Piano Analytics compliance according to the CNIL

👋 In this document you will discover how Piano Analytics, also known as Analytics Suite Delta by AT Internet, may be subject to transfers of personal data to third countries or international organizations in accordance with the CNIL and the RGPD.

Certification that the transfer of data to Piano complies with CNIL directives

AT Internet provides the appropriate protection measures for the following two cases:

1. The main shareholder ofAT Internet SAS: Piano Software Inc :

• The Piano Group's executive headquarters are located in the European Union (Amsterdam - Netherlands).

• AT Internet's commitments remain unchanged under the Piano banner(data stored within the European Union, data ownership, etc.).

• Piano has other entities within the European Union and the EDPB to validate its BCR Processor and BCR Controller via the Slovak control authority(the CNIL was involved in the validation process).

• No active data transfer with other Piano entities.

• No default data sharing with other Piano products.

• Compliance with data protection principles for all future integrations.

• Piano Analytics R&D and engineering remain within the European Union (Bordeaux - France).

• No requests from US authorities to date.

• The Piano Group's executive headquarters are located in the European Union (Amsterdam - Netherlands).

2. The service providers required to provide the Analytics service: Amazon Web Services (AWS) and Snowflake :

• AWS provides an IaaS cloud solution and is headquartered in Washington State.

• Snowflake provides a SaaS data platform solution, and is headquartered in the state of California.

• A DPA has been signed with both solutions, and the latest European Commission Standard Contractual Clauses (SCC) are included, dated 15/09/2021 for AWS and 29/10/2021 for Snowflake.

• Data is stored and processed only in the EU.

• Encryption of data in transit and at rest.

• Pseudonymization and data anonymization options.

• AWS complies with the CISPE code of conduct, and Snowflake has not received any requests for government information.

Good to know:

• Certification: Piano Analytics has begun the process of obtaining "Europrivacy" RGPD certification, approved by the EDPB in October 2022.

• Contact: For any questions, please contact the DPO at dpo@atinternet.com.

☝ It ' s important to remain vigilant about data confidentiality and take appropriate measures to ensure compliance with data protection regulations. While the European Commission recently adopted a new decision recognizing that the United States now guarantees a level of protection equivalent to that of the European Union for transfers of personal data from July 2023. This could have positive repercussions for French and European players using Google Analytics 4 or US hosting providers. However Piano Analytics stores its data in the European Union and works with RGPD-compliant providers to ensure regulatory compliance and data protection. It is crucial to ensure data confidentiality and to take the necessary steps to comply with data protection regulations.