LIFELENZ

LIFELENZ is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to LIFELENZ's public trust center, LIFELENZ is GDPR compliant. On SOC2C this listing is Listed.

According to LIFELENZ's public trust center, LIFELENZ is NIST CSF compliant. On SOC2C this listing is Listed.

LIFELENZ is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. LIFELENZ's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Yes, LifeLenz has a Data Privacy Framework Certification. This certification demonstrates our commitment to protecting personal data and complying with global privacy standards. The Data Privacy Framework Certification is relevant because it ensures that we meet the rigorous requirements for handling and processing personal information securely and responsibly. Additionally, it is an approved data transfer mechanism, which means we can transfer personal data internationally without solely relying on Standard Contractual Clauses (SCCs). This flexibility helps us streamline data transfers while remaining compliant with privacy regulations. This certification is particularly important for: - International Compliance: It aligns with major global privacy regulations, which govern how personal data must be protected and managed. - Customer Trust: By adhering to a certified privacy framework, we reinforce trust with our customers, providing assurance that their data is handled with the highest standards of privacy and security. - Accountability: The certification process requires regular assessments and improvements, ensuring that we remain accountable and proactive in managing data privacy risks.

LifeLenz has integrated Privacy by Design into every aspect of our product to ensure data privacy and security from the ground up. Here’s how we incorporate Privacy by Design: - Privacy in Product Development: Privacy considerations are embedded in each stage of product development. Before any feature is designed or deployed, we assess its potential impact on user privacy and implement measures to minimize data collection and exposure. - Data Minimization: We only collect and retain the minimum amount of data necessary for functionality. Our systems are designed to avoid storing sensitive information unless absolutely required, reducing privacy risks and exposure. - User Control and Transparency: We empower users with control over their data. Clear privacy settings allow users to manage what data is collected, retained, and shared. Additionally, our privacy policies are transparent, giving users clear insights into how their data is used. - Access Controls and Encryption: We enforce strict access controls to ensure that only authorized personnel can access sensitive data. All data is encrypted both in transit and at rest, protecting it from unauthorized access and breaches. - Regular Privacy Impact Assessments (PIAs): We conduct ongoing PIAs to evaluate new features and processes for privacy risks. This proactive approach helps us identify and mitigate potential privacy issues before they arise. - Privacy Training and Culture: Privacy by Design is ingrained in our organizational culture. Our team is regularly trained on privacy principles, ensuring that everyone—from developers to customer support—prioritizes privacy in their work. - Proactive Compliance with Regulations: Our Privacy by Design approach ensures we meet and often exceed requirements from regulations like GDPR and CCPA. By integrating these principles, we are committed to maintaining high standards of privacy protection.

For LifeLenz, understanding what information is relevant to a German Works Council and collaborating effectively with the Works Council is essential to ensuring compliance and fostering a productive, transparent relationship. Here’s how LifeLenz addresses this: 1. Relevant Information for the Works Council: - Data Privacy and Employee Monitoring: - Data Collection and Usage Policies:Details on what employee-related data the software collects, processes, and retains, with specific focus on any tools used for monitoring or analytics. - Purpose and Scope of Data Collection: Explanation of why data is collected and how it will be utilized, especially if employee activities are being monitored or analyzed within the system. - Data Privacy Impact Assessments (DPIAs): Summaries of privacy impact assessments conducted to identify any potential risks to employee privacy from using LifeLenz software. - GDPR Compliance Measures: Assurance that LifeLenz meets GDPR requirements for transparency, consent, data minimization, and data protection, ensuring employee privacy. - Introduction of New Technology and Security Systems: - Technology Implementation and Usage Policies: Information about any technology, software, or security measures that may impact employees’ privacy or daily tasks (e.g., SSO, device compliance checks). - Zero Trust Security Strategy: Explanation of how the zero-trust approach works, including access controls that ensure employees’ data is only accessible based on roles and need. - Workplace Policies and Changes: - Remote Work and Security Policies: Policies and practices that ensure the security of employee data in remote environments, including any remote monitoring policies and their relevance to security. - Data Access and Transparency: Clear access controls for employee data within the software, showing who can access certain data and under what circumstances. - Employee Training and Awareness: Information on mandatory security and privacy training…

LifeLenz is fully committed to GDPR compliance, especially in managing Data Subject Access Requests (DSARs) for our B2B customers. As a data processor, we operate in a way that supports our customers (the data controllers) in fulfilling their GDPR obligations while protecting personal data and respecting privacy rights. Here’s how we achieve this: 1. Controller-Managed DSAR Requests: - LifeLenz does not process DSARs directly from our customers' employees. Instead, since our B2B customers are the data controllers, they are responsible for managing DSARs on behalf of their employees. This approach aligns with GDPR’s designation of controllers and processors and ensures compliance with privacy obligations. 2. Support for Customer-Initiated Requests: - When a data controller (our customer) submits a DSAR to us on behalf of an employee, LifeLenz will fully facilitate and support the request. We promptly provide the necessary data to the customer to enable them to meet their GDPR obligations efficiently. 3. Data Minimization and Purpose Limitation: - We adhere to data minimization principles by only collecting and processing the data necessary for our services. Each data processing activity is limited to specific, legitimate purposes, ensuring GDPR compliance throughout our operations. 4. Privacy by Design and by Default: - LifeLenz integrates privacy into every stage of our product development, ensuring that data protection is foundational to our platform. This includes regular privacy impact assessments and security reviews to maintain robust privacy protections. 5. Data Security and Encryption: - We protect all personal data with strict security controls, including encryption for data both at rest and in transit. Our zero-trust security strategy enforces access control policies, allowing only authorized personnel access to sensitive data. 6. Data Transfers and Privacy Framework Certification: - LifeLenz complies with GDPR data transfer requirements and holds a Data…

We utilize industry-standard encryption protocols to ensure that all sensitive data is protected while stored in our systems. This includes the use of AES-256 encryption, which meets compliance requirements for SOC 2, GDPR, and other data protection frameworks. Encrypting data at rest is a critical component of our security strategy, aligned with our commitment to zero-trust principles and privacy by design.