Data Security and Regulatory Compliance
At YourCX, both the platform and its development team are fully committed to legal compliance and implementing robust technical safeguards to ensure data security.
At YourCX, we take data protection seriously—both at the platform level and throughout our organization. We ensure full compliance with legal regulations and apply strict technical standards to safeguard user data.
EU-Based Data Hosting
- Data residency: All data assets (including customer feedback, user profiles, and metadata) are physically hosted exclusively in data centers located within the European Union—specifically in Poland and Germany.
- No data transfers outside the EU: During standard operations, no personal data is sent to servers outside the European Economic Area (EEA).
Technical and Organizational Security Measures (Article 32 GDPR)
End-to-end encryption: All data is encrypted throughout every stage of communication.
Pseudonymization: Personally identifiable data (e.g., customer IDs, IP addresses) is pseudonymized where appropriate to reduce the risk of identification.
Access control: Role-Based Access Control (RBAC), access logging, and full audit trails are implemented to track every operation.
Infrastructure protection: Firewalls, IDS/IPS systems, and regular backups ensure resilient system performance.
Monitoring and alerts: Continuous system monitoring includes uptime, internal errors, and resource usage to maintain reliability and security.
GDPR Compliance
Legal coverage: We ensure all GDPR rights are upheld, including the right to access, rectify, and delete personal data.
Data Protection by Design & by Default: All feature development follows the principles of maximum default privacy and data minimization.
Client data protection: YourCX signs Data Processing Agreements (DPAs) with all clients to clearly define responsibilities and ensure lawful handling of personal data.
For your end users, this means full data security and legal compliance with both Polish and EU regulations—including the rights to data access, erasure, and process control.
