AquaFold’s GDPR Commitment

AquaFold, Inc. (“AquaFold”) is committed to the General Data Protection Regulation (“GDPR”), which will go into effect on May 25, 2018. The GDPR regulation contains the most significant changes to European data privacy legislation in the last 20 years. It is designed to give European Union (“EU”) citizens more control over their data and seeks to unify a number of existing privacy and security laws under one comprehensive law. The GDPR applies to all companies that do business with EU citizens or process data of EU citizens regardless of the location of the company that is processing such data. To that end, the GDPR applies to AquaFold.

Our customers can trust that AquaFold has made GDPR a priority and has devoted significant and strategic resources toward our efforts to adhere with GDPR.

Like many other global software companies, AquaFold is in the process of rolling out its company-wide GDPR policy program starting on May 25, 2018. AquaFold appreciates that its customers have requirements under the GDPR, which are directly impacted by their use of AquaFold’s products and services, and AquaFold is committed to helping its customers fulfill their requirements under the GDPR and local law.

AquaFold’s customers will typically act as the data controller for any personal data they provide to AquaFold in connection with their use of our products and services. The data controller determines the purposes and means of processing personal data, while the data processor processes data on behalf of the data controller. AquaFold is a data processor and processes personal data on behalf of the data controller when the controller is using AquaFold’s product and services.

Data controllers (e.g. AquaFold’s customers) are responsible for implementing appropriate technical and organizational measures to ensure and demonstrate that any data processing is performed with GDPR in mind. Our customers’ obligations as data controller relate to principles such as fairness and transparency, purpose limitation, lawfulness, data minimization, and accuracy, as well as fulfilling data subject’s (e.g. the customer clients of our customers) rights with respect to their data.

AquaFold will keep you informed through its website about its policy with the GDPR requirements; however, should you have any questions or concerns, please do not hesitate to contact our legal department at

Questions about GDPR?

If you have questions about AquaFold’s GDPR commitment or if you would like to submit an inquiry about your personal data, please fill out and submit this form. An AquaFold representative will be in touch shortly.

Frequently Asked Questions about GDPR Compliance1

Idera, Inc., together with its subsidiaries, CopperEgg Corporation, Uptime Software, Inc., AquaFold, Inc, Embarcadero Technologies, Inc., Sencha, Inc., Precise Software Solutions, Inc., Embarcadero Technologies Europe Ltd., Gurock Software GmbH and Ranorex GmbH (collectively, the “Company”) prepare this document to help you clarify some common confusions around the General Data Protection Regulation (“GDPR”). The Company recognizes the importance of the evolving legal and regulatory landscape around information security and data privacy and remains firmly committed to GDPR readiness.

  • Does my data need to be stored in Europe?

    No. The GDPR does not contain any obligation to store information in Europe. However, transfers of European personal data outside the European Economic Area (EEA) generally require that a valid transfer mechanism be in place to protect the data once it leaves the EEA. The GDPR does not invalidate or override the EU Model Clauses or the EU-U.S. and Swiss-U.S. Privacy Shield Framework, which are both legally valid mechanisms to ensure the legal transfer of personal data into and out of the EEA. The Company ensures that its customers can comply by offering its customers a data processing agreement (“DPA”) that incorporates the Model Clauses as approved by the European Commission.

  • Is it required for me as a customer to have a DPA with the Company?

    For customers of the traditional software model (all Idera entities except Gurock and CopperEgg) e.g. customer that uses a traditional perpetual product that is not hosted by any Idera subsidiary. These customers do not need to sign a DPA with the Company because Idera and its subsidiaries (except Gurock and CopperEgg) are not processing EEA personal data on behalf of their customers. We have prepared the Company Privacy and Security Statement, available here, which explains our technical and organizational security measures to protect your data. In addition, if you want to learn more about how the Company collects, processes and uses your personal information, please review our Privacy Statement here.

    For customers of our SaaS solution, e.g. Gurock and CopperEgg customers, that are located in the EEA must sign a DPA with Gurock or CopperEgg. The DPA will reflect our agreement that will govern the processing of personal data. Putting another way, it is an agreement that CopperEgg and Gurock as a SaaS platform can process personal data on your behalf.

  • Does the GDPR apply to company that is established outside the European Union?

    Yes. The GDPR applies to all companies regardless of where it is located to the extent the company process personal data in the context of (A) offering goods and services (whether paid or not) to people in the EEA; or (B) monitoring the behavior of people in the EEA, for example by placing cookies on the devices of EEA individuals.

  • Is it required to have consent from individuals to process their personal data?

    Consent is only one of the legal bases a company can use for the processing of personal data. For example, the company can process personal data (A) when necessary for the performance of a contract to which the data subject (the individual whose data is processed) is a party; (B) when there is a legal obligation to do so (such as the submission of employee data to a tax authority); and (C) sometimes even on the basis of legitimate interests, such as commercial and marketing goals. The legitimate interest must, however, outweigh any detriment to the privacy of the data subject.

  • What is the difference of ‘data controller’ and ‘data processor’?

    Data Controller is the owner of their information and decides how that information should be used. Data Processor is an entity who processes the personal data of the Data Controller and carries out instructions of the Data Controller with regard to this data. Generally speaking, when the Company collects data from a customer in order to create an account, the Company will be the Data Controller. However, under limited circumstances, for example, for the SaaS solutions – solely for Gurock and CopperEgg’s customers – the Company will be the Data Processor because the customers of Gurock and CopperEgg will be the Controllers of their content, including any associated personal information they place or generate in Gurock or CopperEgg systems. Formal definitions from the GDPR full text may be found at

  • As an owner of the data (e.g. data subject) located in the EEA, do I have the absolute right to be forgotten? Putting another way, is the Company obligated to delete all my personal data upon my request?

    No. The right to erasure (or right to be forgotten) is not absolute. The Company may refuse to honor the request if continued processing is necessary for compliance with a legal obligation which requires processing by Union or Member State law to which the Company is subject. In addition, the Company can refuse to honor the request for the establishment, exercise or defense of legal claims. Therefore, several relevant factors have to be taken into account when considering a request for deletion of personal data by the data subject. Note, however, that data subjects have an absolute right to prevent their personal data from being processed for direct marketing purposes.

  • Does the GDPR require encryption of all personal data?

    No. The GDPR does not mandate specific security measures. Instead, the GDPR requires organizations to take technical and organizational security measures which are appropriate to the risks presented. Encryption at rest and pseudonymization may be appropriate depending on the circumstances, but they are not mandated by the GDPR in every instance. The following are kinds of security actions considered “appropriate to the risk” (1) the pseudonymization and encryption of personal data (as mentioned); (2) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (3) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and (4) a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

Privacy and Security Statement

Idera Inc., together with its US subsidiaries, Uptime Software, Inc., AquaFold, Inc, Embarcadero Technologies, Inc., CooperEgg Corporation, Sencha, Inc. and Precise Software Solutions, Inc. (collectively, “Company”), is committed to respecting and protecting the privacy of its customers, partners and website visitors (collectively “You” or “Your”). For more information about our Privacy Statement, please click here.

The security of your personal information is very important to the Company. We use robust security measures, which encompass both technical and organizational security controls, to prevent data loss, information leaks, or other unauthorized data processing operations. The Company incorporates encryption, incident management, network and system integrity, and availability and resilience requirements into its security program.

In addition, the Company uses standard security protocols mechanisms to exchange the transmission of sensitive data such as credit card details. When you enter sensitive personal information such as your credit card number on our site, we encrypt it using secure socket layer (SSL) technology.

In the event that your personal information is acquired, or is reasonably believed to have been acquired, by an unauthorized person and applicable law requires notification, the Company will notify you by e-mail or mail. The Company will give you notice promptly, consistent with the reasonable needs of law enforcement and/or the Company to determine the scope of the breach and to investigate and restore the integrity of the data system.

If you have additional questions about privacy, please contact us at .

1NOTE: The above information is provided by the Company for informational purposes only and is not intended to serve as legal advice. You should contact your attorney to obtain advice with respect to any particular GDPR question, issue or problem.

Idera Notice of Certification Under the EU-US Privacy Shield Framework and Swiss-US Privacy Shield Framework

Effective for Idera, Inc. and its subsidiaries on April 23, 2018.

Idera, Inc. and its United States subsidiaries, CopperEgg Corporation, Uptime Software, Inc., AquaFold, Inc, Embarcadero Technologies, Inc., Sencha, Inc., Precise Software Solutions, Inc. and Whole Tomato Software, LLC (collectively, “Idera”), participate in the EU-US Privacy Shield Framework and Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information transferred from European Union member countries and Switzerland to the United States, respectively. Idera has certified with the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield principles, please visit

In compliance with the EU-US and Swiss-US Privacy Shield Principles, Idera commits to resolve complaints about your privacy and our collection or use of your personal information. European Union or Swiss individuals with inquiries or complaints regarding this privacy policy should first contact Idera at

Idera has further committed to refer unresolved privacy complaints covering non-Human Resource data under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU Privacy Shield, operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit for more information and to file a complaint. If your concern continues to be unresolved, you may pursue binding arbitration through the Privacy Shield Arbitration Panel. To learn more about the Privacy Shield Panel, please visit

Please note that Idera also receives some data via other compliance mechanisms, including data processing agreements based on the EU Standard Contractual Clauses

In regard to Human Resource data, Idera commits to cooperate with the panel established by the EU data protection authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner, as applicable and comply with the advice given by them with regard to human resources data transferred from the European Union and Switzerland, as applicable in the context of the employment relationship. For more information about Idera Human Resource data and the Human Resource Privacy Policy, please contact As an employee, you can always review Idera Human Resource Privacy Policy here.

As explained in our Privacy Statement we sometimes provide personal information (such as name, email address, purchases, and billing information) to third parties to perform services on our behalf, or in response to contractual requirements. If we transfer personal information received under the Privacy Shield to a third party, the third party’s access, use, and disclosure of the personal data must also be in compliance with our Privacy Shield obligations, and we will remain liable under the Privacy Shield for any failure to do so by the third party unless we prove we are not responsible for the events giving rise to such failure to comply with the Privacy Shield obligations.

European Union individuals and Swiss individuals have rights to access personal data about them, and to limit use and disclosure of their personal data. With our Privacy Shield certification, Idera has committed to respect those rights. If you wish to access, to limit use, or to limit disclosure, please access your customer account after you enter your customer log in information and revise the information that you entered into our system or contact us at and we will assist you through this process.

Idera is subject to the investigatory and enforcement powers of the US Federal Trade Commission. Idera may be required to disclose personal information that we handle under the Privacy Shield in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you have any questions about our handling of your personal data under Privacy Shield, or about our privacy practices generally, please contact us at or at our mailing address below. We will work with you to address your inquiry in a timely manner.

Idera Inc.
Attn: Legal Department
2950 North Loop Freeway West
Suite 700
Houston, Texas 77092