Brego Security Measures

These Security Measures form part of the Brego Data Processing Agreement (the “DPA”) and apply to Customer Personal Data processed by Brego as processor or subprocessor. Capitalised terms have the meanings given in the DPA, including its definition of Customer Personal Data.

1. Technical and organisational measures

1.1 Brego shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risks of the relevant processing, in accordance with Article 32 of the UK GDPR or EU GDPR, as applicable. In selecting those measures, Brego shall take account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to individuals.

1.2 The measures shall address, as appropriate to those risks, protection against unauthorised access, disclosure, alteration, destruction or loss; ongoing confidentiality, integrity, availability and resilience of processing systems and services; timely restoration of availability and access following a physical or technical incident; and a process for regularly testing, assessing and evaluating the effectiveness of the measures.

1.3 Brego selects the particular access, encryption, network, monitoring, vulnerability-management, recovery and other safeguards appropriate to the relevant systems and processing. Subject to the DPA and any expressly agreed security requirements, Brego may modify or replace individual controls without the Customer’s prior approval, provided that the overall level of protection for Customer Personal Data is not materially reduced. Applicable change-notification requirements remain in force.

1.4 No particular provider, product, technical architecture, encryption algorithm, certification, audit standard, testing method, remediation deadline or review frequency is warranted unless expressly stated in an Order or expressly incorporated service-specific security description. This does not limit an obligation imposed by applicable Data Protection Laws or Transfer Clauses.

2. Scope and assurance

2.1 These measures do not prescribe an exhaustive control inventory. Brego’s confidentiality, incident-response, Subprocessor and return or deletion obligations remain governed by the DPA.

2.2 Brego shall make available information reasonably necessary to demonstrate compliance, including an accurate description of measures actually implemented, in accordance with clause 10 of the DPA and subject to lawful confidentiality and security safeguards. Those safeguards shall not restrict mandatory information, audit or inspection rights.

2.3 The Customer remains responsible for securing its Customer Systems, user accounts, credentials, integrations, devices and communications and for configuring and using the Services in accordance with the Agreement and Documentation.

2.4 Where these measures are used as Annex II to applicable Transfer Clauses, they shall be read with the service-specific security information expressly incorporated under Schedule 2 of the DPA. That information must describe measures actually implemented for the relevant processing and be completed before the transfer begins. It may be made available confidentially where appropriate; this general standard does not replace required transfer-specific information.