- Lawful Processing
In general, the company process Personal Data where:
- Processing is necessary for the performance of a contract to which a Data Subject is a party, or to take steps at the request of a Data Subject prior to entering into such contract
- Processing is necessary to protect the vital interests of a Data Subject or of another natural person
- Processing is necessary for the purpose of legitimate interests pursued by us or a third party to whom the Personal Data has been made available. A Controller that is part of a group has a legitimate interest in transferring Personal Data within our Group for internal administrative purposes. Furthermore, processing is legitimate if it is necessary and proportionate to prevent fraud or to ensure network and information security.
Data Subject’s written consent shall be obtained to process his/her Personal Data for any other clearly defined purpose (for instance for direct marketing purposes).
- Information of Data Subject (Privacy Statement)
We have adopted a Privacy Statement by which it provides our Data Subjects with data protection information, in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, at the time of collecting the Personal Data to enable the Data Subjects to assess the implications of providing their Personal Data:
- our identity and contact details
- the contact details of the DPO, if applicable
- the purposes of the processing, as well as our lawful basis under the Data Protection Law
- if our lawful basis for the Processing is legitimate interests or compliance with any applicable law to which we are subject, we state clearly what those legitimate interests or compliance obligations are
- the categories of Personal Data relating to the Data Subject that are being processed
- the recipients or categories of recipients of the Personal Data
- where applicable, the fact that we intend to transfer Personal Data to a third country or international organisation, or reference to the appropriate or suitable safeguards and how to obtain a copy of them or where they have been made available; and
- any further information in so far as such is necessary, having regard to the specific circumstances in which the Personal Data is collected, to ensure fair and transparent processing in respect of the Data Subject, including:
- the period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period
- the existence of the right to request from us access to and rectification
- or erasure of Personal Data or restriction of processing concerning the Data Subject or to object to processing as well as the right to data portability
- where the processing is based on the Data Subject's consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of Processing based on consent before our withdrawal
- the right to lodge a complaint with the Data Protection Commissioner
- whether the Personal Data is obtained pursuant to a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the Data Subject is obliged to provide the Personal Data and the possible consequences of failure to provide such data
- if applicable, the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the possible outcomes of such processing for the Data Subject
- whether replies to questions are obligatory or voluntary, as well as the possible consequences of failure to reply
- whether the Personal Data will be used for direct marketing purposes; and
- if we intend to process Personal Data in a manner that will restrict or prevent the Data Subject from exercising his rights to request rectification or erasure of Personal Data or to object to the Processing of the Personal Data. In such cases, we:
- include a clear and explicit explanation of the expected impact on such rights; and
- satisfy ourselves that the Data Subject understands and acknowledges the extent of any such restrictions.
Where Personal Data is not obtained from the Data Subject, we shall provide the above information:
- No later than one month from obtaining the Persona Data
- If the Personal Data is used for communicating with the Data Subject, no later than the first communication
- If a disclosure to a Processor or a third party is envisaged, no later than the time when the Personal Data is first disclosed.
Our Privacy Statement is made available on our website. Data Subjects are directed to this Private Statement using weblinks in our client communications, forms, and agreements
