated to them any such PII in a format that would be intelligible to a reasonable person, with regard given to, in particular, the age of the Data Subject; and
3. be told the source(s) from which the Participant obtained their PII, or any pertinent, available information as to the source of the PII; and
4. be told the Third Parties, or categories of Third Parties, to whom the Participant has disclosed or intends to disclose their PII; and
5. be told the purposes for which their PII has been or will be Processed, either by the Participant or any Third Party acting as the Participant’s Data Processor; and
6. have their PII corrected or amended where it is inaccurate or incomplete.

6.2 Right to Erasure. Where the Participant is a Data Controller, Data Subjects have a right to obtain the erasure of their PII:

1. in cases where such PII is incorrect; or
2. where the Participant’s Processing of such PII has materially violated the Program Criteria, applicable law(s), or applicable self-regulatory obligations; or
3. where the PII is no longer necessary for the purpose(s) of Processing or there is no longer a valid Basis for Processing; or
4. where the PII is collected via an Information Society Service and the Data Subject is under the age of thirteen.

6.3 Where the Participant is a Data Controller and the Participant has made a Data Subject’s PII public, the Data Subject has the right to request that the Participant take all reasonable steps, including technical measures, to inform Third Parties which are Processing such PII, of the Data Subject’s request to erase any copy or replication (and hyperlinks thereto) of such PII.

1. Where the Participant has authorized a Third Party publication of PII, the Participant shall remain responsible for that publication.

6.4 Limitations of the Right of Access, Correction, and Erasure.

1. Where the Participant is a Data Controller, that Participant must, at no charge to the Data Subject, implement the Data Subject’s wishes so exercised under this Section 6, except:
   1. where the burden or expense of implementation would be overwhelmingly disproportionate to the risks to the Data Subject’s privacy in the case in question; or
   2. where the Data Subject’s PII cannot reasonably be separated from confidential commercial information; or
   3. where the implementation would interfere with the execution or enforcement of the law or with private causes of action, including the prevention, investigation, or detection of criminal offenses or the right to a fair trial; or
   4. where the legitimate rights or important interests of others would be violated; or
   5. where the implementation would breach a legal or other professional privilege or obligation to which the Participant is subject; or
   6. where the Data Subject’s requests are vexatious or manifestly excessive, due in particular to their frequent or repetitive nature; or
   7. where the Processing of such PII is strictly necessary for historical, statistical, or scientific research purposes.
2. If a Participant determines that a Data Subject’s right of access, correction, or erasure should be limited in any particular instance, the Participant must respond to the Data Subject with an explanation of why the Participant has made such a determination and provide information as to where the Data Subject can lodge further inquiries.

6.5 Where the Participant is a Data Controller, that Participant must provide Data Subjects one or more easy to use, conspicuous, readily available, and affordable means to exercise their rights under this Section.

6.6 Participants must confirm the identity of persons attempting to exercise rights under this Section, and only implement a Data Subject’s wishes so exercised under this Section where the identity of such Data Subject has been adequately confirmed by the Participant.

6.7 Where the Participant is a Data Controller, that Participant is responsible for implementing the Data Subject’s wishes so exercised under this Section, including in the systems of the Data Processors engaged by the Participant, unless doing so is not reasonably possible or would require a level of effort that is overwhelmingly disproportionate to the risks to the Data Subject’s privacy in the case in question.

7. Data Security

7.1 Within the Scope of the Certification, Participants must comply with the requirements of this Section.

7.2 Identify.

1. Asset Management. [ID.AM]
   1. Maintain an inventory of the hardcopy and electronic records and the electronic devices and storage media that the Participant uses to Process PII.
   2. Identify and appoint one or more natural persons who are responsible for the development and implementation of the data security policies and procedures required by the Program Criteria.
2. Business Environment. [ID.BE] (Reserved)
3. Governance. [ID.GV]
   1. Implement and maintain a high-level data security policy.
4. Risk Assessment. [ID.RA]
   1. If the Participant’s workforce is comprised of 250 or more full-time equivalent employees, conduct an accurate and thorough assessment of the potential risks to the confidentiality, integrity, and availability of PII it Processes. Such assessment must:
      1. identify critical assets; and
      2. identify threats and vulnerabilities to those critical assets; and
      3. result in a formal, documented analysis of risk; and
      4. be conducted based on established frameworks or methodologies such as NIST SP 800-30, ISO 27005, FAIR, or OCTAVE.
5. Risk Management Strategy. [ID.RM]
   1. Implement data security controls that ensure an appropriate level of confidentiality, integrity, and availability for the PII that the Participant Processes. The Program Criteria set a baseline of required data security controls; however, additional data security controls may be needed to establish an appropriate level of data security under a Participant’s circumstances. In determining what is appropriate under the circumstances, regard should be given to the sensitivity of the PII, the purposes of Processing, the risks to the rights and freedoms of the Data Subject(s) that arise from such Processing, the cost of implementation and maintenance of such additional controls, and the consensus of professional opinion in the field of data security.

7.3 Protect.

1. Access Control. [PR.AC]
   1. Implement and maintain procedures to control and validate a person’s physical and logical access to the Secured Facility(s), the information system(s), and the PII therein based on role or function, including visitor control.
      1. All users of Participant’s information systems must be individually identified and authenticated.
      2. Restrict logical access to all Workstations, and administrator and non-consumer functions in other IT Systems, with a strong password known only to authorized users, whenever reasonably practicable.
      3. Implement and maintain appropriate entry controls to reasonably prevent unauthorized persons from physically accessing the Secured Facility(s). Such controls may include using locks and keys, badges and badge readers, key fobs, et cetera, as appropriate given the risks to the rights and freedoms of the Data Subjects presented by the Processing.
      4. Require visitors to sign-in, wear a plainly visible “Guest” ID badge, and be escorted by an authorized individual at all times in the Secured Facility(s).
   2. Implement and maintain policies and procedures for terminating access to the Secured Facility(s), the information systems, and the PII therein when an employee or contractor is separated from the Participant or when such access is no longer justifiable.
      1. Such policies must require that all of the Participant’s physical authentication methods are either returned by such employees and contractors, or are deactivated.
   3. Implement and maintain policies and procedures to authenticate and verify the identity of a user before granting the user’s request to modify any authentication credential, such as resetting a password.
   4. Implement and maintain policies and procedures to correctly authenticate and verify the identity of Data Subjects before granting such Data Subjects’ requests to exercise rights with regards to PII Processed by Participant.
      1. Participant must not rely on fewer than two unique identifiers in authenticating such Data Subjects.
   5. Implement and maintain policies and procedures to limit employees’ and contractors’ access to the Secured Facility(s), the information systems, and the PII therein to those natural persons with an identified, legitimate need for such access, incorporating the principle of least privilege.
      1. Regularly audit such privileged access rights (at least twice per year).
2. Awareness and Training. [PR.AT]
   1. Implement and maintain a data-security-training-program for all employees within the Scope of the Certification.
   2. Implement and maintain an ongoing data-security-awareness-program for all employees within the Scope of the Certification.
   3. Implement and maintain procedures for creating, changing, and safeguarding IT System passwords.
   4. Implement and maintain policies and procedures to mitigate risks that arise from unintentional insider threats.
3. Data Security. [PR.DS]
   1. Secure the transmission of PII and authentication information over non-private networks with strong cryptography and security protocols (such as recent Transportation Layer Security protocols) if the inappropriate use or disclosure of that data could cause financial, physical, or reputational harm to a Data Subject.
      1. Secure the transmission of PII and authentication information over wireless networks with strong cryptography and security protocols.
   2. Maintain (and implement as needed) procedures for securely disposing of PII when the Basis of Processing becomes obsolete.
   3. Implement and maintain policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical and technical attributes surrounding a specific Workstation or class of Workstations. Such policies and procedures must, at minimum:
      1. prohibit those software applications or categories of software applications that are likely to introduce a critical vulnerability, from being used or installed on the Workstations; and
      2. prohibit operating systems with unauthorized modifications (including rooted or jailbroken operating systems) from being used or installed on Workstations; and
      3. require users to re-authenticate to reactivate Workstations that have been idle for more than 15 minutes.
   4. Implement and maintain policies to regulate the removal of storage media containing PII from within the Secured Facility(s). Whenever reasonably practicable, such policies must:
      1. prohibit the removal of electronic storage media containing PII from within the Secured Facility(s), except for the occasional removal of PII done not on a large scale, or if such PII is encrypted with strong cryptography; and
      2. prohibit the removal of PII in hardcopy from within the Secured Facility(s), except if such PII is reasonably physically secured when outside of the Secured Facility(s).
   5. Implement and maintain policies and procedures to require that whole disc encryption, container-level encryption, or file-level encryption be used in portable Workstations and portable mass storage media, as appropriate, to secure PII and authentication information contained on those devices. In all such cases, the encryption must be cryptographically strong.
   6. Implement and maintain policies to require that Workstations, storage media containing PII, and authentication information be physically secured when not in use, both inside and outside of the Secured Facility(s).
   7. Implement and maintain appropriate technical controls to prevent, detect, and correct data integrity violations in IT Systems.
      1. Such controls may include checksums, mirroring, ECC memory, RAID parity, and file integrity monitoring tools.
   8. Implement and maintain policies, whenever possible, to prohibit the use of PII for information system testing or development purposes.
4. Information Protection Processes and Procedures. [PR.IP]
   1. Implement and maintain policies and procedures to ensure that vendor-supplied default passwords and other authentication parameters in IT System(s) are changed, removed, or disabled.
   2. Implement and maintain a binding confidentiality agreement with employees who are within the Scope of the Certification.
   3. Implement and maintain policies to apply appropriate sanctions against employees who fail to adhere to the Participant’s documented data security policies and procedures.
   4. Implement and maintain procedures to create and maintain retrievable exact copies of PII that the Participant stores or otherwise maintains.
   5. Implement and maintain appropriate environmental controls to protect the integrity and availability of mission critical information systems and PII that the Participant stores or otherwise maintains.
      1. Such controls may include emergency power supplies, emergency lighting, fire protection and suppression equipment, temperature and humidity controls, and measures to prevent water damage.
   6. Implement and maintain policies and procedures to ensure the removal of PII from storage media before such media are made available for re-use by the Participant.
   7. Implement and maintain policies and procedures to ensure the secure disposal of the media on which PII is or has been stored.
   8. Implement and maintain policies and procedures to detect technical security vulnerabilities in the IT Systems.
5. Maintenance. [PR.MA]
   1. Implement and maintain policies and procedures to patch exploitable and high severity security vulnerabilities that exist in IT Systems expeditiously after the discovery of such vulnerabilities.
      1. Such policies and procedures must require that vendor-supplied patches for exploitable and high severity IT System vulnerabilities be tested and applied to the affected IT Systems (or the vulnerability otherwise mitigated) within sixty days of the date on which the vendor released the patch.
   2. Implement and maintain policies and procedures to prohibit the use of deprecated software that is no longer updated by the author.
6. Protective Technology. [PR.PT]
   1. Limit repeated logical access attempts to IT System(s) by automatically locking out the user ID after not more than six consecutive failed access attempts.
      1. Set the lockout duration to a minimum of thirty minutes or until an administrator re-enables the user ID.
   2. Implement a functional firewall and maintain its configuration to protect the IT Systems from untrusted networks and untrusted traffic.

7.4 Detect.

1. Anomalies and Events. [DE.AE]
   1. Establish a baseline of network operations and expected data flows.
   2. Analyze suspected Security Incidents to understand attack targets and methods.
2. Security Continuous Monitoring. [DE.CM]
   1. Implement and maintain policies and procedures to monitor the Secured Facility(s) and the IT Systems to detect Security Incidents and associated activity.
      1. Implement and maintain hardware, software, and/or procedural mechanisms to record and monitor technical activity in the IT Systems.
      2. Implement and maintain mechanisms to monitor physical activity in the Secured Facility(s), including the physical activity of contractors and visitors.
   2. Deploy antivirus software on all IT Systems that are commonly affected by malicious software. Such antivirus software must:
      1. be regularly, frequently updated; and
      2. automatically scan the IT System(s) where it is deployed; and
      3. not be disabled on the IT System(s) where it is deployed.
3. Detection Processes. [DE.DP] (Reserved)

7.5 Respond.

1. Response Planning. [RS.RP]
   1. Implement and maintain policies and procedures to respond to suspected or known Security Incidents.
   2. Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that physically damages the Secured Facility(s) or the information system(s).
      1. Maintain (and implement as needed) procedures to ensure the continuation of those procedures that are necessary to protect the security of PII, while operating during an emergency.
      2. Maintain (and implement as needed) procedures for accessing PII during an emergency.
2. Data Breach Notification. [RS.CO]
   1. Where the Participant is a Data Controller, for any Data Breach in the Scope of the Certification, including in the information systems of the Participant’s Data Processors and subprocessors, that Participant must transmit the information described in Section 7.5(b)(2) (a “Notice of Data Breach”) to competent law enforcement agency(ies) and affected Data Subjects without delay and promptly after becoming aware of each such Data Breach, or do otherwise as required by law.
      1. Participant must promptly transmit its Notice of Data Breach to the competent law enforcement agency(ies), no later than seventy-two hours after becoming aware of such Data Breach.
      2. Unless a longer timeframe is officially requested by a competent law enforcement agency, the Participant must transmit its Notice of Data Breach to the Data Subjects no later than ten days after becoming aware of such Data Breach.
         1. Participant must provide its Notice of Data Breach to affected Data Subjects by way of its usual means of communicating with the Data Subjects, along with other means, if necessary.
         2. If performing the obligation of 7.5(b)(1)II would require a disproportionate effort (for example, costing the Participant more than the lesser of ten percent of global turnover or $250,000 USD) the Participant may satisfy the obligation of 7.5(b)(1)II by making a public notification or similar measure whereby the Data Subjects are notified in an equally effective manner.
   2. Unless otherwise required by applicable law, Participant’s Notice of Data Breach must:
      1. be titled “Notice of Data Breach”; and
      2. disclose that a Data Breach occurred; and
      3. disclose the categories of PII that were disclosed in the Data Breach; and
      4. disclose, if available, the approximate number of records that were exposed in the Data Breach; and
      5. disclose, if available, the approximate number of Data Subjects affected by the Data Breach; and
      6. disclose when the Data Breach occurred; and
      7. disclose what steps Data Subjects can take to protect themselves; and
      8. disclose likely consequences of the Data Breach; and
      9. disclose the actions the Participant is taking regarding the Data Breach including the steps the Participant is taking to reduce the risk of a repeated or sustained Data Breach; and
      10. disclose the name and contact information of a representative of the Participant who can provide additional information regarding the Data Breach;
      11. be written in the language(s) in which the Participant usually conducts its affairs; and
      12. be provided in written form (which may be electronic), using clear language that a reasonable person would comprehend.
   3. Where the Participant is a Data Processor, that Participant must transmit its Notice of Data Breach to the Data Controller(s) within 72 hours of becoming aware of each such Data Breach.
   4. The Participant must act immediately, without undue delay, to patch any unmitigated exploitable IT security vulnerabilities and reduce the risk of a repeat or sustained Data Breach upon becoming aware of a Data Breach.
   5. Participants must notify VeraSafe of the occurrence of a Data Breach no later than ten days from the date of discovery of the Data Breach unless a longer timeframe is officially requested by a competent law enforcement agency.
3. Analysis. [RS.AN]
   1. Implement and maintain policies and procedures to document Security Incidents and their outcomes.
4. Mitigation. [RS.MI]
   1. Implement and maintain policies and procedures to mitigate, to the extent practicable, harmful effects of Security Incidents that are known to the Participant.
5. Improvements. [RS.IM]
   1. Update policies and procedures based on lessons learned.

7.6 Recover.

1. Recovery Planning. [RC.RP]
   1. Maintain (and implement when needed) procedures to restore any unintentionally lost PII.
2. Improvements. [RC.IM] (Reserved)
3. Communications. [RC.CO] (Reserved)

8. Data Quality

8.1 Where the Participant is a Data Controller, that Participant must take all reasonable steps to ensure that, with regard to the risks to the rights and freedoms of the Data Subject(s), PII it Processes is sufficiently reliable, accurate, complete, and current and that PII that are inaccurate are erased or rectified without unreasonable delay.

9. Privacy By Default

9.1 Where the Participant is a Data Controller, that Participant must ensure that, by default, the PII it Processes is not made accessible, without the Data Subject’s intervention, to an indefinite number of natural or legal persons.

10. Privacy Of Children

10.1 Where the Participant is a Data Controller, that Participant must, where the Participant’s Scope of the Certification includes Information Society Services:

1. ensure that the Information Society Service is not directed at or intended for use by Data Subjects under the age of thirteen (“U13”); or
2. provide notice to parents or legal guardians of U13 (“Parent(s)”) and obtain verifiable parental consent, such as in the form of a consent agreement signed by the Parent and returned to the Participant before Processing the PII of U13; and
3. give Parent(s) the opportunity to terminate such consent agreement at any time; and
4. give Parent(s) the choice of consenting to the Participant’s internal Processing of their U13’s PII, while prohibiting the Participant from disclosing that PII to a Third Party Data Controller (unless such disclosure is strictly necessary for the purpose(s) of Processing, in which case this must be made clear to Parents); and
5. enable Parent(s) to exercise the rights described in Sections 5 and 6 on behalf of their U13.

10.2 Where the Participant is a Data Controller, and the Participant becomes aware that it Processes the PII of a U13 without complying with Section 10.1(b)-(e), that Participant must securely dispose of such PII.

11. Commercial Email Communication

11.1 Where the Participant is a Data Controller, and Processes PII for the purpose of sending Commercial Email Messages:

1. such Commercial Email Messages must include the Participant’s valid postal address which can be a current street address, a post office box registered with the U.S. Postal Service, a private mailbox registered with a commercial mail receiving agency established under U.S. Postal Service regulations or, for Participants whose principal office(s) are located outside of the U.S., a valid and current post office box registered with the local governmental authority responsible for postal matters; and
2. such Commercial Email Messages must include a clear and conspicuous, functioning and free unsubscribe mechanism. Such an unsubscribe mechanism must not require a Data Subject to give the Participant any PII beyond an email address, or make a Data Subject take any step other than sending a reply email or visiting a single page on a website as a condition for honoring an unsubscribe request. Participants must implement the Data Subject’s unsubscribe request within ten business days of receipt of such a request.
   1. An unsubscribe mechanism is not required for Relationship Messages and a Participant may continue to send Relationship Messages after a Data Subject unsubscribes from Commercial Email Messages provided that the Data Subject continues a business or employment relationship with the Participant.

11.2 If a Data Subject has unsubscribed to the Participant’s Commercial Email Messages, the Participant must not transfer that Data Subject’s email address to any Third Parties for their direct marketing use.

12. Recourse And Enforcement

12.1 Compliance Verification.

1. Participants must retain the records related to their compliance with the Program Criteria for at least six years from the date on which a record was created, or was last in effect, whichever is later.
2. Participants must regularly review their compliance with the applicable Privacy Notice(s) and these Program Criteria, and take remedial action, as appropriate, to ensure their ongoing compliance therewith.
3. Each Participant shall be subject to, and cooperate with, the Verification Process at least annually to verify its ongoing compliance with these Program Criteria.
4. The Verification Process can be re-initiated by VeraSafe at any time at VeraSafe’s discretion.

12.2 Recourse.

1. Where the Participant is a Data Controller, that Participant must respond to data protection related inquiries or complaints it receives from Data Subjects within thirty days of receipt by the Participant.
2. Participants must cooperate with VeraSafe’s efforts to investigate complaints pertaining to such Participant, that are determined to be valid and within the scope of these Program Criteria.
   1. Participants must cooperate and comply with the Procedure applicable to any such complaints.

12.3 Accountability.

1. In the event VeraSafe reasonably believes that a Participant has violated these Program Criteria or the applicable Master License and Services Agreement between VeraSafe and the Participant in a material way, such Participant’s good standing in the Program may be suspended (“Program Suspension”) by VeraSafe.
   1. In such circumstance, VeraSafe shall provide the suspended Participant with a description of the violation(s) and any remedial actions that VeraSafe will require the Participant to take during the Program Suspension period (“Program Suspension Obligations”).
   2. Participant’s participation in the Program shall be considered to be suspended immediately upon receiving notice to such effect from VeraSafe.
2. Program Suspension Obligations.
   1. Program Suspension Obligations may include, but are not limited to:
      1. implementation of additional data protection controls beyond those specified in the Program Criteria; and
      2. cooperation with additional compliance monitoring by VeraSafe; and
      3. payment to VeraSafe as compensation for VeraSafe’s additional compliance monitoring activities.
   2. Participants must comply with all Program Suspension Obligations within forty-five days of receiving the suspension notice, unless a longer duration is mutually agreed upon between VeraSafe and the Participant.
   3. During the Program Suspension period, Participant’s suspended status may be indicated via its VeraSafe instant verification page hosted by VeraSafe, and VeraSafe may revoke the Participant’s license to display the VeraSafe Privacy Seal(s).
3. Exiting Program Suspension.
   1. Program Suspension shall last until such time as the Participant has corrected the material violation(s) to VeraSafe’s satisfaction.
   2. If the Participant has not rectified the material violation(s) by the end of the Program Suspension period, VeraSafe will, in its discretion, either:
      1. extend the Program Suspension period; or
      2. determine that Participant has failed to comply with the Program Suspension Obligations and apply one or more Enforcement Actions (as defined in the Section 12.3(d)) against the Participant.
4. Enforcement Actions.
   1. Subject to the provisions of Section 12.3, VeraSafe may:
      1. terminate the Participant’s participation in the Program(s) (“Termination”); and
         1. Participants that are Terminated will no longer be entitled to use, reproduce, or display any of the VeraSafe Privacy Seals and must immediately stop all use of any VeraSafe Privacy Seal; and
         2. Participant’s participation in the Program shall be considered to be Terminated immediately upon receiving notice to such effect from VeraSafe; and
      2. notify the relevant regulatory enforcement authority in the Participant’s jurisdiction in cases where the Terminated Participant’s material violations are, in VeraSafe’s judgment, repeated or intentionally negligent; and
      3. make publicly available, a notice of the Terminated Participant’s material violation(s) in cases where such material violation(s), in VeraSafe’s judgment, constitute an ongoing risk to the rights and freedoms of Data Subjects; (“Enforcement Actions”).

13. Requirement For Neutrality

13.1 A Participant must not have a direct or indirect business affiliation with VeraSafe, or with any employee of VeraSafe, that would prejudice the ability of VeraSafe to render a fair decision with respect to the certification of the Participant. Such affiliations include but are not limited to the Participant and VeraSafe being under common control such that the Participant can exert undue influence in VeraSafe.