Supplement to the list of processing activities pursuant to Art. 30(1) GDPR for ProCall

Product name

The product name "ProCall" used in this document refers to the products ProCall Business, ProCall Enterprise and ProCall DataCenter. Product-specific limitations or enhancements are described with the specific product name. This document does not refer to ProCall One.

1 Foreword

This document is intended to assist companies using ProCall software. The compiled information is intended to facilitate the preparation of a list of processing activities pursuant to Article 30(1) of the GDPR. It does not constitute legally binding information.
Such a list must contain all the details listed in Art. 30(1) sentence 2 lit. (a-g) GDPR. This information must give a meaningful description of the processing activities of the person responsible.
The preparation of records of processing activities does not in any way fulfill all the documentation requirements necessary by the GDPR. The list is only one building block in order to comply with the standardized accountability in Art. 5(2) GDPR. For example, the Conditions for consent (Art. 7(1) GDPR), the Responsibility of the controller (Art. 24(1) GDPR) and the result of Data protection impact assessments (Art. 35(7) GDPR) must be carried out so that the appropriate documentation can be verified.
The chapters are structured according to the procedural subject matter. Each chapter contains pre-filled information relevant to ProCall 6 Enterprise.

2 Privacy-friendly default settings (Art. 25 GDPR)

ProCall Enterprise provides privacy-friendly default settings during the installation process. These can also be changed after the installation in the UCServer Administration:

ProCall Enterprise: Privacy-friendly default settings (Art. 25 GDPR)

3 Reasons for GDPR proceedings (Art. 12–23 GDPR)

• Latest date of collected data sets (date of issue):  _____________________
• Is the reason due to rights of access, rectification or objection?

Right of access (Art. 15(1) GDPR)

• Right of access by the data subject

  (search criteria used): <Name>, <First name>, <Address street>, <Address postcode/town>, <Telephone number>, <E-mail address> etc.

Rectification (Art. 16 GDPR)

• Which person has requested rectification 
  (search criteria used): <Name>, <First name>, <Address street>, <Address postcode/town>, <Telephone number>, <E-mail address> etc.

• Which personal data must be changed: 
  

  (search criteria used): <Name>, <First name>, <Address street>, <Address postcode/town>, <Telephone number>, <E-mail address> etc.

Objection (Art. 21 GDPR)

• Erasure/pseudonymization
  Art. 17 GDPR/Recital 26
• Restriction of the use of personal data
  Art. 18(3) GDPR/Recital 67

4 Rights of access, rectification or objection to processing

4.1 Rights of access (Art. 15(1) GDPR)

The information in this chapter provides information about the personal data processed in ProCall Enterprise.

4.1.1 Purpose and legal basis of the collection, processing or use

4.1.2 Categories of personal data being processed

Group description such as health data, credit data, etc.

F.x Favorites/Federation

H.x Journal

T.x Tasks

C.x Chat

L.x Logging/Tracing

4.1.3 Standard periods for the deletion of the data or for the examination of the deletion

Planned storage period if possible, otherwise the criteria for determining the storage period..

4.1.4 Origin of the data, where this has not been obtained by the data subject

The origin of personal data can be seen in the overview of contact details (Data source). The personal data/contact details can be accessed in the following areas (sequence no. from section 4.1.3):

• F.x: Favorites/Federation
• H.x: Journal
• T.x: Tasks
• C.x: Chat

4.2 Rectification (Art. 16 GDPR)

In ProCall Enterprise, contact details are managed centrally and can therefore be changed centrally. Any changes to personal data are then effective throughout the software. Please refer to 4.1.2 Categories of personal data that are processed to find out which personal data can be changed in the software. You will find the corresponding correction option in the UCServer administration:

Sample screenshot: UCServer Administration – User management – User/Modification of personal data

4.3 Objection

4.3.1 4.3.1 Erasure/Pseudonymization (Art. 17 GDPR)

Pseudonymisation is currently not planned in ProCall Enterprise. Individual users or a selection of users can be deleted via the UCServer administration:

Sample screenshot: UCServer Administration – User management – User/Deleting users

4.3.2 Restriction of processing (Art. 18(3) GDPR) 

ProCall Enterprise offers a number of ways to restrict the processing of personal data.
These are described in detail below.

4.3.2.1 Journal

The data in the journal databases can only be viewed by the administrator. Administrator access is necessary for problem analysis and statistical evaluation.

The logging of data for private calls is carried out according to rules that can be configured.

The user can mark calls as private. Lines can generally be marked as private.

Selected telephone lines/extensions can be excluded from logging.

4.3.2.2 Presence states

Presence states or a change history of presence states are not logged. A possibility for the evaluation of presence states is not provided.

In the sense of an implementation of individual agreements, the exchange of presence-relevant information can be configured in a differentiated way.

The establishment of the lowest common denominator on the subject of presence within an organization can be done on three levels:
1. Global
2. Group
3. User
The rights system is additive, that is, if a right is assigned at a higher level, it cannot be removed at a lower level.
The presence state "Inactive" is displayed on a workstation PC or smartphone app due to "inactivity" and can be deactivated centrally/server-side. You can find the configuration in the UCServer administration in settings under User Administration Profiles.

4.3.2.3 Telephone function "Hands-free mode“

If the telephone system’s CSTA interface provides the function "Switch to hands-free mode", this feature can be switched off via a compatible estos ECSTA middleware driver if necessary.

4.3.2.4 Telephone function "Switch-on function

"Switch-on" functions of telephone systems are generally not supported by the estos ECSTA middleware drivers.

4.3.2.5 Telephone function "Softphone conference“

An attention tone is played when entering and leaving a conference. 

4.3.2.6 Phone function "Prevent phone calls via TAPI".

Prevents calls from being made on the TAPI line. Calls can only be made via softphone. This ensures that employees cannot control their desk phone/end device in the office from a remote location (e.g. home office). This is to prevent, for example, that an incoming call is accidentally accepted on the TAPI line and other participants in the office room can accidentally or intentionally listen to a telephone conversation and possibly data of the caller.

4.3.2.7 Authorization levels

Users themselves can control what selected (contact) details and actions a ProCall Enterprise user may view and perform via global authorization levels:

• System-wide authorizations:
  If authorization is granted on a system-wide basis, it applies to all users of the system. These rights are assigned by the administrator. 
• Authorizations assigned to User Groups:
  If authorization is granted for groups, it applies to all users who are members of this group. These rights are assigned by the administrator.
• Authorizations assigned by the user:
  Each user can assign individual authorizations to other users. These permissions can also be viewed and modified by the administrator.

The following authorization levels can be used to restrict the processing of personal data by ProCall Enterprise users as follows:

5 Evidence of suitable technical and organizational measures according to Art. 24(1) and Art. 32 GDPR

Here, the necessary measures for the creation and verification of suitable technical and organizational measures according to Art. 24(1) and Art. 32 GPDR for the software ProCall Enterprise are described.

5.1 Confidentiality (Art. 32(1) lit. b GDPR)

5.1.1 Protection against unauthorized access/access controls

5.1.2 Access control (use of system)

5.1.3 Access control 

5.1.4 Separation control

5.1.5 Pseudonymization

5.2 Integrity (Art. 32(1) lit. b GDPR)

5.2.1 Transfer control

5.2.2 Input control

5.3 Availability and resilience

5.3.1 Availability control

5.3.2 Recoverability

5.4 Procedure for regular verification, assessment, evaluation (Art. 32(1) (d) of the GDPR, Art. 25(1) GDPR)

5.4.1 Verification control

6 Hybrid cloud building blocks

Further information on our hybrid cloud building blocks can be found on the internet at
https://www.estos.com/products/ucconnect

Additional information

For further information about estos, e.g. about our products, services, data protection guidelines, code of conduct, can be found on our website. www.estos.de or www.estos.com