2Checkout is currently in the process of becoming compliant with GDPR. Since it is a complex process it takes time and involves mapping, assessing, planning and implementing changes throughout the company. We are working with subject matter experts from the field and consultancy firms to support us in the process. Here's an overview of our analysis and the steps that we are taking to ensure compliance:

Establishing the Governance Structure - Completed

• Build the GDPR compliance initiative with a dedicated focus group
• Appoint a Data Protection Officer (DPO) in an independent role
• Conduct an assessment on product and business impact
• Initiate the internal Privacy and Security Awareness program
• Conduct Data Protection Impact Assessment (DPIA) [Internal]
• Conduct Data Protection Impact Assessment [External]

Updating Policies and Procedures - Completed

• Data Privacy Policy
• Terms of Use
• Refund and Delivery Policy
• Data Retention Policy
• Information Security Policy
• Cookie policy
• Data breach and incident response plan
• Risk management framework to assess and manage threats across the organization that also takes into account personal data
• Embedding of personal data protection requirements within contracts and agreements with third-party service providers and merchants

Embedding and Implementing Data Privacy into Operations - Completed

• Conduct a data mapping inventory and analysis of data in our systems
• Establish procedures and policies to restrict processing of personal data
• Set up automatic mechanisms to automatically track the flow of personal data within and outside our systems