Personal Data Privacy Policy

Personal Data Privacy Policy

Down­load and print the con­tent on this page

 

1.     Purpose, Scope, and Users

iCon­nect, here­inafter referred to as the “Com­pa­ny”, strives to com­ply with applic­a­ble laws and reg­u­la­tions relat­ed to Per­son­al Data pro­tec­tion in coun­tries where the Com­pa­ny oper­ates. This Pol­i­cy sets forth the basic prin­ci­ples by which the Com­pa­ny process­es the per­son­al data of con­sumers, cus­tomers, sup­pli­ers, busi­ness part­ners, employ­ees and oth­er indi­vid­u­als, and indi­cates the respon­si­bil­i­ties of its busi­ness depart­ments and employ­ees while pro­cess­ing per­son­al data.

This Pol­i­cy applies to the Com­pa­ny and its direct­ly or indi­rect­ly con­trolled whol­ly-owned sub­sidiaries con­duct­ing busi­ness with­in the Euro­pean Eco­nom­ic Area (EEA) or pro­cess­ing the per­son­al data of data sub­jects with­in EEA.

The users of this doc­u­ment are all employ­ees, per­ma­nent or tem­po­rary, and all con­trac­tors work­ing on behalf of The Company.

 

2.     Reference Documents

• EU GDPR 2016/679 (Reg­u­la­tion (EU) 2016/679 of the Euro­pean Par­lia­ment and of the Coun­cil of 27 April 2016 on the pro­tec­tion of nat­ur­al per­sons with regard to the pro­cess­ing of per­son­al data and on the free move­ment of such data, and repeal­ing Direc­tive 95/46/EC)
• Employ­ee Per­son­al Data Pro­tec­tion Policy
• Data Reten­tion Policy
• Data Pro­tec­tion Offi­cer Job Description
• Guide­lines for Data Inven­to­ry and Pro­cess­ing Activities
• Data Sub­ject Access Request Procedure
• Data Pro­tec­tion Impact Assess­ment Guidelines
• Cross Bor­der Per­son­al Data Trans­fer Procedure
• Breach Noti­fi­ca­tion Procedure

 

3.     Definitions

The fol­low­ing def­i­n­i­tions of terms used in this doc­u­ment are drawn from Arti­cle 4 of the Euro­pean Union’s Gen­er­al Data Pro­tec­tion Regulation:

Per­son­al Data: Any infor­ma­tion relat­ing to an iden­ti­fied or iden­ti­fi­able nat­ur­al per­son (“Data Sub­ject”) who can be iden­ti­fied, direct­ly or indi­rect­ly, in par­tic­u­lar by ref­er­ence to an iden­ti­fi­er such as a name, an iden­ti­fi­ca­tion num­ber, loca­tion data, an online iden­ti­fi­er or to one or more fac­tors spe­cif­ic to the phys­i­cal, phys­i­o­log­i­cal, genet­ic, men­tal, eco­nom­ic, cul­tur­al or social iden­ti­ty of that nat­ur­al person.

Sen­si­tive Per­son­al Data: Per­son­al data which are, by their nature, par­tic­u­lar­ly sen­si­tive in rela­tion to fun­da­men­tal rights and free­doms mer­it spe­cif­ic pro­tec­tion as the con­text of their pro­cess­ing could cre­ate sig­nif­i­cant risks to the fun­da­men­tal rights and free­doms. Those per­son­al data include per­son­al data reveal­ing racial or eth­nic ori­gin, polit­i­cal opin­ions, reli­gious or philo­soph­i­cal beliefs, or trade union mem­ber­ship, genet­ic data, bio­met­ric data for the pur­pose of unique­ly iden­ti­fy­ing a nat­ur­al per­son, data con­cern­ing health or data con­cern­ing a nat­ur­al per­son­’s sex life or sex­u­al orientation.

Data Con­troller: The nat­ur­al or legal per­son, pub­lic author­i­ty, agency or any oth­er body, which alone or joint­ly with oth­ers, deter­mines the pur­pos­es and means of the pro­cess­ing of per­son­al data.

Data Proces­sor: A nat­ur­al or legal per­son, pub­lic author­i­ty, agency or any oth­er body which process­es per­son­al data on behalf of a Data Controller.

Pro­cess­ing: An oper­a­tion or set of oper­a­tions which is per­formed on per­son­al data or on sets of per­son­al data, whether or not by auto­mat­ed means, such as col­lec­tion, record­ing, orga­ni­za­tion, struc­tur­ing, stor­age, adap­ta­tion or alter­ation, retrieval, con­sul­ta­tion, use, dis­clo­sure by trans­mis­sion, dis­sem­i­na­tion or oth­er­wise mak­ing avail­able, align­ment or com­bi­na­tion, restric­tion, era­sure or destruc­tion of the data.

Anonymiza­tion: Irre­versibly de-iden­ti­fy­ing per­son­al data such that the per­son can­not be iden­ti­fied by using rea­son­able time, cost, and tech­nol­o­gy either by the con­troller or by any oth­er per­son to iden­ti­fy that indi­vid­ual. The per­son­al data pro­cess­ing prin­ci­ples do not apply to anonymized data as it is no longer per­son­al data.

Pseu­do­nymiza­tion: The pro­cess­ing of per­son­al data in such a man­ner that the per­son­al data can no longer be attrib­uted to a spe­cif­ic data sub­ject with­out the use of addi­tion­al infor­ma­tion, pro­vid­ed that such addi­tion­al infor­ma­tion is kept sep­a­rate­ly and is sub­ject to tech­ni­cal and orga­ni­za­tion­al mea­sures to ensure that the per­son­al data are not attrib­uted to an iden­ti­fied or iden­ti­fi­able nat­ur­al per­son. Pseu­do­nymiza­tion reduces, but does not com­plete­ly elim­i­nate, the abil­i­ty to link per­son­al data to a data sub­ject. Because pseu­do­nymized data is still per­son­al data, the pro­cess­ing of pseu­do­nymized data should com­ply with the Per­son­al Data Pro­cess­ing principles.

Cross-bor­der pro­cess­ing of per­son­al data: Pro­cess­ing of per­son­al data which takes place in the con­text of the activ­i­ties of estab­lish­ments in more than one Mem­ber State of a con­troller or proces­sor in the Euro­pean Union where the con­troller or proces­sor is estab­lished in more than one Mem­ber State; or pro­cess­ing of per­son­al data which takes place in the con­text of the activ­i­ties of a sin­gle estab­lish­ment of a con­troller or proces­sor in the Union but which sub­stan­tial­ly affects or is like­ly to sub­stan­tial­ly affect data sub­jects in more than one Mem­ber State;

Super­vi­so­ry Author­i­ty: An inde­pen­dent pub­lic author­i­ty which is estab­lished by a Mem­ber State pur­suant to Arti­cle 51 of the EU GDPR;

Lead super­vi­so­ry author­i­ty: The super­vi­so­ry author­i­ty with the pri­ma­ry respon­si­bil­i­ty for deal­ing with a cross-bor­der data pro­cess­ing activ­i­ty, for exam­ple when a data sub­ject makes a com­plaint about the pro­cess­ing of his or her per­son­al data; it is respon­si­ble, among oth­ers, for receiv­ing the data breach noti­fi­ca­tions, to be noti­fied on risky pro­cess­ing activ­i­ty and will have full author­i­ty as regards to its duties to ensure com­pli­ance with the pro­vi­sions of the EU GDPR;

Each “local super­vi­so­ry author­i­ty” will still main­tain in its own ter­ri­to­ry, and will mon­i­tor any local data pro­cess­ing that affects data sub­jects or that is car­ried out by an EU or non-EU con­troller or proces­sor when their pro­cess­ing tar­gets data sub­jects resid­ing on its ter­ri­to­ry. Their tasks and pow­ers includes con­duct­ing inves­ti­ga­tions and apply­ing admin­is­tra­tive mea­sures and fines, pro­mot­ing pub­lic aware­ness of the risks, rules, secu­ri­ty, and rights in rela­tion to the pro­cess­ing of per­son­al data, as well as obtain­ing access to any premis­es of the con­troller and the proces­sor, includ­ing any data pro­cess­ing equip­ment and means.

“Main estab­lish­ment as regards a con­troller” with estab­lish­ments in more than one Mem­ber State, the place of its cen­tral admin­is­tra­tion in the Union, unless the deci­sions on the pur­pos­es and means of the pro­cess­ing of per­son­al data are tak­en in anoth­er estab­lish­ment of the con­troller in the Union and the lat­ter estab­lish­ment has the pow­er to have such deci­sions imple­ment­ed, in which case the estab­lish­ment hav­ing tak­en such deci­sions is to be con­sid­ered to be the main establishment;

“Main estab­lish­ment as regards a proces­sor” with estab­lish­ments in more than one Mem­ber State, the place of its cen­tral admin­is­tra­tion in the Union, or, if the proces­sor has no cen­tral admin­is­tra­tion in the Union, the estab­lish­ment of the proces­sor in the Union where the main pro­cess­ing activ­i­ties in the con­text of the activ­i­ties of an estab­lish­ment of the proces­sor take place to the extent that the proces­sor is sub­ject to spe­cif­ic oblig­a­tions under this Regulation;

Group Under­tak­ing: Any hold­ing com­pa­ny togeth­er with its subsidiary.

 

4.     Basic Principles Regarding Personal Data Processing

The data pro­tec­tion prin­ci­ples out­line the basic respon­si­bil­i­ties for organ­i­sa­tions han­dling per­son­al data. Arti­cle 5(2) of the GDPR stip­u­lates that “the con­troller shall be respon­si­ble for, and be able to demon­strate, com­pli­ance with the prin­ci­ples.”

4.1.Lawfulness, Fairness, and Transparency

Per­son­al data must be processed law­ful­ly, fair­ly and in a trans­par­ent man­ner in rela­tion to the data subject.

4.2.Purpose Limitation

Per­son­al data must be col­lect­ed for spec­i­fied, explic­it and legit­i­mate pur­pos­es and not fur­ther processed in a man­ner that is incom­pat­i­ble with those purposes.

4.3.Data Minimization

Per­son­al data must be ade­quate, rel­e­vant, and lim­it­ed to what is nec­es­sary in rela­tion to the pur­pos­es for which they are processed. The Com­pa­ny must apply anonymiza­tion or pseu­do­nymiza­tion to per­son­al data if pos­si­ble to reduce the risks to the data sub­jects concerned.

4.4.Accuracy

Per­son­al data must be accu­rate and, where nec­es­sary, kept up to date; rea­son­able steps must be tak­en to ensure that per­son­al data that are inac­cu­rate, hav­ing regard to the pur­pos­es for which they are processed, are erased or rec­ti­fied in a time­ly manner.

4.5.Storage Period Limitation

Per­son­al data must be kept for no longer than is nec­es­sary for the pur­pos­es for which the per­son­al data are processed.

4.6.Integrity and confidentiality

Tak­ing into account the state of tech­nol­o­gy and oth­er avail­able secu­ri­ty mea­sures, the imple­men­ta­tion cost, and like­li­hood and sever­i­ty of per­son­al data risks, the Com­pa­ny must use appro­pri­ate tech­ni­cal or orga­ni­za­tion­al mea­sures to process Per­son­al Data in a man­ner that ensures appro­pri­ate secu­ri­ty of per­son­al data, includ­ing pro­tec­tion against acci­den­tal or unlaw­ful destruc­tion, loss, alter­na­tion, unau­tho­rized access to, or disclosure.

4.7.Accountability

Data con­trollers must be respon­si­ble for and be able to demon­strate com­pli­ance with the prin­ci­ples out­lined above.

 

5.     Building Data Protection in Business Activities

In order to demon­strate com­pli­ance with the prin­ci­ples of data pro­tec­tion, an organ­i­sa­tion should build data pro­tec­tion into its busi­ness activities.

5.1.Notification to Data Subjects

(See the Fair Pro­cess­ing Guide­lines section.)

5.2.Data Subject’s Choice and Consent

(See the Fair Pro­cess­ing Guide­lines section.)

5.3.Collection

The Com­pa­ny must strive to col­lect the least amount of per­son­al data pos­si­ble. If per­son­al data is col­lect­ed from a third par­ty, the Data Pro­tec­tion Offi­cer must ensure that the per­son­al data is col­lect­ed lawfully.

5.4.Use, Retention, and Disposal

The pur­pos­es, meth­ods, stor­age lim­i­ta­tion and reten­tion peri­od of per­son­al data must be con­sis­tent with the infor­ma­tion con­tained in the Pri­va­cy Notice. The Com­pa­ny must main­tain the accu­ra­cy, integri­ty, con­fi­den­tial­i­ty, and rel­e­vance of per­son­al data based on the pro­cess­ing pur­pose. Ade­quate secu­ri­ty mech­a­nisms designed to pro­tect per­son­al data must be used to pre­vent per­son­al data from being stolen, mis­used, or abused, and pre­vent per­son­al data breach­es. Data Pro­tec­tion Offi­cer is respon­si­ble for com­pli­ance with the require­ments list­ed in this section.

5.5.Disclosure to Third Parties

When­ev­er the Com­pa­ny uses a third-par­ty sup­pli­er or busi­ness part­ner to process per­son­al data on its behalf, the Data Pro­tec­tion Offi­cer must ensure that this proces­sor will pro­vide secu­ri­ty mea­sures to safe­guard per­son­al data that are appro­pri­ate to the asso­ci­at­ed risks. For this pur­pose, the Proces­sor GDPR Com­pli­ance Ques­tion­naire must be used.

The Com­pa­ny must con­trac­tu­al­ly require the sup­pli­er or busi­ness part­ner to pro­vide the same lev­el of data pro­tec­tion. The sup­pli­er or busi­ness part­ner must only process per­son­al data to car­ry out its con­trac­tu­al oblig­a­tions towards the Com­pa­ny or upon the instruc­tions of the Com­pa­ny and not for any oth­er pur­pos­es. When the Com­pa­ny process­es per­son­al data joint­ly with an inde­pen­dent third par­ty, the Com­pa­ny must explic­it­ly spec­i­fy its respec­tive respon­si­bil­i­ties of and the third par­ty in the rel­e­vant con­tract or any oth­er legal bind­ing doc­u­ment, such as the Sup­pli­er Data Pro­cess­ing Agreement.

5.6.Cross-border Transfer of Personal Data

Before trans­fer­ring per­son­al data out of the Euro­pean Eco­nom­ic Area (EEA) ade­quate safe­guards must be used includ­ing the sign­ing of a Data Trans­fer Agree­ment, as required by the Euro­pean Union and, if required, autho­riza­tion from the rel­e­vant Data Pro­tec­tion Author­i­ty must be obtained. The enti­ty receiv­ing the per­son­al data must com­ply with the prin­ci­ples of per­son­al data pro­cess­ing set forth in Cross-Bor­der Data Trans­fer Procedure.

5.7.Rights of Access by Data Subjects

When act­ing as a data con­troller, the Data Pro­tec­tion Offi­cer is respon­si­ble to pro­vide data sub­jects with a rea­son­able access mech­a­nism to enable them to access their per­son­al data, and must allow them to update, rec­ti­fy, erase, or trans­mit their Per­son­al Data, if appro­pri­ate or required by law. The access mech­a­nism will be fur­ther detailed in the Data Sub­ject Access Request Procedure.

5.8.Data Portability

Data Sub­jects have the right to receive, upon request, a copy of the data they pro­vid­ed to us in a struc­tured for­mat and to trans­mit those data to anoth­er con­troller, for free. The Data Pro­tec­tion Offi­cer is respon­si­ble to ensure that such requests are processed with­in one month, are not exces­sive and do not affect the rights to per­son­al data of oth­er individuals.

5.9.Right to be Forgotten

Upon request, Data Sub­jects have the right to obtain from the Com­pa­ny the era­sure of its per­son­al data. When the Com­pa­ny is act­ing as a Con­troller, Data Pro­tec­tion Offi­cer must take nec­es­sary actions (includ­ing tech­ni­cal mea­sures) to inform the third-par­ties who use or process that data to com­ply with the request.

 

 

6.     Fair Processing Guidelines

Per­son­al data must only be processed when explic­it­ly autho­rised by the Data Pro­tec­tion Officer.

The Com­pa­ny must decide whether to per­form the Data Pro­tec­tion Impact Assess­ment for each data pro­cess­ing activ­i­ty accord­ing to the Data Pro­tec­tion Impact Assess­ment Guidelines.

6.1.Notices to Data Subjects

At the time of col­lec­tion or before col­lect­ing per­son­al data  for any kind of pro­cess­ing activ­i­ties includ­ing but not lim­it­ed to sell­ing prod­ucts, ser­vices, or mar­ket­ing activ­i­ties, the Data Pro­tec­tion Offi­cer is respon­si­ble to prop­er­ly inform data sub­jects of the fol­low­ing: the types of per­son­al data col­lect­ed, the pur­pos­es of the pro­cess­ing, pro­cess­ing meth­ods, the data sub­jects’ rights with respect to their per­son­al data, the reten­tion peri­od, poten­tial inter­na­tion­al data trans­fers, if data will be shared with third par­ties and the Company’s secu­ri­ty mea­sures to pro­tect per­son­al data. This infor­ma­tion is pro­vid­ed through the Pri­va­cy Notice.

If your com­pa­ny has mul­ti­ple data pro­cess­ing activ­i­ties, you will need to devel­op dif­fer­ent notices which will dif­fer depend­ing on the pro­cess­ing activ­i­ty and the cat­e­gories of per­son­al data col­lect­ed – for exam­ple, one Notice might be writ­ten for mail­ing pur­pos­es, and a dif­fer­ent one for ship­ping purposes.

Where per­son­al data is being shared with a third par­ty, the Data Pro­tec­tion Offi­cer must ensure that data sub­jects have been noti­fied of this through a Pri­va­cy Notice.

Where per­son­al data is being trans­ferred to a third coun­try accord­ing to Cross Bor­der Data Trans­fer Pol­i­cy, the Pri­va­cy Notice should reflect this and clear­ly state to where, and to which enti­ty per­son­al data is being transferred.

Where sen­si­tive per­son­al data is being col­lect­ed, the Data Pro­tec­tion Offi­cer must make sure that the Pri­va­cy Notice explic­it­ly states the pur­pose for which this sen­si­tive per­son­al data is being collected.

6.2.Obtaining Consents

When­ev­er per­son­al data pro­cess­ing is based on the data sub­jec­t’s con­sent, or oth­er law­ful grounds, the Data Pro­tec­tion Offi­cer is respon­si­ble for retain­ing a record of such con­sent. The Data Pro­tec­tion Offi­cer is respon­si­ble for pro­vid­ing data sub­jects with options to pro­vide the con­sent and must inform and ensure that their con­sent (when­ev­er con­sent is used as the law­ful ground for pro­cess­ing) can be with­drawn at any time.

Where col­lec­tion of per­son­al data relates to a child under the age of 16, the Data Pro­tec­tion Offi­cer must ensure that parental con­sent is giv­en pri­or to the col­lec­tion using the Parental Con­sent Form.

When requests to cor­rect, amend or destroy per­son­al data records, the Data Pro­tec­tion Offi­cer must ensure that these requests are han­dled with­in a rea­son­able time frame. The Data Pro­tec­tion Offi­cer must also record the requests and keep a log of these.

Per­son­al data must only be processed for the pur­pose for which they were orig­i­nal­ly col­lect­ed. In the event that the Com­pa­ny wants to process col­lect­ed per­son­al data for anoth­er pur­pose, the Com­pa­ny must seek the con­sent of its data sub­jects in clear and con­cise writ­ing. Any such request should include the orig­i­nal pur­pose for which data was col­lect­ed, and also the new, or addi­tion­al, purpose(s). The request must also include the rea­son for the change in purpose(s). The Data Pro­tec­tion Offi­cer is respon­si­ble for com­ply­ing with the rules in this paragraph.

Now and in the future, the Data Pro­tec­tion Offi­cer must ensure that col­lec­tion meth­ods are com­pli­ant with rel­e­vant law, good prac­tices and indus­try standards.

The Data Pro­tec­tion Offi­cer is respon­si­ble for cre­at­ing and main­tain­ing a Reg­is­ter of the Pri­va­cy Notices.

 

7.     Organization and Responsibilities

The respon­si­bil­i­ty for ensur­ing appro­pri­ate per­son­al data pro­cess­ing lies with every­one who works for or with the Com­pa­ny and has access to per­son­al data processed by the Company.

The key areas of respon­si­bil­i­ties for pro­cess­ing per­son­al data lie with the fol­low­ing organ­i­sa­tion­al roles:

The board of Direc­tors or oth­er rel­e­vant deci­sion mak­ing body makes deci­sions about, and approves the Company’s gen­er­al strate­gies on per­son­al data protection.

The Data Pro­tec­tion Offi­cer (DPO) or any oth­er rel­e­vant employ­ee, is respon­si­ble for man­ag­ing the per­son­al data pro­tec­tion pro­gram and is respon­si­ble for the devel­op­ment and pro­mo­tion of end-to-end per­son­al data pro­tec­tion poli­cies, as defined in Data Pro­tec­tion Offi­cer Job Description;

The Finance Direc­tor togeth­er with the Data Pro­tec­tion Offi­cer, mon­i­tors and analy­ses per­son­al data laws and changes to reg­u­la­tions, devel­ops com­pli­ance require­ments, and assists busi­ness depart­ments in achiev­ing their Per­son­al data goals.

The IT man­ag­er, is respon­si­ble for:

• Ensur­ing all sys­tems, ser­vices and equip­ment used for stor­ing data meet accept­able secu­ri­ty standards.
• Per­form­ing reg­u­lar checks and scans to ensure secu­ri­ty hard­ware and soft­ware is func­tion­ing properly.

The Market­ing man­ag­er, is respon­si­ble for:

• Approv­ing any data pro­tec­tion state­ments attached to com­mu­ni­ca­tions such as emails and letters.
• Address­ing any data pro­tec­tion queries from jour­nal­ists or media out­lets like newspapers.
• Where nec­es­sary, work­ing with the Data Pro­tec­tion Offi­cer to ensure mar­ket­ing ini­tia­tives abide by data pro­tec­tion principles.

The Finance Direc­tor is respon­si­ble for:

• Improv­ing all employ­ees’ aware­ness of user per­son­al data protection.
• Orga­niz­ing Per­son­al data pro­tec­tion exper­tise and aware­ness train­ing for employ­ees work­ing with per­son­al data.
• End-to-end employ­ee per­son­al data pro­tec­tion. It must ensure that employ­ees’ per­son­al data is processed based on the employ­er’s legit­i­mate busi­ness pur­pos­es and necessity.

The Data Pro­tec­tion Offi­cer is respon­si­ble for pass­ing on per­son­al data pro­tec­tion respon­si­bil­i­ties to sup­pli­ers, and improv­ing sup­pli­ers’ aware­ness lev­els of per­son­al data pro­tec­tion as well as flow down per­son­al data require­ments to any third par­ty a sup­pli­er they are using. The Pro­cure­ment Depart­ment must ensure that the Com­pa­ny reserves a right to audit suppliers.

 

8.     Guidelines for Establishing the Lead Supervisory Authority

8.1.Necessity to Establish the Lead Supervisory Authority

Iden­ti­fy­ing a Lead super­vi­so­ry author­i­ty is only rel­e­vant if the Com­pa­ny car­ries out the cross-bor­der pro­cess­ing of per­son­al data.

Cross bor­der of per­son­al data is car­ried out if:

a) pro­cess­ing of per­son­al data is car­ried out by sub­sidiaries of the Com­pa­ny which are based in oth­er Mem­ber States; 

              or

b) pro­cess­ing of per­son­al data which takes place in a sin­gle estab­lish­ment of the Com­pa­ny in the Euro­pean Union, but which sub­stan­tial­ly affects or is like­ly to sub­stan­tial­ly affect data sub­jects in more than one Mem­ber State.

If the Com­pa­ny only has estab­lish­ments in one Mem­ber State and its pro­cess­ing activ­i­ties are affect­ing only data sub­jects in that Mem­ber State than there is no need to estab­lish a lead super­vi­so­ry author­i­ty. The only com­pe­tent author­i­ty will be the Super­vi­so­ry Author­i­ty in the coun­try where Com­pa­ny is law­ful­ly established.

8.2.Main Establishment and the Lead Supervisory Authority

8.2.1.        Main Establishment for the Data Controller

The Com­pa­ny Direc­tors needs to iden­ti­fy the main estab­lish­ment so that the lead super­vi­so­ry author­i­ty can be determined.

If the Com­pa­ny is based in an EU Mem­ber State and it makes deci­sions relat­ed to cross-bor­der pro­cess­ing activ­i­ties in the place of its cen­tral admin­is­tra­tion, there will be a sin­gle lead super­vi­so­ry author­i­ty for the data pro­cess­ing activ­i­ties car­ried out by the Company.

If Com­pa­ny has mul­ti­ple estab­lish­ments that act inde­pen­dent­ly and make deci­sions about the pur­pos­es and means of the pro­cess­ing of per­son­al data, the Com­pa­ny Direc­tors needs to acknowl­edge that more than one lead super­vi­so­ry author­i­ty exists.

8.2.2.        Main Establishment for the Data Processor

When the Com­pa­ny is act­ing as a data proces­sor, then the main estab­lish­ment will be the place of cen­tral admin­is­tra­tion. In case the place of cen­tral admin­is­tra­tion is not locat­ed in the EU, the main estab­lish­ment will be the estab­lish­ment in the EU where the main pro­cess­ing activ­i­ties take place.

8.2.3.        Main Establishment for Non-EU Companies for Data Controllers and Processors

If the Com­pa­ny does not have a main estab­lish­ment in the EU, and it has subsidiarie(s) in the EU, then the com­pe­tent super­vi­so­ry author­i­ty is the local super­vi­so­ry authority.

If the Com­pa­ny does not have a main estab­lish­ment in the EU nor the sub­sidiaries in the EU, it must appoint a rep­re­sen­ta­tive in the EU, and the com­pe­tent super­vi­so­ry author­i­ty will be the local super­vi­so­ry author­i­ty where the rep­re­sen­ta­tive is located.

 

9.     Response to Personal Data Breach Incidents

When the Com­pa­ny learns of a sus­pect­ed or actu­al per­son­al data breach, Data Pro­tec­tion Offi­cer must per­form an inter­nal inves­ti­ga­tion and take appro­pri­ate reme­di­al mea­sures in a time­ly man­ner, accord­ing to the Data Breach Pol­i­cy. Where there is any risk to the rights and free­doms of data sub­jects, the Com­pa­ny must noti­fy the rel­e­vant data pro­tec­tion author­i­ties with­out undue delay and, when pos­si­ble, with­in 72 hours.

 

10.             Audit and Accountability

The Audit Depart­ment or oth­er rel­e­vant depart­ment is respon­si­ble for audit­ing how well busi­ness depart­ments imple­ment this Policy.

Any employ­ee who vio­lates this Pol­i­cy will be sub­ject to dis­ci­pli­nary action and the employ­ee may also be sub­ject to civ­il or crim­i­nal lia­bil­i­ties if his or her con­duct vio­lates laws or regulations.

 

11.             Conflicts of Law

This Pol­i­cy is intend­ed to com­ply with the laws and reg­u­la­tions in the place of estab­lish­ment and of the coun­tries in which iCon­nect oper­ates. In the event of any con­flict between this Pol­i­cy and applic­a­ble laws and reg­u­la­tions, the lat­ter shall prevail.

 

12.             Managing records kept on the basis of this document

Record name	Stor­age location	Per­son respon­si­ble for storage	Con­trols for record protection	Reten­tion time
Data Sub­ject Con­sent Forms	GDPR sec­tion on CRM	Data Pro­tec­tion Officer	Only autho­rized per­sons may access the forms	10 years
Data Sub­ject Con­sent With­draw­al Form	GDPR sec­tion on CRM	Data Pro­tec­tion Officer	Only autho­rized per­sons may access the forms	10 years
Parental Con­sent Form	GDPR sec­tion on CRM	Data Pro­tec­tion Officer	Only autho­rized per­sons may access the forms	10 years
Parental Con­sent With­draw­al Form	GDPR sec­tion on CRM	Data Pro­tec­tion Officer	Only autho­rized per­sons may access the forms	10 years
Sup­pli­er Data Pro­cess­ing Agreements	GDPR sec­tion on CRM	Data Pro­tec­tion Officer	Only autho­rized per­sons may access the folder	5 years after the agree­ment has expired
Reg­is­ter of Pri­va­cy Notices	GDPR sec­tion on CRM	Data Pro­tec­tion Officer	Only autho­rized per­sons may access the folder	Per­ma­nent­ly

 

13.             Validity and document management

This doc­u­ment is valid as of March 2018.

The own­er of this doc­u­ment is the Data Pro­tec­tion Offi­cer, who must check and, if nec­es­sary, update the doc­u­ment at least once a year.