Question 1

When it comes to customer data, is Phocas a controller or a processer?

Accepted Answer

Under the GDPR, a “controller” determines why and how personal data is processed. A “processor” processes personal data on behalf of the controller. Phocas has limited knowledge of the data that each customer processes via the hosting infrastructure (“Customer Data”). Also, Phocas only processes Customer Data in accordance with the customer’s instructions. Therefore, Phocas is a processor of Customer Data hosted on our servers; the customer is a controller. We will continue to process personal data only in accordance with your instructions.

Question 2

Does GDPR change the way Phocas treats customer data?

Accepted Answer

Phocas continues to treat customer data with the required level of sensitivity and confidentiality. Phocas uses Rackspace, one of the leading cloud service providers, as its sub processor. Learn more about the Rackspace security practices at https://www.rackspace.com/compliance.

Phocas will continue to invest in the security of its customer solutions to ensure it remains compliant with applicable legislation.

Question 3

Under GDPR regulations, can an EU customer host personal data outside of the EU/EEA?

Accepted Answer

Provided certain legal mechanisms are in place, EU customers can host personal data outside of the EU. Personal data may be transferred outside of the EU and the EEA when an adequate level of protection for that data is guaranteed.

To help achieve this level of protection Phocas uses AWS and Rackspace as its sub-processors for cloud provision. AWS and Rackspace ensure adequate safeguards are in place, including entering Standard Contractual Clauses 2010/87/EU, approved by the European Commission, with third party recipients.

Please contact your account manager if you need a Rackspace Data Processing Addendum that includes EU Standard Contractual Clauses.

Question 4

Won’t I be in breach of the data protection laws if Phocas transfers my personal data outside the EU/EEA?

Accepted Answer

The current laws allow Phocas and its sub-processors to process personal data and therefore support your services from outside the EEA if you have given us your consent, or if data is transferred to a non-EU jurisdiction deemed by the European Commission to offer an adequate level of protection for personal data, or if the transfer is subject to model contracts.

Question 5

Can you keep my data in the EU only?

Accepted Answer

Phocas is able to offer high quality support by operating a 24/7 "follow the sun" support model that leverages our support consultants in the countries where we operate. Therefore sometimes we will need to provide you with support from outside the EU. We comply at all times with applicable laws.

Transfers of personal data originating from other locations globally to Phocas affiliates are subject to the terms of the intra-company data processing agreement which requires all transfers of personal data to be made in compliance with applicable Phocas security and data privacy policies and standards.

Question 6

Will the Data Protection laws/GDPR apply when Britain leaves the EU?

Accepted Answer

The Information Commissioner has confirmed that the U.K. will comply with the GDPR to enable it do business in Europe.

Question 7

Do you have other data centres within the EU where I can store my data?

Accepted Answer

Yes, Phocas can provide servers in the EU. Because Phocas has customers throughout the world in different timezones it enables us to optimise the use of our servers because different timezones put load on the servers at different times. This enables us to keep the cost of our cloud service to our customers as low as possible. If we have to provide servers that are dedicated to a particular timezone this increases the cost of providing the service. Follow the sun support policy cannot take place if you geolocate your data.

General Data Protection Regulation (GDPR)

FAQs about (GDPR)