Source: https://www.ifiduciaries.com/language/en/privacy-policy-2/
Timestamp: 2019-04-24 12:02:50+00:00

Document:
“International Federation” Ltd. is an Administrator of Personal Data within the meaning of Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (hereafter referred to as “CRPD”) and the Personal Data Protection Act (hereinafter “LPDP”).
Understanding this Policy prior to using the Services of the Administrator is imperative as providing it involves the collection of certain categories of personal data required by the Administrator for the full provision of services.
(D) information on the right of access, the right to rectify and delete the data collected.
B) “Special categories of personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or membership of trade unions and the processing of genetic data, biometrics for the unique identification of an individual, data relating to health or data about a person’s sexual life or sexual orientation.
(G) “Register” means any structured set of personal data accessed according to specific criteria, whether centralised, decentralised or distributed according to a functional or geographic basis.
(H) “Data subject” means any natural person who is the subject of personal data held by the Administrator.
J) “Child” – The General Regulation defines a child as anyone below the age of 16, although this may be reduced to 13 from the Member State’s law. The processing of personal data of a child is legal only if the parent or guardian has given its consent. The Administrator shall make reasonable efforts to verify in such cases that the holder of parental responsibility for the child has given or has been authorised to give his consent.
M) “Principal place of establishment” – the EU Administrator’s headquarters will be the place where he takes the basic decisions on the purpose and means of his data processing activities. For personal data processors, its main place of establishment in the EU will be its administrative center. If the Administrator is headquartered outside the EU, he must appoint a representative in the jurisdiction in which the Administrator works to act on behalf of the Administrator and deal with supervisors.
Where this is necessary to protect the vital interests of the individual or the legitimate interest of the Administrator, provided that he does not conflict with the legitimate interests of the individual.
The Administrator processes personal data provided by employees, clients, assignors, suppliers, contractors and other individuals to whom the data relate to the provision of services from the subject of their activity, as well as for the preparation and conclusion of contracts.
3. to provide information on the right of access and the correction of personal data of the person to whom they relate.
The collected personal data are stored for up to 6 (six) years from the date of termination of the service contract.
Personal data shall be stored for the period required by the purposes for which they were collected or for a period laid down in a statutory instrument.
With the consent of the direct marketing data subject, personal data is retained until it is written off or requested to be deleted. In cases where personal data is provided only for needs and purposes for feedback upon request, in the absence of a contract / order or other written agreement between the parties, the personal data are deleted and destroyed.
The administrator processes personal data through a set of actions that may be performed by automatic or other non-automated means such as collecting, recording, organizing, storing, adapting or modifying, restoring, consulting, using, disclosing by transmitting, distributing, providing, updating or combining, blocking, deletion and destruction.
The administrator processes the personal data either on his own or through the assignment of the data processors, by a written agreement defines the objectives and the volume of the obligations assigned by the controller of the data processor, provided the relevant legal basis is in accordance with the requirements of the ARPD / PDPA. Processors on behalf of the Administrator are, for example, the employees of the Administrator, whose rights and obligations regarding the processing of personal data of individuals are duly regulated in the internal acts of the Administrator, as well as in the employment characteristics of the respective employees. They also process third parties outside the Administrator structure who are entrusted with the processing of personal data on behalf of the Administrator.
actuality of the processed personal data.
– administration of contractual relations: personal data of pre-contract and current clients (including where explicit consent is granted or processing is necessary to fulfill contractual obligations under which the data subject is a party as and for actions preceding the conclusion of a contract and undertaken at the request of the person).
In establishing permanent commercial relations with natural persons, the Administrator, in accordance with the provisions of Art. 4, item 15, b. “A” and b. “C” of the Money Laundering Measures Act (LMML), undertakes to identify its clients. Pursuant to Art. 2, para. 1 of the Regulations for the Application of the LMML in relation to Art. 6, para. 1, item 2 of the LMML, the identification of the clients and the verification of the identification of the individuals shall be carried out by presenting an official identity document and taking a copy of it. The administrator is obliged to collect and process information, which is personal data for individuals pursuant to Art. 4, in connection with Art. 10 and Art. 11 of the Measures for the Prevention of Money Laundering Act.
Other personal data that may be provided to receive the service of the Administrator.
Each data subject shall have the right to request information about the type of personal data processed by the Administrator that affects him personally. This information should be provided regardless of where the personal data is being processed.
The data subject is entitled to information for the purposes of processing his or her personal data which is provided to him when collecting his or her personal data and subsequently altering the purposes of the processing.
If the stored personal data are incorrect or incomplete, the data subject may request that they be corrected. Data subjects are responsible for providing the correct personal data to the Administrator. In addition, the data subject should inform the Administrator of any relevant changes to his or her personal data (such as address changes or subject name).
At any time of the processing of personal data, the data subject may request the Administrator to restrict the use of his or her personal data to any or all of the processing purposes for which the subject has given consent.
Refusal to request information, correction or limitation of the processing of personal data.
When the request for information, correction or limitation of processing is denied, the data subject will be informed of the reason for the refusal. The refusal is made in the form of the request submitted by the subject and should be motivated.
Everyone has the right to request from the Administrator the deletion of the related personal data, and the Administrator has the obligation to delete them without undue delay. In the exercise of this right by the data subject, the Administrator tells the subject how the deletion will affect the relationship between them in the future.
Each data subject shall have the right to object to the processing of personal data relating to him. The administrator terminates the processing of personal data unless it can prove that there is a legal basis for continuing processing.
In addition, any data subject has the right to object if his or her personal data are used for advertising purposes (direct marketing) or for purposes related to market research or public opinion. In this case, personal data should be blocked and not used for the purposes.
The data subject has the right to withdraw his consent to processing his or her personal data at any time with a separate request addressed to the Administrator. The administrator tells the subject how the deletion affects the relationship between them in the future.
The data subject is entitled to submit complaints / requests to the Administrator on issues related to the processing of his or her personal data to which the Administrator responds in accordance with a procedure adopted (Procedure for Complaint Communications and Claims by the Data subject).
For the existence of “consent” the Administrator accepts only in cases where the data subject has been fully informed of the intended processing and has expressed his / her consent without exerting pressure on him / her. Consent obtained under pressure or on the basis of misleading information is not a valid basis for the processing of personal data.
Consent can not be inferred from the absence of a response to a message to the data subject. There must be active communication between the Administrator and the subject for consent. The controller should be able to demonstrate that consent has been obtained for the processing operations.
In most cases, consent to the processing of personal data is routinely obtained by the Administrator using standard consent documents, for example when a new client signs a contract or when recruiting new staff.
When processing personal data of children, the Administrator should be authorized by parents exercising parenting rights (parents, guardians, etc.). This requirement applies to children under the age of 16 (unless the Member State has provided for a lower age limit, which may not be less than 13 years).
The data subject may authorize another person to exercise the rights under this policy. Authorization should be explicit and made in writing. In every exercise of the data subject’s rights, the proxy is required to submit a copy of his power of attorney to the Administrator or the personal data processor on behalf of the Administrator.
The administrator ensures the security of personal data in accordance with the principles laid down in the ARPD / PDPA by taking appropriate and sufficient administrative, technical and organizational measures to protect data from loss, theft, misuse and unauthorized access, disclosure, alteration or destruction .
The processing of personal data is only admissible if the data subject has agreed to this if there is a legal obligation to process the data when concluding or executing a contract when necessary to protect the vital interests of the individual or the legitimate interest of the Administrator , provided that it does not conflict with the legitimate interests of the individual. The admissibility of the processing of personal data is a prerequisite for the transmission of personal data.
Consent should be declared in writing or on the basis of other legally permissible means, and the data subject must be informed in advance of the purpose of the processing and the possibility of transmitting personal data to third parties. An emphasis is placed on giving consent when included in other declarations so as to be clear to the data subject.
Personal data may only be collected for the purposes outlined above and can not be processed for purposes other than those intended. The purpose of data collection and processing must be complied with by the Administrator for further processing and storage of such data. Changes to the purpose are only acceptable with the consent of the data subject or if permitted by the domestic law of the country from which the personal data were received.
The processing of personal data must be necessary for the intended purpose. The available anonymisation or pseudonymization capabilities for personal data should be used at an early stage as far as possible and cost-effective for the intended protective purpose.
Personal data must be factually correct and, as necessary, up-to-date. The administrator shall take appropriate and reasonable steps to correct or delete incorrect or incomplete data.
The Data Administrator shall put in place appropriate technical and organizational measures to ensure the necessary data security. These measures apply in particular to computers (servers and workstations), networks and communications connections and applications, and they are incorporated into the IT security management system. Appropriate measures are taken to protect this data from erasure by mistake, unauthorized deletion or loss. Full information is provided in the European Parliament and Council Directive (EU) 2016/1148 of 6 July 2016 on measures to ensure a high level of security of networks and information systems in the Union.
Only authorized personnel who have committed to complying with data privacy requirements may participate in the processing of personal data. Employees are prohibited from using such data for personal purposes or providing them to unauthorized companies and third parties. Unauthorized in this context also means the use of personal data by employees who do not require access to such data in order to fulfill their official responsibilities. The confidentiality obligation continues to work even after termination of the employment / civil / service relationship with the Administrator.
All personal data should only be accessible to those employees / processors whose duties include the processing of specific data, and access is only made in accordance with the internal rules of access control adopted (Rule and Rights Procedure in relation to control of access to personal data by technical means).
The administrator shall establish procedures for restoring the availability of personal data following a physical or technical incident. In order to fulfill these obligations, the Administrator shall provide the necessary technical means (servers, computer network, cloud space) for which the protection measures under this section are undertaken.
The processing of personal data outside the premises of the Administrator is carried out in accordance with the relevant procedural rules and is permitted with the explicit written consent of the direct manager of the personal data processor or the Administrator.
The administrator appoints a Data Protection Officer (DPA). The role of this person is to monitor compliance with this Policy in the Enterprise of the Administrator and to ensure the possibility of demonstrating compliance of the processing of personal data in accordance with data protection legislation.
LDDP develops and implements the requirements for the protection of personal data in accordance with the provisions of this Policy. LDDP carries out security and risk management with respect to compliance with this Policy. DPOF is responsible for administering and processing requests and inquiries made by the data subject to the Administrator. LDDP gives the necessary clarifications to the Administrator’s employees regarding the respect of the protection of personal data.
DPLD shall periodically prepare and submit reports to the Administrator in connection with the application of this Policy, the legal provisions regulating the protection of personal data and the compliance of the provided protection of personal data in the enterprise with the legal requirements in this field.
The period for storing each category of personal data contained in a separate register is determined by a procedure adopted by the Administrator (Procedure for Storing and Destruction of Data). This procedure specifies the criteria used to determine the storage period, including any legal obligations incumbent upon the Administrator in respect of the storage of data.
The procedure for storing and destroying data, as well as the rules for the destruction of information on physical media, applies in all cases.
Personal data must be destroyed securely, in accordance with the principle of ensuring an appropriate level of security. Compliance with the procedure is mandatory in order to ensure protection against unauthorized or unlawful processing and against accidental loss, destruction or damage to data by applying appropriate technical or organizational measures.
LDDP makes a periodic review of the initially inventory data, reviewing the entered information in the “Processing Activity Register” for any changes in the Administrator’s activities.
The administrator shall disclose personal data to entities whose personal data are processed when required by law, by regulation, by international treaty or by an act of European Union law or in connection with a judicial proceeding in response to a request from a public authority. eg law enforcement or investigative bodies) or in case of suspicion of serious and unlawful interference with the legal rights and interests of the subjects of law.
Having regard to the regulation of the protection of personal data of individuals and the enhanced data protection measures introduced by the ARDD / PDPA, the Administrator takes into account the necessity to carry out initial and follow-up training of its personnel, whose duties include the processing of personal data of natural persons on behalf of the Administrator. Initial and follow-up trainings are intended to inform employees about the established rules and procedures for complying with this Policy and the applicable legal framework in the field of personal data protection as well as other data protection and privacy issues.
Employee training seeks to raise awareness about existing or newly emerging privacy requirements as well as the actions taken by the Administrator in accordance with them.
The Data Protection Officer shall ensure that employees’ responsibilities are appropriately allocated in relation to data protection in accordance with the Rules and Procedures of the Administrator for the processing of personal data.
The Data Protection Officer should ensure that all employees who have ongoing obligations related to personal data and processing operations as well as those with permanent / regular access to personal data demonstrate compliance with data protection requirements.
Employees must be able to demonstrate competence in understanding compliance requirements and how they apply to the Administrator’s organization.
The Data Protection Officer is responsible for updating their knowledge and being aware of all personal data issues within the scope of their professional duties, such as organizing ongoing training in changing the legal framework of personal data protection or changing the the subject of the Administrator’s activity, as well as the introduction of new procedures / measures for the protection of personal data by the Administrator.
The Administrator encourages training and awareness-raising measures by providing the necessary resources and material resources for this.
The Data Protection Officer familiarizes and informs employees of the importance of data protection in the performance of their direct duties, and in accordance with their role in the organization.
The Data Protection Officer is responsible for ensuring that employees understand how and why the rules and procedures of the Administrator’s organization for the processing of personal data apply and for which he / she compiles the relevant reports / protocols.
The Data Protection Officer develops training and information programs for both the entire staff and each specific role in the organization involved in the processing of personal data.
The Data Protection Officer establishes a system of periodic alert checking and updating employee knowledge in relation to changes in data protection requirements.
Employees receive specific training for the processing of personal data related to their permanent roles and responsibilities and in accordance with the rules and procedures adopted by the Administrator.
Employees receive specific training on all data protection requirements and procedures applicable to data protection and data processing within their daily roles and responsibilities, including reporting of personal data breaches.
Employees receive training on data submissions and complaints from data subjects related to the protection of personal data and the processing of personal data in accordance with the Administrator’s policies and procedures.
The Data Protection Officer organizes training for all responsible persons and employees.
The Data Protection Officer documents each training that he / she has done and, in doing so, draws up a list / protocol with those attending relevant trainings performed at the appropriate time according to the Administrator’s activities.
Initial training of employees is carried out in the implementation of this policy as well as when new employees are brought into work whose personal duties include the processing of personal data.
Subsequent trainings are conducted periodically (at least once every 12 months) or when a change in the legal framework of personal data protection / change in the subject of activity of the Administrator regarding the processing of personal data or when introducing new measures / procedures for protection.

References: Art. 4
 Art. 2
 Art. 6
 Art. 4
 Art. 10
 Art. 11