https___samflynn.co.uk_data-protection-policy_.xml
http___gajeta-zg.hr_politika-privatnosti_1.xml
1.1 2.1 2.2 2.3 2.4 3.1 3.2 3.3 4.1 4.2 4.3 4.4 5.1 5.2 6.1 7.1 8.1 9.1 10.1 11.1 12.1 12.2 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 41.2 42.1 42.2 43.1 44.1 45.1 46.1 46.2 47.1 47.2 48.1 48.2 49.1 50.1 51.1 51.2 51.3 52.1 52.2 53.1 54.1 54.2 54.3 55.1 55.2 56.1 56.2 57.1 57.2 57.3 57.4 57.5 58.1 59.1 60.1 60.2 61.1 62.1 62.2 63.1 64.1 64.2 64.3 65.1 66.1 67.1 68.1 69.1 69.2 69.3 70.1 71.1 71.2 71.3 72.1 73.1 73.2 74.1 75.1 75.2 76.1 77.1 77.2 78.1 79.1 80.1 80.2 80.3 80.4 80.5 80.6 81.1 82.1 83.1 83.2 83.3 83.4 83.5 83.6 84.1 84.2 85.1 86.1 86.2 86.3 86.4 86.5 87.1 88.1 88.2 89.1 90.1 90.2 90.3 90.4 91.1 92.1 92.2 92.3 93.1 94.1 94.2 94.3 95.1 96.1 96.2 97.1 97.2 97.3 98.1 99.1 100.1 101.1 101.2 101.3 101.4 102.1 103.1 103.2 104.1 104.2 105.1 106.1 106.2 106.3 107.1 108.1 109.1 109.2 110.1 111.1 111.2 111.3 111.4 111.5 111.6 111.7 111.8 112.1 113.1 113.2 114.1 114.2 115.1 115.2 115.3 115.4 115.5 116.1 117.1 117.2 117.3 117.4 118.1 118.2 118.3 119.1 120.1 121.1 121.2 121.3 122.1 123.1 123.2 123.3 123.4 124.1 124.2 124.3 124.4 124.5 124.6 125.1 126.1 127.1 127.2 127.3 128.1 128.2 129.1 129.2 130.1 130.2 131.1 131.2 131.3 131.4 131.5 132.1 133.1 133.2 134.1 135.1 135.2 135.3 136.1 136.2 137.1 137.2 138.1 139.1 140.1 140.2 141.1 141.2 142.1 142.2 143.1 143.2 144.1 145.1 146.1 146.2 147.1 147.2 147.3 148.1 148.2 149.1 149.2 150.1 151.1 151.2 151.3 151.4 151.5 151.6 152.1 152.2 152.3 153.1 154.1 154.2 154.3 154.4 155.1 155.2 156.1 157.1 157.2 157.3 157.4 157.5 158.1 158.2 159.1 159.2 160.1 161.1 162.1 163.1 164.1 165.1 165.2 166.1 166.2 166.3 166.4 167.1 167.2 167.3 168.1 168.2 168.3 168.4 168.5 169.1 169.2 170.1 170.2 171.1 171.2 171.3 172.1 173.1 173.2 174.1 174.2 175.1 175.2 176.1 177.1 178.1 179.1 180.1 181.1 182.1 183.1 184.1 185.1 186.1 187.1 187.2 188.1 188.2 189.1 190.1 190.2 190.3 191.1 191.2 192.1 192.2 193.1 194.1 194.2 194.3 195.1 195.2 196.1 196.2 197.1
Foreword In the information age we offer our customers the means to be always connected. This requires data to be collected and processed. When handling any data we adhere to this principle: When storing and transmitting data, we must ensure a high level of data protection and data security. That goes for information pertaining to our customers, prospects, business partners and employees. We view it as our duty to comply with the various legal regulations around the world that govern the collection and processing of personal data. Our top priority is to ensure universally applicable, worldwide standards for handling personal data. For us, protecting personal rights and privacy for everyone is the foundation of trust in our business relationships. Our Corporate Data Protection Policy lays out strict requirements for processing personal data pertaining to customers, prospects, business partners and employees. It meets the requirements of the European Data Protection Directive and ensures compliance with the principals of national and international data protection laws in force all over the world. The policy sets a globally applicable data protection and security standard for our company. We have established seven data protection principles – among them transparency, data economy and data security – as our guideline. We are obligated to adhere to the Corporate Data Protection Policy and observe their local data protection laws. As the Chief Officer of Corporate Data Protection, it is my duty to ensure that the rules and principles of data protection at SF2 Ltd. are followed around the world. I will be pleased to answer any questions you have about data protection and security at SF2 Ltd. Sam Flynn Managing Director, SF2 Ltd (trading as Sam Flynn Social Media) Contents - Aim of the Data Protection Policy 4 - Scope and amendment of the Data Protection Policy 4 III. Application of national laws 5 - Principles for processing personal data 5 Fairness and lawfulness Restrictions to a specific purpose Transparency Data reduction and data economy Deletion Factual accuracy; up-to-date data Confidentiality and data security - Reliability of data processing 7 - Customer and partner data 1.1 Data processing for contractual relationship 1.2 Data processing for advertising purposes 1.3 Consent to data processing 1.4 Data processing pursuant to legal authorization 1.5 Data processing pursuant to legitimate interest 1.6 Processing of highly sensitive data 1.7 Automated individual decisions 1.8 User data and internet - Employee Data 10 2.1 Data processing for the employment relationship 2.2 Data processing pursuant to legal authorization 2.3 Collective agreements on data processing 2.4 Consent to data processing 2.5 Data processing pursuant to legitimate interest 2.6 Processing of highly sensitive data 2.7 Automated decisions 2.8 Telecommunications and internet - Transmission of personal data 13 VII. Contract data processing 14 VIII. Rights of the data subject 15 - Confidentiality of processing 16 - Processing security 17 - Data protection control 17 XII. Data protection incidents 18 XIII. Responsibilities and sanctions 18 XIV. Chief Officer of Corporate Data Protection 19 - Definitions 20 - Aim of the Data Protection Policy As part of its social responsibility, SF2 Ltd. is committed to international compliance with data protection laws. This Data Protection Policy applies worldwide and is based on globally accepted, basic principles on data protection. Ensuring data protection is the foundation of trustworthy business relationships and reputation of SF2 Ltd. as an attractive employer. The Data Protection Policy provides one of the necessary framework conditions for cross-border data transmission. It ensures the adequate level of data protection prescribed by the European Union Data Protection Directive and the national laws for cross-border data transmission, including in countries that do not yet have adequate protection laws. - Scope and amendment of the Data Protection Policy This Data Protection Policy extends to all processing of personal data. In countries where the data of legal entities is protected to the same extent as personal data, this Data Protection Policy applies equally to data of legal entities. Anonymized data, e.g. for statistical evaluations or studies, is not subject to this Data Protection Policy. This Data Protection Policy will only be amended by the Chief Officer Corporate Data Protection. The latest version of the Data Protection Policy can be accessed with the data privacy information at SF2 Ltd. website: www.bestbusinessenabler.com III. Application of national laws This Data Protection Policy comprises the internationally accepted data privacy principles without replacing the existing national laws. It supplements the national data privacy laws. The relevant national law will take precedence in the event it conflicts with the Data Protection Policy, or it has stricter requirements than this Policy. The content of this Data Protection Policy must also be observed in the absence of corresponding national legislation. The reporting requirements for data processing under national laws must be observed. - Principles for processing personal data - Fairness and lawfulness When processing personal data, the individual rights of the data subjects must be protected. Personal data must be collected and processed in a legal and fair manner. - Restriction to a specific purpose Personal data can be processed only for the purpose that was defined before the data was collected. Subsequent changes to the purpose are only possible to a limited extent and require substantiation. - Transparency The data subject must be informed of how his/her data is being handled. In general, personal data must be collected directly from the individual concerned. When the data is collected, the data subject must either be aware of, or informed of: - The identity of the Data Controller • The purpose of the data processing • Third parties or categories of third parties to whom the data might be transmitted - Data reduction and data economy Before processing personal data, you must determine whether and to what extent the processing or personal data is necessary in order to achieve the purpose for which it is undertaken. Where the purpose allows and where the expense involved is in proportion with the goal being pursued, anonymized or statistical data must be used. Personal data may not be collected in advance and stored for potential future purposes unless required or permitted by national law. - Deletion Personal data that is no longer needed after the expiration of legal or business process-related periods must be deleted. There may be an indication of interests that merit protection or historical significance of this data in individual cases. If so, the data must remain on file until the interests that merit protection have been clarified legally, or the corporate archive has evaluated the data to determine whether it must be retained for historical purposes. - Factual accuracy; up-to-dateness of data Personal data on file must be correct, complete, and – if necessary – kept up to date. Suitable steps must be taken to ensure that inaccurate or incomplete data are deleted, corrected, supplemented or updated. - Confidentiality and data security Personal data is subject to data secrecy. It must be treated as confidential on a personal level and secured with suitable organizational and technical measures to prevent unauthorized access, illegal processing or distribution, as well as accidental loss, modification or destruction. - Reliability of data processing Collecting, processing and using personal data is permitted only under the following legal bases. One of these legal bases is also required if the purpose of collecting, processing and using the personal data is to be changed from the original purpose. 1 Customer and partner data 1.1 Data processing for contractual relationship Personal data of the relevant prospects, customers and partners can be processed in order to establish, execute and terminate a contract. This also includes advisory services for the partner under the contract if this is related to the contractual purpose. Prior to a contract – during the contract initiation phase – personal data can be processed to prepare proposals or purchase orders or to fulfill other requests of the prospect that relate to contract conclusion. Prospects can be contacted during the contract preparation process using the information that they have provided. Any restrictions requested by the prospects must be complied with. For advertising measures beyond that, you must observe the following requirements under V.1.2. 1.2 Data processing for advertising purposes If the data subject contacts SF2 Ltd. to request information (e.g. request to receive information material about a product or service), data processing to meet this request is permitted. Customer loyalty or advertising measures are subject to further legal requirements. Personal data can be processed for advertising purposes or market and opinion research, provided that this is consistent with the purpose for which the data was originally collected. The data subject must be informed about the use of his/her data for advertising purposes. If data is collected only for advertising purposes, the disclosure form the data subject is voluntary. The data subject shall be informed that providing data for this purpose is voluntary. When communicating with the data subject, consent shall be obtained from him/her to process the data for advertising purposes. When giving consent, the data subject should be given a choice among available forms of contact such as regular mail, email and phone (Consent, see V.1.3). 1.3 Consent to data processing Data can be processed following consent by the data subject. Before giving consent, the data subject must be informed in accordance with IV.3 of this Data Protection Policy. The declaration of consent must be obtained in writing or electronically for the purposes of documentation. In some circumstances, such as telephone conversations, consent can be given verbally. The granting of consent must be documented. 1.4 Data processing pursuant to legal authorization The processing of personal data is also permitted if national legislation requests, requires or allows this. The type and extent of data processing must be necessary for the legally authorized data processing activity, and must comply with the relevant statutory provisions. 1.5 Data processing pursuant to legitimate interest Personal data can be processed if it is necessary for a legitimate interest of SF2 Ltd. Legitimate interests are generally of a legal (e.g. collection of outstanding receivables) or commercial nature (e.g. avoiding breaches of contract). Personal data may not be processed for the purposes of a legitimate interest if, in individual cases, there is evidence that the interest of the data subject merit protection, and that this takes precedence. Before data is processed, it is necessary to determine whether there are interests that merit protection. 1.6 Processing of highly sensitive data Highly sensitive personal data can be processed only if the law requires this or the data subject has given express consent. This data can also be processed if it is mandatory for asserting, exercising or defending legal claims regarding the data subject. If there are plans to process highly sensitive data, the Chief Officer Corporate Data Protection must be informed in advance. 1.7 Automated individual decisions Automated processing of personal data that is used to evaluate certain aspects (e.g. creditworthiness) cannot be the sole basis for decisions that have negative legal consequences or could significantly impair the data subject. The data subject must be informed of the facts and results of automated individual decisions and the possibility to respond. To avoid erroneous decisions, a test and plausibility check must be made by an employee. 1.8 User data and internet If personal data is collected, processed and used on websites or in apps, the data subjects must be informed of this in a privacy statement and, if applicable, information about cookies. The privacy statement and any cookie information must be integrated so that it is easy to identify, directly accessible and consistently available for the data subjects. If use profiles (tracking) are created to evaluate the use of websites and apps, the data subjects must always be informed accordingly in the privacy statement. Personal tracking may only be effected if it is permitted under national law or upon consent of the data subject. If tracking uses a pseudonym, the data subject should be given the chance to opt out in the privacy statement. If websites or apps can access personal data in an area restricted to registered users, the identification and authentication of the data subject must offer sufficient protection during access. 2 Employee data 2.1 Data processing for the employment relationship In employment relationships, personal data can be processed if needed to initiate, carry out and terminate the employment agreement. When initiating an employment relationship, the applicants’ personal data can be processed. If the candidate is rejected, his/her data must be deleted in observance of the required retention period, unless the applicant has agreed to remain on file for a future selection process. Consent is also needed to use the data for further application processes. In the existing employment relationship, data processing must always relate to the purpose of the employment agreement if none of the following circumstances for authorized data processing apply. If it should be necessary during the application procedure to collect information on an applicant from a third party, the requirements of the corresponding national laws have to be observed. In cases of doubt, consent must be obtained from the data subject. There must be a legal authorization to process personal data that is related to the employment relationship but was not originally part of performance of the employment agreement. This can include legal requirements, collective regulations with employee representatives, consent of the employee, or the legitimate interest of the company. 2.2 Data processing pursuant to legal authorization The processing of personal employee data is also permitted if national legislation requests, requires or authorizes this. The type and extent of data processing must be necessary for the legally authorized data processing activity, and must comply with the relevant statutory provisions. If there is some legal flexibility, the interests of the employee that merit protection must be taken into consideration. 2.3 Collective agreements on data processing If a data processing activity exceeds the purposes of fulfilling, it may be permissible if authorized through a collective agreement. Collective agreements are pay scale agreements or agreements between employers and employee representatives, within the scope allowed under the relevant employment law. The agreement must cover the specific purpose of the intended data processing activity, and must be drawn up within the parameters of national data protection legislation. 2.4 Consent to data processing Employee data can be processed upon consent of the person concerned. Declarations of consent must be submitted voluntarily. Involuntary consent is void. The declaration of consent must be obtained in writing or electronically for the purposes of documentation. In certain circumstances, consent may be given verbally, in which case it must be properly documented. In the event of informed, voluntary provision of data by the relevant party, consent can be assumed if national laws do not require express consent. Before giving consent, the data subject must be informed in accordance with IV.3. of this Data Protection Policy. 2.5 Data processing pursuant to legitimate interest Personal data can be processed if it is necessary to enforce a legitimate interest of SF2 Ltd. Legitimate interests are generally of a legal (e.g. filing, enforcing or defending against legal claims) or financial (e.g. valuation of company) nature. Personal data may not be processed based on legitimate interest if, in individual cases, there is evidence that the interests of the employee merit protection. Before data is processed, it must be determined whether there are interests that merit protection. Control measures that require processing of employee data can be taken only if there is a legal obligation to do so or there is a legitimate reason. Even if there is a legitimate reason, the proportionality of control must also be examined. The justified interests of the company in performing the control measure (e.g. compliance with legal provisions and internal company rules) must be weighed against any interests meriting protection that the employee affected by the measure may have in its exclusion, and cannot be performed unless appropriate. The legitimate interests of the company and any interests of the employee meriting protection must be identified and documented before any measures are taken. Moreover, any additional requirements under national law (e.g. rights of co-determination for the employee representatives and information rights of the data subjects) must be taken into account. 2.6 Processing of highly sensitive data Highly sensitive data can be processed only under certain conditions. Highly sensitive data is data about racial and ethnic origin, political beliefs, religious or philosophical beliefs and health and sexual life of the data subject. Under national law, further data categories can be considered highly sensitive or the content of the data categories can be filled out differently. Moreover, data that relates to a crime can often be processed only under special requirements under national law. The processing must be expressly permitted or prescribed under national law. Additionally, processing can be permitted if it is necessary for the responsible authority to fulfill its rights and duties in the area of employment law. The employee can also expressly consent to processing. If there are plans to process highly sensitive data, the Chief Officer Corporate Data Protection must be informed in advance. 2.7 Automated decisions If personal data is processed automatically as part of the employment relationship, and specific personal details are evaluated (e.g. as part of personnel selection or the evaluation of skills profiles), this automatic processing cannot be the sole basis for decisions that would have negative consequences or significant problems for the affected employee. To avoid erroneous decisions, the automated process must ensure that a natural person evaluates the consent of the situation, and that this evaluation is the basis for the decision. The data subject must also be informed of the facts and results of automated individual decisions and the possibility to respond. 2.8 Telecommunications and internet Telephone equipment, e-mail addresses, intranet and internet along with internal social networks are provided by the company primarily for work-related assignments. They are a tool and a company resource. They can be used within the applicable legal regulations and internal company policies. In the event of authorized use for private purposes, the laws on secrecy of telecommunications and the relevant national telecommunications laws must be observed if applicable. There will be no general monitoring of telephone and e-mail communications or intranet/internet use. To defend against attacks on the IT infrastructure or individual users, protective measures can be implemented for the connections to the SF2 Ltd. network that block technically harmful content or that analyze the attack patterns. For security reasons, the use of telephone equipment, e-mail addresses, the intranet/internet and internal social networks can be logged for a temporary period. Evaluations of this data from a specific person can be made only in a concrete, justifiable case of suspected violations of laws or policies of SF2 Ltd. The evaluations can be conducted only by investigating officers while ensuring that the principle of proportionality is met. The relevant national laws must be observed in the same manner Company regulations. - Transmission of personal data Transmission of personal data to recipients outside or inside SF2 Ltd. is subject to authorization requirements for processing personal data under section V. The data recipient must be required to use the data only for the defined purposes. In the event that data is transmitted to a recipient outside of SF2 Ltd. to a third country this country must agree to maintain a data protection level equivalent to this Data Protection Policy. In the alternative, the laws of the domiciliary country can acknowledge the purpose of data transmission based on the legal obligation of a third country. It must be ensured that the data can be used for the intended purpose. The data subject is entitled to assert his or her rights against the company exporting the data. In the event of claims of violation, the company exporting the data must document to the data subject that the company importing the data in a third country (in the event that the data is further processed after receipt) did not violate this Data Protection Policy. In the case of personal data being transmitted from the European Economic Area to a company located in a third country, the data controller transmitting the data shall be held liable for any violations of this Policy committed by the company in a third country with regard to the data subject whose data was collected in the European Economic Area, as if the violation had been committed by the data controller transmitting the data. The legal venue is the responsible court where the company exporting the data is located. VII. Contract data processing Data processing on Behalf means that a provider is hired to process personal data, without being assigned responsibility for the related business process. In these cases, an agreement on Data Processing on Behalf must be concluded with external providers and SF2 Ltd. The client retains full responsibility for correct performance of data processing. The provider can process personal data only as per the instructions from the client. When issuing the order, the following requirements must be complied with; the department placing the order must ensure that they are met. - The provider must be chosen based on its ability to cover the required technical and organizational protective measures. The order must be placed in writing. The instructions on data processing and the responsibilities of the client and provider must be documented. The contractual standards for data protection provided by the Chief Officer Corporate Data Protection must be considered. Before data processing begins, the client must be confident that the provider will comply with the duties. A provider can document its compliance with data security requirements in particular by presenting suitable certification. Depending on the risk of data processing the reviews must be repeated on a regular basis during the term of the contract. - In the event of cross-border data processing, the relevant national requirements for disclosing personal data abroad must be met. In particular, personal data from the European Economic Area can be processed in a third country only if the provider can prove that it has Data protection standards equivalent to this Data Protection Policy. Suitable tools can be: Agreement on EU standard contract clauses for contract data processing in third countries with the provider and any subcontractors. Participation of the provider in a certification system accredited by the EU for the provision of a sufficient data protection level. iii. Acknowledgement of binding corporate rules of the provider to create a suitable level of data protection by the responsible supervisory authorities for data protection. VIII. Rights of the data subject Every data subject has the following rights. Their assertion is to be handled immediately by the responsible unit and cannot pose any disadvantage to the data subject. - The data subject may request information on which personal data relating to him/her has been stored, how the data was collected, and for what purpose. If there are further rights to view the employer’s documents (e.g. personnel file) for the employment relationship under the relevant employment laws, this will remain unaffected. If personal data is transmitted to third parties, information must be given about the identity of the recipient or the categories of recipients. If personal data is incorrect or incomplete, the data subject can demand that it be corrected or supplemented. The data subject can object to the processing of his or her data for purposes of advertising or market/opinion research. The data must be blocked from these types of use. - The data subject may request his/her data to be deleted if the processing of such data has no legal basis, or if the legal basis has ceased to apply. The same applies if the purpose behind the data processing has lapsed or ceased to be applicable for other reasons. Existing retention periods and conflicting interests meriting protection must be observed. The data subject generally has a right to object to his/her data being processed, and this must be taken into account if the protection of his/her interests takes precedence over the interest of the data controller owing to a particular personal situation. This does not apply if a legal provision requires the data to be processed. Additionally, ever data subject can assert the rights under III, IV, V, Vi, IX, X and XIV as a Para. 3 as a third-party beneficiary if a company that has agreed to comply with the Data Protection Policy does not observe the requirements and violates the party’s rights. - Confidentiality of processing Personal data is subject to data secrecy. Any unauthorized collection, processing, or use of such data by employees is prohibited. Any data processing undertaken by an employee that he/she has not been authorized to carry out as part of his/her legitimate duties is unauthorized. The “need to know” principle applies. Employees may have access to personal information only as is appropriate for the type and scope of the task in question. This requires a careful breakdown and separation, as well as implementation, of roles and responsibilities. Employees are forbidden to use personal data for private or commercial purposes, to disclose it to unauthorized persons, or to make it available in any other way. Supervisors must inform their employees at the start of the employment relationship about the obligation to protect data secrecy. This obligation shall remain in force even after employment has ended. - Processing security Personal data must be safeguarded from unauthorized access and unlawful processing or disclosure, as well as accidental loss, modification or destruction. This applies regardless of whether data is processed electronically or in paper form. Before the introduction of new methods of data processing, particularly new IT systems, technical and organizational measures to protect personal data must be defined and implemented. These measures must be based on the state of the art, the risks of processing, and the need to protect the data (determined by the process for information classification). In particular, the responsible department can consult with its Information Security Officer (ISO) and data protection coordinator. The technical and organizational measures for protecting personal data are part of Corporate Information Security management and must be adjusted continuously to the technical developments and company changes. - Data protection control Compliance with the Data Protection Policy and the applicable data protection laws is checked regularly with data protection audits and other controls. The performance of these controls is the responsibility of the Chief Officer Corporate Data Protection, the data protection coordinators and others within the company with audit rights or external auditors hired. The results of the data protection controls must be reported to the Chief Officer Corporate Data Protection. On request, the results of data protection controls will be made available to the responsible data protection authority. The responsible data protection authority can perform its own controls of compliance with the regulations of this Policy, as permitted under national law. XII. Data protection incidents All employees must inform their supervisor, data protection coordinator or the Chief Officer Corporate Data Protection immediately about cases of violations against this Data Protection Policy or other regulations on the protection of personal data (data protection incidents). The manager responsible for the function of the data is required to inform the responsible data protection coordinator or the Chief Officer Corporate Data Protection immediately about data protection incidents. In cases of: - Improper transmission of personal data to third parties, • Improper access by third parties to persona data, or • Loss of personal data the required company reports (Information Security Incident Management) must be made immediately so that any reporting duties under national law can be complied with. XIII. Responsibilities and sanctions The company is required to ensure that the legal requirements, and those contained in the Data Protection Policy, for data protection are met (e.g. national reporting duties). Management staff are responsible for ensuring that organizational, HR and technical measures are in place so that any data processing is carried out in accordance with data protection. Compliance with these requirements is the responsibility of the relevant employees. If official agencies perform data protection controls, the Chief Officer Corporate Data Protection must be informed immediately. The data protection coordinators are the contact persons on site for data protection. They can perform checks and must familiarize the employees with the content of data protection policies. The relevant management is required to assist the Chief Officer Corporate Data Protection and the data protection coordinators with their efforts. Those responsible for business process and projects must inform the data protection coordinators in good time about new processing of personal data. For data processing plans that may pose special risks to the individual rights of the data subjects, the Chief officer Corporate Data Protection must be informed before processing begins. This applies in particular to extremely sensitive personal data. The managers must ensure their employees are sufficiently trained in data protection. Improper processing of personal data, or other violations of the data protection laws, can be criminally prosecuted in many countries and result in claims for compensation of damage. Violations for which individual employees are responsible can lead to sanctions under employment law. XIV. Chief Officer of Corporate Data Protection The Chief officer Corporate Data Protection, works towards the compliance with national and international data protection regulations. He/She is responsible for the Data Protection Policy, and supervises its compliance. The Chief Officer Corporate Data Protection is appointed by SF2 Ltd. The data protection coordinators shall promptly inform the Chief Officer Corporate Data Protection of any data protection risks. Any data subject may approach the Chief Officer Corporate Data Protection, or the relevant data protection coordinator, at any time to raise questions, request information or make complaints relating to the data protection or data security issues. If requested, concerns and complaints will be handled confidentially. If the data coordinator in question cannot resolve a complaint or remedy a breach of the Policy for data protection, the Chief Officer Corporate Data Protection must be consulted immediately. Decisions made by the Chief Officer Corporate Data Protection to remedy data protection breaches must be upheld by the management of the company in question. Inquiries by supervisory authorities must always be reported to the Chief Officer Corporate Data Protection. Contact details for the Chief Officer Corporate Data Protection and staff are as follows: Chief Officer Corporate Data Protection SF2 Ltd, 217 Finney Lane Heald Green Cheshire SK8 3PX Email: hello@samflynn.com - Definitions - Data is anonymized if personal identity can never be traced by anyone, or if the personal identity could be recreated only with an unreasonable amount of time, expense and labour. • Consent is the voluntary, legally binding agreement to data processing. • Data protection incidents are all events where there is justified suspicion that personal data is being illegally captured, collected, modified, copied, transmitted or used. This can pertain to actions by third parties or employees. • Data subject under this Data Protection Policy is any natural person whose data can be processed. In some countries, legal entities can be data subjects as well. • The European Economica Area (EEA) is an economic region associated with the EU, and includes Norway, Iceland and Liechtenstein. • Highly sensitive data is data about racial and ethnic origin, political opinions, religious or philosophical beliefs, union membership or the health and sexual life of the data subject. Under national law, further data categories can be considered highly sensitive or the content of the data categories can be structured differently. Moreover, data that relates to a crime can often be processed only under special requirements under national law. - Personal data is all information about a certain or definable natural persons. A person is definable for instance if the personal relationship can be determined using a combination of information with even incidental additional knowledge. • Processing personal data means any process, with or without the use of automated systems, to collect, store, organize, retain, modify, query, use, forward, transmit, disseminate or combine and compare data. This also includes disposing of, deleting and blocking data and data storage media. • Processing personal data is required if the permitted purpose or justified interest could not be achieved without the personal data, or only with exceptionally high expense. • A sufficient level of data protection in third countries is acknowledged by the EU Commission if the core of the personal privacy, as unanimously defined in the member countries of the EU is adequately ensured. When making its decision, the EU Commission accounts for all circumstances that play a role in data transmission or a category of data transmission. This includes the opinions under national law and relevant applicable professional standards and security measures. • Third countries under the Data Protection Policy are all nations outside the European Union/EEA. This does not include countries with a data protection level that is considered sufficient by the EU Commission. • Third parties are anyone apart from the data subject and the Data Controller. In a case of Data Processing in Behalf data processors in the EU are not third parties under the data protection laws, because they are assigned by law to the responsible entity. • Transmission is all disclosure of protected data by the responsible entity to third parties.
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 22.2 23.1 24.1 24.2 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 40.2 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 57.3 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 69.2 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1
OPĆA POLITIKA O ZAŠTITI OSOBNIH PODATAKA - Općenito Opća politika zaštite osobnih podataka opisuje svrhu i ciljeve prikupljanja, obrade i upravljanja osobnim podacima od strane GAJETA d.o.o. Cankareva 6, 10000 Zagreb, OIB: 38448070359 (u daljnjem tekstu Voditelj obrade) te osigurava adekvatnu razinu zaštite osobnih podataka u skladu s Općom uredbom o zaštiti podataka ( Uredba EU 2016/679 ) i Zakonom o provedbi Opće uredbe o zaštiti podataka ( NN 42/2018 ). Cilj jest uspostaviti primjerene procese zaštite i upravljanja osobnim podacima ispitanika, a primjenjuje se na sve obrade osobnih podataka, osim u slučaju gdje se obrađuju anonimizirani podaci ili su obrade takve prirode da se radi o statističkim analizama iz kojih nije moguće identificirati pojedinca. Pojmovi * osobni podaci - su svi podaci koji se odnose na pojedinca (ispitanika) čiji je identitet utvrđen ili se može utvrditi Pojedinac čiji se identitet može utvrditi jest osoba koje se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. * obrada podataka - svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim ili neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodna, izmjena, pronalaženje, vršenje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanje na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. * izrada profila - svaki oblik automatizirane obrade i upotrebe osobnih podataka radi ocjene određenih osobnih aspekata povezanih s pojedincem radi analize ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, lokacijom, kretanjem tog pojedinca * voditelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka, kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice * izvršitelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje podatke u ime voditelja obrade * primatelj - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome da li je on treća strana * treća strana - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka koji se na njega odnose * privola - svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose * povreda osobnih podataka - kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani * nadzorno tijelo - u Republici Hrvatskoj - Agencija za zaštitu osobnih podataka * usluga informacijskog društva - usluga definirana čl. 1 st. 1 točkom 2 Direktive 2015/1535 Europskog parlamenta i Vijeća - svaka usluga informacijskog društva, to jest svaka usluga koja se obično pruža uz naknadu, na daljinu, elektroničkim sredstvima te na osobni zahtjev primatelja usluga - Načela obrade podataka Načela obrade podataka su osnovna pravila kojih se pridržavamo prilikom obrade osobnih podataka ispitanika, a to su: * zakonitost i poštenost - obrađujemo osobne podatke ispitanika sukladno važećim zakonima i poštujući sva prava ispitanika * transparentnost - pružamo ispitanicima sve potrebne informacije te na zahtjev osiguravamo uvid u njihove osobne podatke koje obrađujemo. Ispitanik će ujedno biti, prije samog prikupljanja osobnih podataka, upoznat sa svrhom obrade i svojim pravima * ograničenje svrhe - osobne podatke prikupljamo u posebne, jasne i zakonite svrhe te iste ne obrađujemo u svrhe za koje privola nije dana, osim za obrade koje su uvjetovane zakonom ili su neophodne za kvalitetnu isporuku usluge ili dostave * ograničenje pohrane - osobne podatke ispitanika čuvamo u obliku koji omogućava identifikaciju ispitanika samo onoliko dugo koliko je to potrebno u svrhu ili svrhe radi kojih se osobni podaci obrađuju. Mi možemo pohraniti osobne podatke na duži vremenski period, ukoliko nam to nalaže posebni zakonski propis ili legitimni interes ( npr. sudski spor) * smanjenje količine podataka - osobne podatke obrađujemo na način da su primjereni, relevantni i ograničeni u odnosu na svrhu ili svrhe za koje se obrađuju. * točnost - osobni podaci koje obrađujemo moraju biti točni i po potrebi ažurirani * cjelovitost i pouzdanost - osobne podatke obrađujemo na način kojim se osigurava odgovarajuća sigurnost osobnih podataka, uključujući zaštitu od neovlaštene ili nezakonite obrade te od slučajnog gubitka, uništenja ili oštećenja, primjenom odgovarajućih tehničkih i organizacijskih mjera. - Zakonitost obrade Obrada osobnih podataka je zakonita samo ako je ispunjen jedan od niže navedenih uvjeta: * ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više svrha * obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora * obrada je nužna radi poštovanja pravnih obveza voditelja obrade * obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtjevaju zaštitu obrade osobnih podataka, osobito ako je ispitanik dijete. Pod legitimnim interesom smatrane su obrade koje služe npr. da bi se unaprijedio i modernizirao proces razvoja proizvoda i usluga, ponudili proizvodi i usluge koje bi ispitaniku olakšali poslovanje sa voditeljem obrade ili npr. u svrhu sudskih sporova * obrada je nužna kako bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe * obrada je nužna za izvršavanje zadaća od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade - Prava ispitanika U trenutku prikupljanja podataka ispitaniku ćemo pružiti sljedeće informacije: identitet i kontakt podatke voditelja obrade, svrhe obrade radi kojih se prikupljaju osobni podaci, pravnu osnovu za obradu, legitimne interese, primatelje ili kategorije primatelja osobnih podataka, ukoliko isti postoje, namjeru prijenosa osobnih podataka trećim zemljama, ukoliko ista postoji, razdoblje pohrane podataka ili kriterije koji definiraju to razdoblje, sva prava ispitanika, potencijalno postojanje automatiziranog donošenja odluka što podrazumijeva i izradu profila (smislene informacije o kojoj logici obrade je riječ, potencijalnim posljedicama i važnosti same obrade za ispitanika). U slučaju da se osobni podaci ne prikupljanju od ispitanika, navodimo i izvor osobnih podataka. * pravo na pristup - ispitanik ima pravo dobiti potvrdu obrađuju li se njegovi osobni podaci te ako se takvi podaci obrađuju, pristup osobnim podacima i svrsi obrade, * pravo na ispravak - ispitanik ima pravo bez nepotrebnog odgađanja ishoditi ispravak netočnih osobnih podataka koji se odnose na njega. Uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, među ostalima i davanjem dodatne izjave. * pravo na brisanje ("pravo na zaborav")- ispitanik ima pravo ishoditi brisanje osobnih podataka koji se na njega odnose, a mi imamo obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako je ispunjen jedan od sljedećih uvjeta: - osobni podaci više nisu nužni u odnosu na svrhe za koje su prikupljeni ili na drugi način obrađeni - ispitanik povuče privolu na kojoj se obrada temelji, a ne postoji druga pravna osnova za obradu, ispitanik uloži prigovor na obradu, a legitimni razlozi za realizaciju prava na brisanje su veći od legitimnog interesa nas kao voditelja obrade za obradu i/ili čuvanje podataka - osobni podaci su nezakonito obrađeni - osobni podaci moraju se brisati radi poštovanja pravne obveze propisane pravom Unije ili pravom Republike Hrvatske - osobni podaci su prikupljeni u vezi s ponudom usluge informacijskog društva izravno djetetu ispod dobne granice od 16 godina * pravo na ograničenje obrade - ispitanik ima pravo od nas tražiti ograničenje obrade osobnih podataka u slučaju da se osporava njihova točnost, kada je obrada nezakonita ( a ispitanik se protivi brisanju osobnih podataka te umjesto toga traži ograničenje njihove uporabe), te u slučaju kada je ispitanik uložio prigovor na obradu osobnih podataka očekujući potvrdu nadilaze li legitimni razlozi voditelja obrade razloge ispitanika * pravo na prijenos podataka - ispitanik ima pravo zaprimiti svoje osobne podatke koji se na njega odnose, a koje nam je dao temeljem svoje privole, u strukturiranom, uobičajeno upotrebljavanom i strojno čitljivom formatu te ima pravo tražiti prijenos tih podataka drugom voditelju obrade, ukoliko je tehnički izvedivo. * pravo na prigovor - ispitanik ima pravo na temelju svoje posebne situacije u svakom trenutku uložiti prigovor na obradu osobnih podataka koji se odnose na njega. Mi u takvoj situaciji više ne smijemo obrađivati osobne podatke, osim ako dokažemo da postoje legitimni razlozi za daljnju obradu koji nadilaze interese, prava i slobode ispitanika ili radi postavljanja, ostvarivanja ili obrane pravnih zahtjeva. Nadalje, ako se osobni podaci obrađuju za potrebe izravnog marketinga, ispitanik u svakom trenutku ima pravo uložiti prigovor na obradu osobnih podataka koji se odnose na njega, što uključuje i izradu profila u mjeri koja je povezana s takvim izravnim marketingom. Dodatno, ispitanik ima pravo zatražiti da se na njega ne odnosi odluka koja se temelji isključivo na automatiziranoj obradi, uključujući izradu profila, koja proizvodi učinke na njega ili na sličan način značajno na njega utječu, osim ako je ta odluka: - dopuštena zakonom - potrebna za izvršavanje odluka između ispitanika i voditelja obrade - temeljena na izričitoj privoli ispitanika Ispitanik svoja prava može ostvariti u svakom trenutku na način da nas kontaktira na: GAJETA d.o.o. Cankareva 6, 10000 Zagreb, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. Ispitaniku će biti pružene informacije o poduzetim radnjama najkasnije u roku od mjesec dana od dana zaprimanja zahtjeva. Ukoliko je obrada zahtjeva složena ili se radi o velikom broju zahtjeva, taj rok se može produžiti za još dva mjeseca, ali će u tome slučaju ispitanik biti izvješten o razlozima eventualnog produljenja roka. Također, ukoliko se ne postupi po zahtjevu ispitanika u roku od mjesec dana od primitka zahtjeva, o odluci će ispitanik biti izvješten uz navođenje razloga za takvu odluku te njegovoj mogućnosti podnošenja pritužbe Agenciji za zaštitu osobnih podataka, Martićeva 14, 10000 Zagreb. U slučaju da su zahtjevi ispitanika očito neutemeljeni ili pretjerani, osobito zbog njihovog učestalog ponavljanja, možemo naplatiti razumnu naknadu na temelju administrativnih troškova ili odbiti postupati po zahtjevu ispitanika. - Sigurnost i obveze U nekim poslovnim procesima se pojavljujemo kao voditelji obrade, u tome slučaju samostalno određujemo svrhu i način obrade osobnih podataka, međutim, u nekim poslovnim procesima smo u ulozi izvršitelja obrade, u kojem situacijama obrađujemo osobne podatke u ime voditelja obrade. U skladu s time kontinuirano provodimo odgovarajuće tehničke i organizacijske mjere zaštite kako bi zaštitili osobne podatke ispitanika, u kojoj god da se ulozi nalazimo. Osobne podatke čuvamo u skladu sa našim integriranim standardima sigurnosti, a gdje je to primjenjivo, koristimo kriptografske metode zaštite podataka te unapređujemo sigurnosne mjere u svrhu sprječavanja povrede osobnih podataka ispitanika. Ne dopuštamo neovlašteno prikupljanje, obradu ili korištenje osobnih podataka te primjenjujemo pravilo ograničavanja pristupa podacima samo na one podatke koji su potrebni za obavljanje pojedinih poslovnih zadataka, sukladno našim internim odlukama. Osobne podatke štitimo od neovlaštenog pristupa, korištenja, izmjene te gubitka neovisno od toga da li su isti pohranjeni u papirnatom ili elektroničkom obliku. - Povreda osobnih podataka U slučaju da dođe do povrede osobnih podataka, svi naši radnici imaju dužnost obavijestiti odgovorne osobe o povredi bez odgode, a mi kao voditelji obrade smo dužni, bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvijestiti nadzorno tijelo odnosno Agenciju za zaštitu osobnih podataka. U slučaju da se nalazimo u ulozi izvršitelja obrade, o povredi obavještavamo u tome slučaju voditelja obrade podataka. Ukoliko je riječ o povredi osobnih podataka koja će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, o povredi ćemo obavijestiti i ispitanika, osim ako: - su poduzete odgovarajuće tehničke i organizacijske mjere zaštite i te su mjere primijenjene na osobne podatke obuhvaćene povredom osobnih podataka, posebno one koje osobne podatke čine nerazumljivima bilo osobi koja im nije ovlaštena pristupiti, kao što je enkripcija - su poduzete naknadne mjere kojima se osigurava da više nije vjerojatno da će doći do visokog rizika za prava i slobode ispitanika - bi se time zahtijevao nerazmjeran napor, u kojem slučaju mora postojati javna obavijest ili slična mjera kojom se ispitanici obavještavaju na jednako djelotvoran način Ispitanik ima pravo podnijeti pritužbu nadzornom tijeku - Agenciji za zaštitu osobnih podataka u slučaju - povrede njegovih osobnih podatka ili - ako drži da se njegova prava grubo krše sukladno Općom uredbom o zaštiti osobnih podataka - Završne odredbe Ova Opća politika stupa na snagu danom donošenja, a dostupna je u poslovnim prostorijama na oglasnoj ploči GAJETA d.o.o. Zagreb, 25.05.2018. godine GAJETA d.o.o. kojeg zastupa direktor Jasminka Jović