Updates to Our Privacy Policy

We have updated our Privacy Policy effective March 27th, 2019. Learn More

GDPR

Updated 12.02.2019

Summary

On May 25, 2018, the General Data Protection Regulation (“GDPR”) became fully applicable in the European Union (EU). The ability to enable end users to control how and when their personal information is used is a cornerstone of Neura. We take privacy seriously and welcome the transparency of GDPR. This GDPR Whitepaper provides an overview of Neura’s GDPR-related efforts.

In relation to the services it provides customers, Neura is a “data processor” under the GDPR and its customers are “data controllers” as Neura is processing personal data on behalf of its customers for the purposes of providing the services.

***

This is a high-level summary of Neura’s Privacy Practices and what Neura has added to its privacy approach to comply with GDPR. For further information please review Neura’s Privacy Policy at https://www.theneura.com/privacy-policy/:

Data Collected

  • In order to provide the services, the Neura SDK collects raw sensory data from the user’s mobile device and from devices in the physical environment around the device. The data is collected dynamically to minimize the impact on memory and battery consumption. It is collected in real-time, only when it is needed, based on decisions made by Neura’s machine learning algorithms.
  • A detailed list of the device sensors and services Neura accesses to, as well as the data collected through the device, is attached as Exhibit A.
  • Neura Insights are used to make a product or a service more personalized and contextually aware. Neura shares User Insights with Neura’s customers according to the API services to which the customer has subscribed. Raw data is never shared with Neura’s customers.
  • Neura may use aggregated data (i.e. non personal data) from several end users to improve its algorithms, measure service usage, publish summaries online or offline, and develop new features.

Legal Basis For Processing and Acquiring User’s Consent

Neura is a data processor and accordingly all data collection and processing is done on behalf of Neura’s customer who is the controller. Under the GDPR, the controller is the party that, alone or jointly with others, determines the purposes and means of the processing of personal data. According to the GDPR, the controller is the party who must have a legal basis for data processing personal data and therefore is required to acquire adequate consent if and to the extent necessary under the GDPR (and/or other privacy laws to which the controller is subject).

Transparency Requirements

Please note that customers are also required to notify the individual about the use of Neura in their privacy policy. We also recommend that customers include a link Neura’s privacy policy in their legal documentation.

Users' Rights

Neura respects all user’s rights protected by GDPR as detailed in Neura’s Privacy Policy.

GDPR Strategy

  • We retained outside counsel to help us interpret the GDPR and prepare a GDPR compliance plan.
  • We built an internal taskforce with members of different departments (security, sales, product development, and others) to implement the GDPR compliance plan internally.

Data Mapping

We mapped Neura’s data collection practices, including the data we collect, where we store it, with whom we share it, etc. We identify as a “data processor”.

Privacy Policy

We updated our global Privacy Policy which was also localized and translated into local languages of various EU jurisdictions.

Data Transfers

Amazon Web Services. We host all the personal data with AWS, which announced it is compliant the GDPR. AWS is also registered with the EU-US Privacy Shield (see: https://www.privacyshield.gov/list).

Neura’s staff. Our staff sits in:

Other service providers. We only share personal data that is subject to the GDPR with vendors and partners who, like Amazon Web Services, have announced that they are compliant with the GDPR. For example, as indicated in our Privacy Policy (https://www.theneura.com/privacy-policy/), we share personal data with CRM companies (such as Salesforce or HubSpot), and with companies for ETL-data processing and queue management purposes.

Data Processing Agreement with Service Providers

We have executed Data Processing Agreements in accordance with Article 28 of the GDPR with all our service providers that have access to personal data subject to the GDPR.

Policy for Handling Data-subject Rights

We implemented an internal policy for recognizing and handling requests and claims related to data-subject rights (such as the right of access, right to be forgotten, etc.).

Privacy by Design and Default

We have implemented various technical and organizational measures that are designed to support the principle of data minimization and specifically ensure only personal data, which are necessary for each specific purpose of the processing, are processed.

Recordkeeping

Neura keeps an updated document describing Neura’s data-collection and data-processing practices. Neura periodically reviews this document to make sure that it is always fully updated. Neura also maintains a record of the processing activities it carries out on behalf of its customers as controllers.

Data Protection Officer

Gali Sokol Kamerman is Neura’s data protection officer. You can contact her via gali@theneura.com.

Security Measures

Neura’s security management system is certificated by ISO270001. Neura is hosted in Amazon EC2 cloud services platform and all Amazon security groups, security zones and best practices are applied in the servers’ implementations. Our Data Center (managed by Amazon Web Services) is SAS 70 Type II certified, SSAE16 (SOC 2) Compliant, and features proximity security badge access and digital security video surveillance. Our server network can only be accessed via SSL VPN with public key authentication or via Two-factor Authentication over SSL. Additionally, our network can only be accessed via multi-factor authentication, and all access to our web portal is secured over HTTPS using SSL 256-bit encryption.

Ongoing Compliance

We are not approaching GDPR compliance as a one-time exercise. Therefore, we are committed to periodically reviewing our roadmap and ensuring ongoing compliance.

As a Neura customer, where should you start your "GDPR journey"?

If the GDPR applies to your company, we highly recommend conducting internal due diligence to map your specific data collection practices. This includes, among other matters, understanding what specific personal data (including sensitive personal data) of individuals protected by the GDPR your company is collecting (e.g. end-users, customers, employees, etc.), from whom is the data collected, where is it being hosted, for what purposes is it being used, with whom is it being disclosed, and whether the personal data is transferred outside of the European Union or European Economic Area.

Where can I learn more about GDPR?

Additional information is available on the European Commission’s website here (http://ec.europa.eu/justice/data-protection/reform/index_en.htm).

I have more questions. Who should I contact?

If you have any additional questions about the GDPR you are invited to contact us at  privacy@theneura.com.

Exhibit A

The data that is collected through the device is as follows:

  • Android ID
  • Vendor ID (iOS)
  • Device model
  • Operating system version
  • Wi-Fi routers in proximity
  • Bluetooth – connections and devices
  • GPS and geolocation data (location changes, Visits, Geofencing)
  • Activity – based on the operating system’s API
  • Surrounding devices’ data – Mac address, IP address, ID
  • Device States – Power (on / off), Airplane Mode, Battery Saver/Optimization, Idle Mode, Interactive Mode, charger (connected / disconnected), Headphones (connected / disconnected) (Android), Screen (on / off) (Android)
  • Application state (foreground / background) (Android)
  • Engagement Data of the user in the hosted mobile application

 

Neura does not collect or hold any medical or healthcare related data and therefore does not handle any “protected health information” (PHI).

Disclaimer

Disclaimer: The information in this document may not be construed as legal advice about the interpretation or application of any law, regulation or regulatory guideline. Customers and prospective customers must seek their own legal counsel to understand the applicability of any law on their processing of personal data.