Personal Data Protection Policy

#PERSONAL DATA PROTECTION POLICY – A TEMPLATE

1. 1.This “Personal Data Protection Policy” (“Policy”) constitutes a map of requirements, rules and regulations concerning data protection in the Company. This Policy is a data protection policy as understood in the GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
2. 2.This Policy consists of:
   1. a)the description of personal data protection rules in the Company;
   2. b)references to appendices and other documents specifying data protection rules in the Company;
3. 3.Responsibility.

Responsibility for implementing, executing, maintaining, reviewing and updating of this Policy relies

1. i)with the Board, within the Board:
2. ii)on a Member of the Board responsible for personal data protection; and on
3. iii)a manager appointed by the Board to ensure compliance with personal data protection;
4. Responsibility for supervising and monitoring compliance with the Policy relies:
5. iv)on a Data Protection Officer, if appointed;
6. v)on internal audit department, if existing in the Company Responsibility for the application of this Policy relies on:
7. vi)the Company;
8. vii)the department responsible for information security;
9. viii)departments processing special categories of data or criminal data;
10. ix)departments processing data on a big scale;
11. x)any other departments;
12. xi)all personnel of the Company.

The Company ensures that recipients of personal data (including data processors) receiving data from the Company comply with this Policy to the extent adequate to the scope and nature of a particular data transfer in question.

Abbreviations and definitions

Policy means this Personal Data Protection Policy.

GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

data means personal data, unless other meaning is apparent from the context.

sensitive data means special category data and criminal data.

Special category data means data enlisted in the art. 9 of the GDPR, that is: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Criminal data means data enlisted in the art.10 of the GDPR, that is data relating to criminal convictions and offences.

Children’s data means data of persons under 16 years of age. individual means a data subject, unless other meaning is apparent from the context.

Processor means an organisation to whom the Company has entrusted data processing (such as an IT support provider, outsourced accounting). Profiling means any form of automated processing of data consisting of the use of data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Data Export means transfer of personal data outside of the European Economic Area (EEA) i.e. to third countries or international organisations DPO or Officer means Data Protection Officer.

RPA or Record means a record of processing activities.

#5 PRINCIPLES OF DATA PROTECTION

Pillars:

1. 1)The Company takes care of privacy protection and processes data in accordance to the law (Lawfulness).
2. 2)The Company takes adequate steps to ensure an appropriate level of data security (Security).
3. 3)The Company performs and facilitates data subjects requests (Data subjects rights).

Foundations

1. 4)The Company documents compliance and performance to be able to demonstrate compliance at any given time (Accountability).
2. 5)The Company assesses the risks it generates to individuals whose data it is processing and applies data security and compliance measures adequate to those risks (Risk Based Approach)

Principles

The Company processes data according to the following principles:

1. 1)based on a legal basis and in accordance with the law (lawfulness);
2. 2)fairly to individuals and with integrity (fairness);
3. 3)transparently, especially from the perspective of individuals (transparency);
4. 4)for specific purposes only and not “just in case” (purpose limitation, minimisation);
5. 5)no more than necessary (adequacy / data minimisation);
6. 6)taking care for data accuracy and updating (accuracy);
7. 7)no longer than necessary (storage limitation / retention);
8. 8)securely i.e. providing an adequate level of security (data security / integrity and confidentiality)

System of data protection in the Company

A Company’s data protection system consists of the following elements:

1. 1)Data inventory. The Company identifies its data resources, classifies data, identifies how data resources are used for data processing, including:
   1. a)when special categories data or criminal data are processed;
   2. b)when the Company processes data of individuals of identity unknown to the Company (“unidentified data” / “UFO data”);
   3. c)when children’s data or data of other persons requiring special attention are being processed;
   4. d)joint controllership
   5. e)significant parallel controllership (i.e. when in the same situation the Company and other entities are processing same data however with little influence on each other – e.g. corporate fan page on Facebook).
2. 2)Record of Processing. The Company maintains the record of processing activities in the Company (Record of Processing). The Record of Processing is a tool of accountability – demonstrating data protection compliance in the Company.
3. 3)Legal grounds. The Company ensures, identifies and verifies legal grounds for processing and records them in the Record of Processing, as well as:
   1. a)systematically manages consents for data processing and for remote direct marketing communication (electronic and telephone);
   2. b)records and performs legitimate interest analysis for processing based on a legitimate interest of a Company or a third party.
4. 4)Data subjects rights. The Company fulfils its information duties towards data subjects and timely processes data subjects’ requests, and in particular:
   1. a)Information duties. The Company provides data subjects with information required by law while collecting data as and when required in other situations and documents fulfilment of this duty.
   2. b)Ability to comply. The Company ensures that each data subject right can be properly served by the Company and its processors.
   3. c)Handling requests. The Company ensures appropriate budget, other resources and procedures to timely process data subjects’ requests and to document it.
   4. d)Data breach communication. The Company has a procedure in place to verify if a personal data breach needs to be communicated to affected data subjects.
5. 5)Minimisation. The Company has appropriate minimisation (privacy by default) management procedures in place, including:
   1. a)data adequacy management
   2. b)data limitation management
   3. c)data access management
   4. d)data retention management
6. 6)Security. The Company ensures an adequate level of data security, and in particular:
   1. a)performs risk analysis for processing operations or activities or categories thereof;
   2. b)performs data protection impact assessment, where a risk to the rights and freedoms of natural persons is high as well as a routine part of change management (privacy by design);
   3. c)adjusts technical and organisational data protection measures to the risk assessed;
   4. d)has an information security management system in place;
   5. e)has data breach management procedures in place allowing for identification of a data breach, assessment, response, and notification to the supervisory authority
7. 7)Processors The Company has appropriate rules of data processors selection and verification, requirements for data processing (e.g.
8. template data processing agreement or checklist), rules on verification of the performance of processing agreements.
9. 8)Extra EU data transfer. The Company has rules in place to identify if the Company transfers data to third countries (meaning outside the EU, Norway, Lichtenstein and Iceland) or to international organisations and to ensure the lawfulness of such transfer.
10. 9)Privacy by design. The Company manages change impacting privacy or data protection. Procedures on initiating projects and investments in the Company take into account the necessity of assessing privacy and data protection impact, preferably in a form of a data protection impact assessment, allowing to ensure privacy (including compliance of purposes of data processing, security and data minimisation) at the stage of designing of a change, investment or a beginning of a new project.
11. 10)Cross-border processing. The Company has rules in place to verify whether it processes data cross-border and rules on determining the lead authority and the main establishment as understood by the GDPR.

Inventory

1. 6.1.Sensitive data

The Company identifies cases where it processes or may be processing special categories data or criminal data and maintains dedicated mechanisms that ensure compliance of such processing.

Unidentified data

The Company identifies cases where it processes or may be processing unidentified data and maintains mechanisms allowing the fulfilment of rights of data subjects concerned by such processing.

Profiling

The Company identifies cases where it uses data for profiling and maintains mechanisms that ensure compliance of this process with the law.

Joint controllership and parallel controllership

The Company identifies cases of joint controllership of data as well as situations where s parallel data controlling may take place.

Record of Processing

1. 7.1.The Record of Processing documents processing activities in the Company, constitutes a map of data processing and is a crucial element to comply with the rule of accountability.
2. 7.2.The Company maintains the Record of Processing, in which it records data processing activities and monitors the way it uses personal data.
3. 7.3.Each data processing activity identified by the Company should be recorded with at least: (i) the name of the processing activity, (ii) the purpose of the processing, (iii) a description of categories of data subjects, (iv) a description of categories of data, (v) legal basis of processing along with a specification of a legitimate interests, if a legitimate interest is a basis for processing, (vi) ways of data collection, (vii) description of the categories of data recipients (including processors), (viii) information on an extra EU data transfer, (ix) a general description of the technical and organisational data security measures.

Legal Basis

1. 8.1.The Company records legal basis for data processing in the Record of Processing separately for every processing activity.
2. 8.2.While pointing to a particular legal basis (consent, contract, legal obligation, vital interests, public interests/official authority, legitimate interest of the Company), the Company provides a clarification when necessary. For instance, while relying on consent the Company demonstrates its scope, for legal obligation Company points to a specific legal provision, for vital interests – the Company describes categories of events, where such vital interests materialise, for legitimate interest – the Company points to a specific legitimate interest, such as self or third party marketing, claims handling, etc.
3. 8.3.The Company implements consent management methods enabling registration and verification of having consent of a data subject for processing hers/his data for specific purposes, for electronic communication (email, phone, text messages, others) and for registration of a consent refusal, withdrawal and other similar actions (objection, restriction request etc.)
4. 8.4.Each manager is obliged to understand legal basis on which her/his department processes data in each of the processing activities.

Handling information duties and data subjects’ requests

1. 9.1.The Company ensures the clarity of the provided information and communication directed to data subjects.
2. 9.2.The Company facilitates performance of data subjects’ rights, including: putting on the Company’s website information and references (links) to the information on data subjects’ rights and ways of performing them, including applicant’s identification requirements, channels of communication with the Company, fees for “additional” requests, etc.
3. 9.3.The Company monitors meeting deadlines for handling data subjects’ requests.
4. 9.4.The Company implements adequate methods of identification and authentication of data subjects when responding to data subjects’ requests.
5. 9.5.The Company has appropriate procedures and mechanisms in place allowing to identify data of particular persons processed by the Company, integrate those data, correct them and erase in an integrated manner.
6. 9.6.The Company documents performing information obligations and processing data subject requests.

Information duties

1. 10.1.The Company determines effective and lawful ways of fulfilling information obligations, taking into consideration the duty to facilitate and legibility, and applying the layered approach to information obligation respectively.
2. 10.2.In case processing a data subject request requires more than one month the Company informs the applicant before the expiry of the one month deadline.
3. 10.3.The Company performs the information obligation to a person at the time when data are obtained from that person. The Company accommodates to the extent reasonably possible preferences of data subjects regarding information obligation, for example by allowing to perform the information obligation via email even if data are collected by a phone, or by allowing to move the lengthy part of the information obligation to the end of the conversation/to a subpage.
4. 10.4.The Company performs the information obligation to a person also when data are obtained from other sources than the data subject directly, unless it is not required according to Art. 14.5 GDPR (e.g. when data are collected from public registers and the purpose of processing corresponds to the purpose of such registers so that information obligation would require a disproportionate effort).
5. 10.5.The Company determines way of informing data subjects when processing unidentified data, where feasible (for instance: notices on CCTV),
6. 10.6.The Company informs the data subjects of a planned change of purpose of processing.
7. 10.7.The Company informs the data subject before lifting the restriction of restriction.
8. 10.8.The Company informs data recipients on any rectification, erasure or restriction of the processing (unless this requires disproportionate effort or proves impossible).
9. 10.9.The Company informs the data subjects on their right to object to processing of data, at the latest at the time of the first communication with the data subject.
10. 10.10.The Company communicates the data breach to the data subject without undue delay, if the breach is likely to result in a high risk to the rights and freedoms of this data subject.

Data subjects requests

1. 11.1.While fulfilling data subjects’ rights, the Company applies procedural guarantees protecting rights and freedoms of others. In particular, after obtaining a credible information that fulfilling the data subject request for a copy of data or a right to data portability may adversely affect the rights or freedoms of others (in particular rights connected with other people’s data, intellectual property, trade secrets, personal rights etc.), the Company may request the data subject to explain or exercise other legal steps, including a refusal to fulfil the data subject’s request.
2. 11.2.Not processing. In response to a data subject’s request the Company informs a data subject that their data are not being processed if that is the case. The Company may however require a data subject to provide a basic context of their request in order not to be considered manifestly excessive.
3. 11.3.Refusal. The Company informs the data subject within a month of receiving a request on refusal to process their request and on related rights and remedies available.
4. 11.4.Right of access. Upon a data subject’s request, the Company informs the data subject whether or not it processes their data and informs the data subject on details of processing with accordance to the art. 15 of the GDPR (the scope of information corresponds with the scope of the information duty) and provides access to the data concerning the data subject.
5. 11.5.Copies of data. Upon request, the Company provides data subject with a copy of data concerning the data subject and documents the provision of the first copy. The Company adopts and announces a data copy price list. The copy fee is calculated based on an estimated cost of handling of a copy request.
6. 11.6.Data rectification. The Company rectifies incorrect data upon the data subjects request. The Company may refuse to correct data unless the data subject demonstrates incorrectness of data in a reasonable manner. In the case of data rectification, the Company informs the data subject on the recipients of data, upon the data subject’s request.
7. 11.7.Data completion. The Company completes and updates data upon data subject’s request. The Company may refuse to complete data, if the completion should be against the processing purposes (i.e. the Company does not want to process data unnecessary for the Company). The Company may rely on data subject’s statement concerning the completion of data unless it is not sufficient in the light of procedures adopted by the Company, the law or there are reasons to believe the data subject’s statement is not credible.
8. 11.8.Data erasure. Upon data subject’s request, the Company erases data when:

1. 1.data are no longer necessary for the purposes for which they were collected or otherwise processed,
2. 2.the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing,
3. 3.the data subject successfully objects to the processing and there are no overriding legitimate grounds for the processing,
4. 4.data have been unlawfully processed
5. 5.data have to be erased to comply with a legal obligation
6. 6.the erasure request refers to children data collected based on consent related to offering of information society services directly to a child (e.g. a child’s profile in social media, participation in a contest on a website).
   1. The Company determines a way of handling an erasure request in an efficient manner with respect to all data protection principles, including data security, and verifies whether any of exceptions of the art. 17.3 of the GDPR applies.
   2. If data subject to erasure have been made public by the Company, the Company takes reasonable steps, including technical measures, to inform other controllers processing such data about the need to erase data and access to them.
   3. In the case of data erasure, the Company informs the data subject on the recipients of data, upon the data subject’s request.
   4. 11.9.Restriction of processing. The Company restricts processing upon data subject’s request when:
   5. a)the accuracy of data is contested by the data subject - for a period enabling to verify the accuracy of the personal data,
   6. b)the processing is unlawful and the data subject opposes the erasure of data and requests the restriction of their use instead,
   7. c)the Company no longer needs data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims,
   8. d)the data subject has objected to processing on grounds relating to his or her particular situation - pending the verification whether the legitimate grounds of the Company override those of the data subject.
   9. During the restriction of processing, the Company stores data, but does not process them (does not use or pass them on), without data subject’s consent, unless for the purpose of the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
   10. The Company informs the data subject before lifting of the processing restriction.
   11. In the case of granting restriction of processing, the Company informs the data subject on the recipients of data, upon the data subject’s request.
   12. 11.10.Data portability. Upon data subject’s request, the Company provides data concerning her or him processed automatically (via IT systems) which he the data subject has provided to the Company, in a structured, commonly used and machine-readable format or (if possible) transfers data directly to another controller, where the processing is based on consent or on a contract.
   13. 11.11.Objection on grounds relating to a particular situation. If the data subject objects to processing of their data on grounds relating to their particular situation and data is processed by the Company on the grounds of the Company’s legitimate interests or necessity for the performance of a task carried out in the public interest, the Company will respect the objection unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or there are basis for the establishment, exercise or defence of legal claims.
   14. 11.12.Objection related to scientific or historical research purposes or statistical purposes. If the Company process data for scientific or historical research purposes or statistical purposes, the data subject may object to such processing based on grounds relating to hers or his particular situation. The Company will respect the objection unless the processing is necessary for the performance of a task carried out for reasons of public interest.
   15. 11.13.Objection related to direct marketing purposes. If the data subjects objects to processing of hers or his data by the Company for the purposes of direct marketing, the Company will respect such objection and will cease to process data for that purpose.
   16. 11.14.Right to a human intervention in the automated decision-making. If the Company processes data automatically, in particular by profiling data subject’s data, which results in decisions taken solely automatically producing legal effects or similarly significantly affecting a data subject (eg. depriving a person of their digital identity), the Company provides a communication channel for an appeal to a human intervention, unless the automated decision is directly authorised by the law.

#12 MINIMISATION

The Company ensures data minimisation with respect to the (i) adequacy to purposes (amount and scope of processing) (ii) access to data, (iii) data retention period. In particular:

Scope minimisation

The Company, while implementing the GDPR, has verified the scope of obtained data, scope of processing and the amount of processed data taking into account their adequacy in the light of the purposes of processing.

The Company periodically analyses an amount and a scope of processed data, not less than once a year.

The Company verifies changes to the amount and scope of the processing as a part of a change management procedure (privacy by design).

Scope minimisation

The Company applies data access restrictions: legal (non-disclosure agreements, access authorisations), physical (access areas, door locking) and logical (access restrictions for data processing IT systems and network resources containing data).

The Company uses physical access control.

The Company updates access rights at the times of changes within personnel (changes in membership or positions) and among processors. The Company periodically verifies profiles of IT systems users and updates them, no less than once a year.

Detailed rules on physical and logical access control are enclosed in the Company’s physical security and information security procedures.

Time minimisation (retention)

The Company applies data life-cycle control mechanisms, including verification of data further suitability with accordance to times and control-points indicated in the Record of Data Activities.

Data, which suitability decreases with time, are erased from production system as well as main and referential files. Such data may be subject to archiving or be present on backup copies of systems and information processed by the Company. Procedures on archiving and using archives, creating and using back-up copies take into account requirements of control over data life-cycle, including the erasure requirements.

#13 SECURITY

The Company ensures level of security adequate to the risk to the rights and freedoms of natural persons resulting from processing data by the Company.

Risks analysis and security measures adequacy

The Company carries out and documents adequacy of data security measures analysis. For this purpose:

1. 1)The Company equips itself with an adequate level of knowledge on information security, cybersecurity and business continuity – internally or with a support of external specialized entities.
2. 2)The Company categorizes data and processing activities with respect to the risk posed by thereof.
3. 3)The Company carries out an analysis of risk to the rights and freedoms of natural persons of the processing activities or their categories. The Company analyses possible situations and scenarios of data protection breaches taking into account the nature, scope, context and purposes of the processing, risk to the rights and freedoms of natural persons of varying likelihood and severity.
4. 4)The Company determines organisational and technical measures possible to apply and assess cost of their implementation. This includes an assessment of suitability of measures and methods such as:
   1. i)pseudonymisation
   2. ii)data encryption
   3. iii)other cybersecurity measures providing the ongoing ability for providing confidentiality, integrity, availability and resilience of systems and processing services.
   4. iv)measures ensuring business continuity and preventing effects of catastrophes, meaning measures with the ability to restore the availability and access to data in a timely manner in the event of a physical or technical incident.

Data protection impact assessment (DPIA)

The Company carries out an assessment of the impact of the envisaged processing operations on the protection of data (data protection impact assessment), where according to the risk analysis, there is a high risk to the rights and freedoms of natural persons.

The Company uses methodology adopted in the Company.

To the extent possible the Company performs DPIA routinely as part of the organisational change control.

Data security measures

The Company applies data security measures (technical and organisational measures of data protection) as determined in the analysis of risk and security measures adequacy and data protection impact assessment.

Security measures are elements of information security and cybersecurity measures in the Company and are described in detail in appropriate procedures.

Data breach notification

The Company applies procedures enabling identification, assessment and notification of an identified data protection breach to the supervisory authority within 72 hours from the moment of identification of the breach.

#14 PROCESSOR

The Company has rules on processors’ selection and verification developed for the purpose of ensuring the provision of sufficient guarantees of implementing appropriate technical and organisational measures by the processors, in order to ensure security, fulfilment of data subject’s rights and other duties relying on the Company.

The Company has adopted minimal requirements as to the processing agreement.

The Company accounts its processors for their use of subprocessor, as well as other requirements arising from the rules on entrusting data processing.

#15 DATA EXPORT

The Company records in the Record of Processing cases of data transfers out of the of EEA (EU plus Iceland, Lichtenstein and Norway).

In order to avoid unauthorised Data Export, including the use of the publicly available cloud services (shadow IT), the Company periodically verifies users actions and provides equivalent solutions that are in line with data protection laws.

#16 PRIVACY BY DESIGN

The Company manages changes that can influence data protection in a way that enables providing a suitable data security and minimisation of data processing.

In order to do so, procedures on starting new projects and investments in the Company refer to the principles of data security and minimisation and require assessment of an influence posed by a change on privacy and data protection as well as taking into account the necessity to design security and minimisation of the processing at the beginning of the project or an investment.

Unless unreasonable, the Company uses the methodology of data protection impact assessment.

#17 FINAL PROVISIONS

This Data Protection Policy enters into force on 25 May 2018.