Documents

1. Welcome

 

1.1 To provide our services, we collect personal data from customers, potential clients, and employees.

 

This is because we aim to deliver strong customer protection, as confidentiality is crucial for building and sustaining trust with our employees, suppliers, and customers.

 

Ensuring a high standard of personal data protection involves adhering to specific organizational and technical protocols. Our company has implemented various internal and external data protection policies that employees are required to follow diligently.

 

Our company is also obligated to document, review, and monitor our compliance with our internal data protection policies and relevant legal requirements, including GDPR (General Data Protection Regulation).

 

It's vital that our company takes every step necessary to fully comply with all data protection-related requirements within our organization. Measures include assigning responsibilities, informing, and educating staff involved in data processing operations. Note that the “Privacy Policy” will be periodically updated to reflect new circumstances, but any storage and processing of personal data will be managed according to the latest policy document.

 

This privacy policy, alongside our personal data processing guidelines, provides a comprehensive framework for data management.

 

1.2 “Personal data” refers to any detail that can identify or relate to an identifiable person. Typically, a person can be identified directly or indirectly, often through identifiers like name, location, phone number, age, or gender. Identifiable individuals could be customers, employees, job applicants, suppliers, business partners, amongst others. This document covers different kinds of personal and sensitive data such as health details, account numbers, ID numbers, location details, online identities, and characteristics unique to an individual, like physical or genetic traits.

 

1.3 Information about businesses or enterprises isn’t classified as personal data, but contact information at such companies (e.g., names, job titles, work email addresses) are considered personal data.

 

1.4 We gather personal data solely for lawful business reasons, which include establishing and maintaining relationships with clients and suppliers, processing purchase orders, fulfilling hiring requirements and managing employment, exchanging necessary information, meeting legal obligations, fulfilling contracts, offering client services, among other purposes.

 

1.5 Personal data will be handled in the following ways:

• Lawfully, appropriately, and transparently with respect to the data subject;
• Collected for specified legitimate purposes and not processed further in ways incompatible with those purposes;
• Appropriate and relevant for the intended processing purposes, only being used to the necessary extent;
• All possible measures will be undertaken to rectify or delete any personal data found inaccurate for its processing purpose timely;
• Stored in a manner ensuring data subject identification only for necessary periods as required for its processing purposes;
• Managed in a manner ensuring data security, including protection against unauthorized or illegal processing, accidental loss, destruction, or damage, utilizing proper technical and organizational measures.

1.6 Ensuring adherence to the points mentioned above is the company’s responsibility.

 

2. Legal Grounds for Data Processing

 

2.1 Data processing principles are based on:

• A legal obligation or entitlement;
• Fulfilling contract terms involving the data subject;
• The data subject’s consent for specific purposes;
• Legitimate interests pursued by the Company.

2.2 Consent

 

2.2.1 Collecting, registering, and further processing personal data of customers, suppliers, business partners, and employees relies on obtaining their consent for processing data for one or more specified purposes. Our Company must be able to verify the data subject’s consent for processing their data.

 

2.2.2 Consent from an identified person for data processing must be specific, unambiguous, and given voluntarily after receiving the necessary explanations. The data subject must provide prompt personal consent for data processing via explicit confirmation or declaration.

Indeed, personal consent for processing personal data must be provided explicitly through declaration or confirmation.

 

2.2.3 Any company's request for data processing consent must be stated clearly and understandably, using plain language.

 

2.2.4 Consent for processing personal data must be structured appropriately to enable processing personal data categories.

 

2.2.5 Data subjects can refuse to provide personal data anytime. Upon opting out, we are obliged to cease data collection and processing unless legally required or entitled to do otherwise.

Indeed, the Company isn’t obliged or allowed otherwise.

 

2.3 Contractual Terms Fulfillment:

 

2.3.1 The collection and processing of personal data in fulfilling contract terms of which the data subject is a part or performing actions requested by the data subject pre-contract is lawful. This is relevant to contractual obligations and agreements signed by the Company, including those during pre-contract stages, irrespective of negotiation outcomes.

 

2.4 Compliance with Legal Obligations for Companies and Clients

 

2.4.1 Our Company must adhere to every legal obligation based on EU or member state legislation. Similar legal scenarios applicable to the Company may legitimize processing Customer’s personal data.

 

2.4.2 Legal terms necessitate collecting, registering, and (or) delivering specific types of information concerning employees, clients, etc., forming a legal rationale for processing personal data.

 

2.5 Company Interests

 

2.5.1 All data must be processed for legitimate interest pursued by the company if such interest or fundamental rights legally prioritize over the data subject's rights. Prior to proceeding with data processing, our Company ensures lawful priority of our legitimate interests against individual rights and processing doesn't cause unlawful harm.

2.5.1 All data will be processed where legitimate company interests prevail legally over data subjects' rights.

 

Processing prospective client's personal data for business expansion and new relationships development connects to company's legitimate interest, offering a lawful example. The subject must provide information on specific legitimate interests if processing relies on current Privacy Policy provision.

 

3. Steps in Data Processing and Transmission

 

3.1 Company as the principal authority managing personal data processing

 

3.1.1 Upon agreeing with the company, the data subject recognizes it as the complete control entity processing personal data. This permits our company to determine data processing methods specific to the subject.

 

3.2 Utilizing Data Processing Firms

 

3.2.1 External processors manage personal data on behalf of and following our directions. An example includes the company's regulation of HR systems, outside IT suppliers, among others. Third-party engagement for data processing mandates confidentiality guarantees. Failure to ensure confidentiality requires alternate data processor selection by the Company.

Our Company also retains the obligation to pick another data processor if required.

 

3.3 Data Processing Contracts

 

3.3.1 Pre-data transfer, our company pledges to form a written agreement with the data processor. The agreement offers company oversight over external personal data processing, holding the Company accountable.

 

3.3.2 If data processor/co-processor location is outside the EU/EEA, 3.4.4 terms shall apply.

 

3.4 Personal Data Disclosure Regulation

 

3.4.1 Before sharing personal details with trusted entities, company duty is to affirm recipient partnership agreement adherence. Notably, internal personal data-sharing is permissible if justified by legitimate business purposes.

 

3.4.2 Our Company confirms recipient's valid reasons to acquire personal data with transfer confinement kept at minimum necessity.

 

3.4.3 The company evaluates all transfer-associated risks for data subjects, individuals, or legal entities beyond organizational boundaries.

 

3.4.4 If recipient entities located outside the EU/EEA in areas lacking appropriate data protection levels, information transfer requires concluding a data transfer agreement conforming to EU Model Contractual Clauses terms.

 

4. Data Subjects’ Rights

 

4.1 Information Mandates

 

4.1.1 For personal data collection and registration, the company pledges to inform subjects of the following:

• The purpose and legal basis for data processing;
• Affected personal data classifications;
• Company-pursued legitimate interests when processing relies on balancing interests;
• Data recipients or categories, if applicable;
• Possible Company intention to relocate personal information to third countries and transfer legal grounds;
• Retention duration for personal data or criteria determining it, if unable to determine;
• The right to request access, correction, or deletion of personal data, impose processing restrictions, or oppose data portability;
• Right to withdraw consent anytime for data processing of specific purpose, with processing legitimacy prior to withdrawal remaining unaffected;
• Right to complain through channelized process to the Company  or a supervisory entity;
• Whether furnishing personal data is legal or contractual for contract engagements, with repercussions for non-provision, along with legal decision-making automated procedures including profiling, providing relevant logical details for understanding procedural impact on subjects.

4.2 Access Management

 

4.2.1 Our company handles personal data from various profiles, allowing individuals to request data access when processing/managing their records.

 

4.2.2 Data subjects have data access rights, knowing processing motivations per criteria, provided storage/processing of their data remains permissible for the company.

 

4.3 Our Company ensures immediate correction of subject’s data inaccuracies once requested.

 

4.4 Subjects acquire the right for permanent personal data deletion by Company upon legal retention non-obligation, excluding statutory conditions.

 

4.5 Subjects may request Company to enforce personal data processing limitations when suitable.

 

4.6 Data subjects retain rights for formatted, machine-readable record of personal data, delivered commonly and systematically.

 

4.7 On specific scenarios, subjects can contest data processing during balancing-interest-based handling, profiling included.

 

4.8 Company responds to data subject requests concerning rights in this clause promptly, processing by service center specialists with Company obligations completed within 30 days.

 

5. Data Safeguarding Methods

 

5.1 Company pledges to create novel products, services, tech solutions prioritizing safety, default data protection principles.

 

5.1.1 Special data protection interpreted as heightened data protection inclusion for new offerings/services.

• Company will accept technical advancements, implementation costs, conditional processing aspects (scope, context), risks affecting rights, ensuring principled data protection, adhering to protective measures effectively.
• By processing design/application, Company applies technical/organizational measures e.g., anonymization, introducing principles minimizing data storage, meeting onwards data protection needs/protecting rights.

 

5.1.2 Default protective measures initiate innovative data minimization.

• Appropriate organizational/technical measures secure default personal data processing limited to specific necessity conditions.
• Reducing personal data collection, processing scope, storage duration, availability constitutes rightful data access default measure implementation requirements.
• Intending to ensure considered access by default introduces careful approach to personal data.

6. Steps in Data Processing

 

6.1 The Company acts as an auditing body for data processing operations, requiring secrecy throughout functional recording process, including these details:

• Name and contact information;
• Data processing aim;
• Description of data subject and category specifics;
• Recipient exposure of personal data, involving third-country/international bodies disclosure when applicable;
• Details of any international data transfers, including country naming when pertinent with assured safeguards;
• Timeframe data category delete aiding information applicable;
• Applied safety measures general oversight;

 6.1.1 Providing documentation at request lies with Company as obliged to fulfill authorities’ demands.

 

7. Personal Data Disposal

 

7.1 Provided no lawful reason to persist, the Company completes personal data elimination.

 

7.2 Our Data Retention and Sharing Strategy clarifies distinct personal data category retention timelines.

 

7.3 Former/prospective clients possess rights for complete personal account detail eradication upon termination of relation.

 

7.4 Cooperative initiation involves customer protection right/other regulation compliance forcing action acknowledgment. All personal details registration follow legal financial exchanges & accounting/code regulations.

 

7.5 Company assures information destruction lacking grounded retention foundation. Deletion timeline spans five years beyond current customer-prior end year.

 

7.6 Prospective client-related data elimination may have a month-long procedure window for procedural adjustments, following privacy standards.

 

7.7 Offending client data retention preserves Company financial hindrance prevention/valid financial resolve safeguard continuation.

 

7.8 Per cooperative limits ends, Company initiate permanent data deletion/anonymization.

 

8. Possible Risks

 

8.1 Should personal data processing pose notable risk towards subjects, a Data Privacy Impact Assessment (DPIA) materializes necessity.

 

8.1.1 Executing privacy impact tells Company to cover process scope, context, purpose considerations establishing assorted regulations fulfilling compliance adopting measures demonstrating data protection implementation safeguard efficiency.

 

8.2 Organizational measures  receive review updates guarantee every six-month cycle.

 

8.2.1 Compliance establishment follows rules of conduct consisting of approved certification processes meeting legal expectations.

 

9. Profiling

 

9.1 This privacy policy interprets “profiling” as automatic personal data analysis predicting future behavior within merged cooperation environment settings. Situations applying profiling include:

• Credit assessment purposes;
• Advertising tailored product/service information for clients/prospective clients;
• Assisting financial crime identification.

10. International Requirements

 

10.1 We commit to Compliance Standards for General Data Protection Regulation (GDPR), international country-specific personal data protection legislative adherence.

 

10.2 Off-local nation regulations necessitating more stringent personal data protection, Company compliance exceeds existing provisions. Company policy overrides stricter comparison following stricter mandates.

 

11. Contact Information

 

11.1 Address queries relating to this policy to Company data protection contact [email protected].