Technical Aspects of Personal Data Security

This document summarizes the technical measures ensuring the security of personal data and the protection of data subjects' rights at ZONER a.s. data centers.

All data centers used by Zoner have physical access controlled by a chip card. The facilities are monitored by security 24/7, and individuals entering the data center facilities are logged at the reception. Chip cards are not issued to third parties, and access and handling of technical equipment is strictly supervised by an authorized employee of Zoner.

The primary data centers (Brno Traťová, Brno Nové sady) and the secondary data center (Brno Kovoterm) are interconnected via fiber optic cables exclusively leased by Zoner. Therefore, the internal operations between data centers are protected against data leakage through physical separation from external networks.

The clustered infrastructure used for cloud and web hosting services is built exclusively on top-tier platforms VMware vSphere and Microsoft Hyper-V. These platforms ensure the highest possible security for virtual servers available on the market for virtualization solutions. Network traffic is divided for security and data protection into independent logical networks (VLANs). The management of the entire infrastructure is also separated from customer data traffic by logical networks. Data of virtual servers are stored on several central network storage systems of the type SAN (Storage Area Network). The SAN network is physically separated from other networks, making the data completely inaccessible from the external network environment.

Data backup for virtual servers is done over an independent SAN network or through a dedicated separated VLAN. The transfer of backups to a secondary location is done through the aforementioned optical connection. To further enhance data protection on Linux and VMware platforms, backups are transferred encrypted, and the backup software accesses the servers via a private key authentication mechanism. Access to backup servers and backups is exclusively granted to authorized employees of Zoner. Backed-up data is not transferred outside the mentioned data centers.

In the event of service termination or virtual server shutdown, all data will be deleted from the data storage and backup systems in accordance with legal requirements and deadlines. When replacing disks or disposing of retired hardware, all disks are checked and wiped by an authorized employee.

From the above, it is evident that ZONER a.s. is a processor providing sufficient guarantees by implementing appropriate technical and organizational measures to ensure that the processing meets the requirements of the EU General Regulation on Personal Data Protection 2016/679 known as GDPR and to ensure the protection of the rights of the data subject. The controller that chose ZONER a.s. as the processor has fulfilled this obligation set out in Article 27(1) of the EU General Regulation on Personal Data Protection 2016/679.

This document is effective from May 25, 2018

Last updated: March 23, 2018