Data protection policy

1. GENERAL TERMS AND CONDITIONS

1.1. PURPOSE

The purpose of the Data Protection Policy (hereinafter – the Policy) is to assist Mellifera Kartiera Limited, registration number: C 107685, legal address: Villa Malitah, Mediterranean Street, The Village, St. Julians, STJ 1870, Malta, (hereinafter – the Company) to meet its legal obligations under the Regulations. It defines requirements and the procedure for the protection of Personal Data against unauthorized leakage and sets up data protection principles in compliance with the rules of processing of Personal Data in order to ensure the Data Subject’s rights to privacy. The Policy is internal and applies to every employee of the Company and its service providers. All principles described in the Policy must be strictly followed. A breach of data protection guidelines will invoke disciplinary and possibly legal action.

1.2. RESPONSIBILITY AND DISTRIBUTION

Within the Personal Data protection process Management Board, as a first line of defense:
- Ensures the Personal Data protection process in the Company is in compliance with the Regulations;
- . Implements appropriate technical and organizational measures for protecting security of the Personal Data;
- . Approves this Policy, including any necessary amendments and/or procedures for managing the Personal Data protection process;
- . Monitors the periodic improvement of the Personal Data protection process in accordance with changes in the Company’s operations and regulatory enactments.
Within the Personal Data protection process the Company’s employees, as a first line of defense:
- . Get acquainted with the Policy and binding procedures and ensure their implementation;
- . Provide suggestions to the Data Protection Officer appointed by the Company (hereinafter – DPO) for improving the Personal Data protection process;
- . Report violations to the DPO.
The DPO, as a second line of defence, shall monitor and control whether the 1^st line activities comply with the internal privacy-related rules. The DPO shall also act as an advisor to the 1^st line of defence in its efforts to ensure Personal Data protection compliance. Everyone can contact the Company‘s DPO by writing to the email:
The Internal Auditor, as a third line of defence, provides an independent assessment of the Personal Data protection process.

2. DEFINITIONS

Authorized Person – any natural person or legal entity (including its employee) having access to Personal Data by mutual agreement with the Company or by law.
Automated decision-making – making a decision solely by automated means without any human involvement.
CITO – Chief Information and Technology Officer.
CISO – Chief Information Security Officer.
Confidential information – information possessed by the Company, marked as confidential or other non-public information in accordance with the Company’s internal procedures, including Personal Data.
Controller – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
Data Subject – any private individual who uses, has used or has expressed a wish to use or is in other way related to any of the services provided by the Company, the Company employees or another identified or identifiable natural person. For the purposes of this Policy this definition also includes any private individual such as the representative, ultimate beneficial owner, manager, board member or member of the management body of the company, customer’s phone contact, whose Personal Data is processed by the Company.
DPIA – Data Protection Impact Assessment – a process to identify and minimize the data protection risks of a project and that describes the nature, scope, context and purposes of the processing; assess necessity, proportionality and compliance measures; identify and assess risks to individuals; and identify any additional measures to mitigate those risks. DPIA template is provided in Annex 1.
Explicit consent – any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her and must be affirmed in a clear statement.
Information System – system software, applications, data transmission channels, system and data files and other information used for processing of Personal Data, their storage and performance of other functions, i.e. the set of information and technical resources.
IT – information technology.
Management Board – the executive institution of the Company appointed in compliance with regulatory enactments and the Company’s policies.
Personal Data – any information related to an identified or identifiable natural person.
Privacy by design – appropriate technical and organizational measures to implement the data protection principles effectively and safeguard individual rights, including the use of Pseudonymization (replacing personally identifiable material with artificial identifiers) and encryption (encoding messages so only those authorized can read them).
Privacy policy – the Company’s external policy directed at Data Subjects and establishing basic principles on Personal Data processing.
Processing (processing) – any operations carried out with Personal Data (incl. collection, recording, storing, alteration, grant of access to, making enquiries, transfer, etc.).
Processor – means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.
Profiling – automated processing of Personal Data to evaluate certain things about an individual. Profiling can be part of an Automated decision-making
Pseudonymization – the Processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to Technical and organizational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person.
Register – the register of processing of Personal Data developed and maintained by the Company.
Regulations – Regulation (EE) 2016/679 of The European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and which has been implemented into Maltese law by virtue of the Data Protection Act (Chapter 586 of the Laws of Malta) and other applicable legal acts.
Responsible Person – the Company’s employee who has access to Personal Data to perform his/her duties.
Security incident – any threat of Confidential Information, a harmful event or act resulting in a threat to the integrity, availability or confidentiality of the Information System, IT System or Personal Data.
Supervisory Authority – The Office of the Information and Data Protection Commissioner of the Republic of Malta.
Technical and organizational measures – mean measures that are designed by the Company to protect Personal Data from accidental or unlawful destruction, alteration, disclosure and any other unlawful processing. The above-mentioned measures shall ensure a level of security appropriate to the nature of Personal Data to be protected and the risk represented by their processing.
Third Party – any natural person or legal entity, except the Data Subject, the Processor of Personal Data and persons directly authorized by the Company or the Processor of Personal Data.

Other terms – in compliance with GDPR and other legal acts.

3. GENERAL PRINCIPLES OF DATA PROTECTION

Fairness, lawfulness and transparency

The Company ensures that the Personal Data is processed lawfully, fairly and in a transparent manner in relation to the Data Subject.
The Company ensures compliance with the above principle by defining the regulations of processing of Personal Data that are compliant with the Regulations.
The Company ensures that the Data Subject has access to his/ her Personal Data in compliance with the Policy and Privacy Policy and is notified of processing of Personal Data prior to processing of Personal Data.

Restriction of purpose

The Company ensures that processing of Personal Data is done only for a particular purpose and only in compliance with it, based on the relevant legal basis.
The Company includes the purpose of processing of Personal Data and the processed types of Personal Data in the Register.

Data minimisation

The Company ensures that the Personal Data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
The Company reviews the Register and assesses whether all the Personal Data is needed for attaining the particular purpose on a regular basis, however, before any changes are made in the process or a minimum once per 2 years.

Accuracy

The Company ensures the accuracy of Personal Data, as far as this is possible due to reasons independent of The Company.
The Company takes care of the accuracy of the Data Subject’s Personal Data, as far as this is possible, including obliging the Data Subject to notify the Company if the Data Subject’s Personal Data changes.
Correction of the Personal Data is based on the Data Subject’s request or when new circumstances arise, in compliance with the Policy.

Storage limitation

The Company ensures that Personal Data is stored no longer than necessary for the purposes for which the Personal Data is processed or in compliance with valid regulatory enactments regarding the storage of Personal Data considering the statute of limitations.
The Company defines the terms of storing the Personal Data in the Register in accordance with the Policy.
The Company ensures that the terms of storage of Personal Data defined in the Register and Policy are regularly reviewed based on the necessity, however, a minimum once in 2 (two) years.

Integrity and confidentiality

The Company ensures that Personal Data is processed in a secure manner in compliance with the requirements of the Regulations.
The Company ensures that Personal Data is only processed by Responsible Persons and Authorized Person

Accountability

The Company complies with the principles defined by the present chapter and performs the processing of Personal Data in compliance with the Regulations and other documents related to the processing of Personal Data.
The Company regularly reviews its internal documents related to the protection of Personal Data as required, however at least once per 2 (two) years.

4. MAIN PRINCIPLES FOR DATA PROCESSING

Processing of Personal Data is done electronically, on paper or by using the technical resources registered in the log-book of technical resources used for processing Personal Data.
Personal Data is stored in the Company’s internal storage system (e.g., Google Drive) and protected with relevant security measures. It is prohibited to enter, copy and store the customers’ and employees’ Personal Data on other data carriers or an employee’s computer, except the cases provided for by other internal regulations of the Company (such as transfer of data to a collection company, sending letters by post, etc.). Sending of Data Subject Personal Data referred to in the present clause may only be done by Responsible Persons.
The Data Subject data (for example, address details) may only be rectified and corrected in compliance with the procedure of performance of particular works.
Processing of Personal Data in the Company is performed by Responsible Persons and Authorized Person
The Company may restrict the Responsible Persons and Authorized Person’s access to information systems without a notice if the Authorized Person breaches the Policy and the Regulations and/ or ethics standards.
The Company is entitled to request a written confirmation on compliance with the Policy, Regulations and confidentiality requirements in working with Personal Data and Information Systems from the Responsible Person and Authorized Person, as well as to perform any other acts deemed necessary to ensure compliance with all the legislation requirements in the area of protection of Personal Data. The above confirmation is stored in the personal file of the Company employee (in case of Responsible Person) or with the contract of the Processor of Personal Data (in the case of an Authorized Person).
The Company is obliged to take care of the security of circulation of Personal Data, including the operation of Information Systems by providing authorized access to Personal Data by Responsible Persons and Authorized Persons, non-accessibility of Personal Data to unAuthorized Persons and the possibility for Data Subjects to get acquainted with their Personal Data from the Personal Data processing system or Personal Data stored in another format.
The Company ensures that Personal Data is accessible only to those who need to use it, and access may only be granted in line with the Information Security Policy.
The Company sets up, makes entries and stores the registration log-book of the technical resources used in processing Personal Data. CITO is responsible for maintaining the above registration log-book. Entries in this registration log-book should be reviewed at least 1 (once) a year.
Responsible Persons are listed in the registration log-book of Responsible Persons. Responsible Persons have the following obligations in relation to the processes of Personal Data processing assigned under their management:
- to review the purposes of processing Personal Data transferred under the supervision of the Responsible Person, including their importance, necessity, proportionality, etc.;
- to ensure that the Personal Data transferred under supervision of the Responsible Person is not accessible to Third Parties;
- to develop and/or review the procedures/ instructions/ policies governing the processes transferred under supervision;
- to develop and/or review the Data Subject notification mechanisms;
- to assess and to ensure the provision of answers to received inquiries of Data Subjects;
- to assess and to ensure the provision of answers to received Data Subject’s complaints regarding processing of Personal Data;
- to assess and to ensure the selection of suitable cooperation partners, including the Processor of Personal Data, signing of a contract and supervision thereof;
- to assess the Authorized Person’s notice on an unjustified request to disclose Personal Data and, if necessary, to notify the Management Board on receipt of such a request;
- to participate in the assessment of the Security Incidents of Personal Data protection, identification of risks, minimisation of consequences and development of future measures in order not to permit further emerging of risks and to ensure the performance of the above acts;
- to follow up on changes of actual circumstances and legislation which may affect the processing of Personal Data for the particular purpose, and in case of relevant changes to assess repeatedly the topicality and adequacy of the processed types of Personal Data and, if necessary, to update the types of Personal Data used in processing in order to ensure compliance of the used Personal Data with the purpose of the processing of Personal Data;
- jointly with DPO, to provide training of involved the Company employees in relation to the particular purpose and process of processing Personal Data;
- to commence and to participate in the performance of the Assessment as required;
- to define the categories of Authorized Persons who are authorized to access the Personal Data supervised by the relevant Responsible Person;
- to participate in the development of relevant technical and organizational measures, as far as they are related to the processing of the Personal Data supervised by the relevant Responsible Person, including in relation to the transfer of Personal Data to processors of Personal Data;
- not to disclose Personal Data to Third Parties without legal basis after termination of employment relationship with the Company. This obligation does not have a time restriction;
- to ensure that, upon termination of the work with Personal Data, the Responsible Person closes the browser or logs off the network if processing of Personal Data takes place in the Information System, and/ or returns paper documents containing Personal Data to the storage place, as well as complies with the security terms of the Company Information System.
The Company is entitled to request information on the performance of the duties of processing Personal Data from Authorized Persons and Responsible Persons.
The Company assesses and reviews all Security Incidents related to the processing of Personal Data and records them in the register of Security Incidents.
The Company and Responsible Persons must ensure that the Authorized Persons comply with these requirements:
- The Authorized Person processes Personal Data in compliance with the procedure provided by legislation, the Regulations, agreement and other binding regulations;
- The Authorized Person ensures that the Personal Data at his/her/its disposal are not accessible to Third Parties;
- The Authorized Person registers the fact of transfer and receipt of Personal Data, including the Data Subject’s application, according to the procedure provided for by the Company, except if such transfer of Personal Data is registered by automated means (the auditing records of the information system are made);
- The Authorized Person only processes the Personal Data transferred to his/her/its possession for the performance of direct obligations;
- The Authorized Person is prohibited from disclosing information about the structure and configuration of the Company information system, the means of physical and logic protection of Personal Data, or disclosing Personal Data to unAuthorized Persons and/ or Third Parties, except the cases provided for by legislation or agreement with the Company;
- The Authorized Person is obliged to comply with the Technical and organizational measures defined by the Company and also selected by itself, if necessary, to protect Personal Data and to prevent their unlawful obtaining;
- The Authorized Person is responsible for Personal Data transferred under its possession, as well as for any other documents required for the performance of official duties or other liabilities to the Company;
- The Authorized Person is prohibited to perform acts directed against the security of the Information System by using not envisaged connection possibilities;
- The Authorized Person, if it has not received a special authorisation from the Company, is prohibited from modifying Personal Data, transferring them to Third Parties, participating in selling them or alienation of any other type, reproducing them as a whole or in any part, to use them for creating other data processing systems and to store them at publicly accessible places;
- The Authorized Person is obliged to notify the Company if there is suspicion regarding risks of processing of Personal Data, damage in the Information System, eventual obtaining of the password or another type of access by Third Parties and other situations which may cause risks to security of Personal Data;
- The Authorized Person is liable for unlawful acts in the area of Personal Data processing according to the procedure defined by the legislation and agreement with the Company.
All the Company employees who have access to the Information System and/ or Personal Data stored in another form are liable for compliance with security measures.
If the Company needs to make a part of the Personal Data resources accessible to the Authorized Persons, this access, as far as possible, is controlled and supervised, including by making available the minimum scope of Personal Data as necessary for attaining the particular purpose of disclosure, and, as far as possible, by performing Pseudonymisation of Personal Data (hiding identificators), encoding.
Upon disclosing Personal Data to Authorized Persons the Company maintains information about:
- The time of disclosing Personal Data;
- the person who transferred Personal Data;
- the person who requested Personal Data and received them;
- the scope of transferred Personal Data.
The Company ensures that processing of Personal Data is only performed by Responsible Persons and Authorized Persons, including, provides the possibility to identify Personal Data that have been processed without relevant authorisation, the time and the person when such processing of Personal Data has taken place by including this information in the Breaches Registry as required.
The Responsible Person and Authorized Person shall, as far as possible, minimize the risk of obtaining Personal Data by unAuthorized Persons or Third Parties which may emerge due to the acts of the Authorized Person: error, theft, lack of care in the transfer of information or incorrect use of devices.
The Company as the employer shall notify employees, including by ensuring that users of Personal Data are aware of the importance of the security of Personal Data and eventual threats and are sufficiently qualified for following and complying with the security requirements of Personal Data and their processing defined by the Company.
The Regulations and other internal regulations, including the terms of use of the information system, are presented to the Company employees and employees are trained to correctly use IT resources, prior to granting access to the Information System to the Company employees.
Prior to the commencement of processing of Personal Data for new purposes or amending the existing purposes, the Company issues an ordinance:
- to define the purpose of processing of Personal Data;
- to appoint Responsible Persons;
- to define the scope of Authorized Persons;
- to define the term of storage of Personal Data;
- to define the technical resources to be used in processing of Personal Data;
- to define the technical and organizational measures to be applied in the processing of Personal Data if they differ from general measures;
- to assess whether it is necessary to perform the DPIA.
CISO/DPO makes relevant supplements in the Register.
The Responsible Persons review and assess the purposes and the essence of processing of Personal Data and implement necessary changes in processing of the Personal Data, the Register and/ or ordinance regularly as required, however, minimum 1 (once) a year.

5. INFORMATION SECURITY, INFORMATION AND TECHNICAL RESOURCES

Information security is the process by which the Company protects the creation, collection, storage, use, transmission, and disposal of Confidential information such as Personal Data, including the protection of hardware and infrastructure used to store and transmit such information.
Information security promotes the commonly accepted objectives of confidentiality, integrity, and availability of information and is essential to the overall safety and soundness of the Company. Irrespective of the form and the place of storing information at any time, it should always be adequately protected.
The Company is aware of the importance and meaning of information security and defines the requirements to be complied with by the Company employees in their daily work.
The Company takes care to ensure that:
- information is only available to the persons who are authorized to receive it (confidentiality);
- the information and its processing methods are accurate and complete (integrity);
- authorized users have access to information in case of necessity (accessibility).
The Company implements technical protection of Personal Data by physical and logical means of protection, by ensuring protection against the threat of Personal Data caused by physical impact and the protection implemented by IT means. By selecting the type of storage of Personal Data, the possibility that damage may be caused by fire, flood, explosion and other Security incidents caused by nature, IT and people are taken into account.
Technical resources that contain Personal Data, including stationary and portable computers, and external hard discs, at the time when they are not used, are stored at places not easily accessible to other persons (in locked rooms or cabinets).
The Company establishes appropriate policies, standards, and procedures to support the information security, information and technical resources, therefore the information security is described in detail in the Information Security Policy and its related procedures.

6. THE REGISTER OF PROCESSING OF PERSONAL DATA

The Company establishes and maintains the Register which is reviewed and supplemented regularly in compliance with the actual processing of Personal Data, including regular reviews of the terms of storing of Personal Data defined in the Policy and Register.
The Register is maintained for the purpose of general recording of the acts performed with Personal Data within the framework of one or several purposes, including, recording and controlling of the recipients of Personal Data.
The Company records all the types of Personal Data processed about the Data Subject by stating also the recipients of Personal Data, including Third Parties from whom the Company obtains or to whom it transfers the Personal Data of the Data Subject.
The Company ensures that only Responsible Persons and Authorized Persons and state authorities (in the cases and the scope provided for by legislation) process the relevant Personal Data of the Data Subject.
In case of necessity, the Company provides accessibility of the Register to the Supervisory Authority.
CISO/DPO is responsible for maintaining and renewing the Register.

7. LEGAL BASIS FOR PROCESSING OF PERSONAL DATA

Processing of the Data Subject’s Personal Data for signing and performance of the contract. The Company processes the Personal Data of the Data Subject for the purpose of signing and performing a contract in order to provide the respective service.
Processing of the Data Subject’s Personal Data for the performance of the duties imposed by legislation:
- The Company processes the Data Subject’s Personal Data in order to perform the obligations imposed by legislation.
- The Company discloses Personal Data in cases provided for by the legislation to the stipulated state authorities in compliance with the conditions of the present Regulations.
- The Company ensures that the Personal Data processed in compliance with the legislation are stored for the term provided for by legislation and that this term is stated in the Register.
Processing of the Data Subject’s Personal Data in compliance with the Data Subject’s consent:
- The Company is entitled to process the Data Subject’s Personal Data on the basis of the consent freely given by the Data Subject in advance. The consent should be received prior to commencing processing of Personal Data.
- The Company defines the purposes of processing the Data Subject’s Personal Data for attaining which it is necessary to receive the Data Subject’s consent. The Company, for example, processes the Data Subject’s Personal Data for direct marketing purposes based on the Data Subject’s consent.
- The Company does not process the Data Subject’s Personal Data for the purposes for which the Data Subject’s consent is needed if the Data Subject has not submitted active consent for such processing of Personal Data.
- Prior to the processing of Personal Data and receipt of Data Subject’s consent, the Company provides information about the intended processing of Personal Data, including processors, types of Personal Data, purposes of the processing of Personal Data and other information related to the processing of Personal Data to the Data Subject.
- In order for the consent to be lawful and valid, it shall comply with the description of Explicit consent and the following mandatory features:
  - actively provided – the consent should be provided by an active act or statement or as a clearly affirmative act;
  - informed and intended – prior to giving the consent, the Data Subject should be informed of processing his or her Personal Data in compliance with Article 13 of GDPR and be aware of the purpose for which his or her Personal Data will be processed;
  - specific – the content should refer to the particular purpose of processing Personal Data regarding which the Data Subject is informed prior to the provision of the consent.
  - If it is necessary to obtain consent for several purposes of processing of Personal Data, The Company should obtain consent for each purpose of processing of Personal Data. If the consent is contained in any document jointly with other matters, the consent should be separated from the other content and the Data Subject should be able to express it irrespective of the content of the other document;
  - free– the Data Subject should have a true and free choice, the process of obtaining the consent may not be enforced and fraudulent;
  - withdrawable – the Data Subject is entitled to withdraw the consent at any time and it may not be agreed with the Data Subject that it may not withdraw its consent;
  - verifiable – if the Company justifies processing of Personal Data by the Data Subject’s consent, it should be able to clearly demonstrate that the Data Subject has consented to processing of its Personal Data.
- The Company provides the information related to the processing of Personal Data to the Data Subject in the Privacy Policy or Employee’s Privacy Policy, in a contract and/or in another manner accessible to the Data Subject.
- The Company preserves evidence of the receipt of the consent until processing of Personal Data is performed on the basis of the consent, as well as after that during the eventual statute of limitations period in order to secure protection of the legitimate interests of the Company in case of a dispute on existence of the legal basis.
- Withdrawal of the consent does not affect the lawfulness of processing of Personal Data based on the consent prior to its withdrawal.
- The Data Subject may give his/her consent to the receipt of commercial communications of the Company by visiting kartiera.eu, registering on the website kartiera.eu, or mobile application (if any), as well as by signing service application forms. The Data Subject’s consent regarding marketing is valid until its withdrawal. Data Subjects have the right to object to the processing of their Personal Data for direct marketing purposes at any time and free of charge. To exercise this right, the Data Subject should be allowed to contact the company or opt out of receiving the advertising and commercial communications using the link provided in the e-mail message or following other instructions as provided in such direct marketing communication.
Processing of the Data Subject’s Personal Data in compliance with the legitimate interests of the Company:
- The Company is entitled to process the Data Subject’s Personal Data on the basis of the legitimate interests of the Company to process Personal Data.
- The Company defines the purposes of processing the Data Subject’s Personal Data based on the legitimate interests of the Company and identifies the particular legitimate interest in the Register.
- The Company performs the interest balancing test prior to starting the processing of Personal Data for a new purpose or for a modified purpose.
- By performing the interest balancing test, the Company:
  - identifies a particular legitimate interest which is defined sufficiently clearly and reflects a true and existing interest of the Company;
  - assesses if there is no other form for attaining the legitimate interest of the Company which presents less restriction to the Data Subject’s freedom;
  - considers the sensitivity of Personal Data and the degree of affecting the Data Subject’s privacy;
  - considers the envisaged type of processing of Personal Data, including the scope of obtained Personal Data, use of profiling and other aspects;
  - assesses the Data Subject’s rights and interests which may be affected and/ or restricted by implementing the particular processing of Personal Data;
  - assesses the potential impact upon the Data Subject’s rights and/ or interests and the potential gain of the Company from the processing of Personal Data;
  - considers the Data Subject’s justified expectations regarding the processing of Personal Data;
  - as far as possible, applies additional mechanisms of protection of Personal Data, including the provision of the possibility to reject processing of Personal Data, and definition of restricted circle of Authorized Person
- The Company ensures that the performance of the balancing test is documented and the results of these tests are maintained. Within the process of balancing of legitimate interests, the Responsible Person involves the DPO and other employees as required.
- Upon necessity or upon the Data Subject’s request if the Data Subject has objected to the processing of Personal Data, the Company performs a re-assessment of the legitimate interests of the Company, including re-assessment of the impact upon the Data Subject.
- Use of other legal bases in processing Personal Data is possible if this directly arises from applicable legislation.

8. STORAGE AND DESTRUCTION OF PERSONAL DATA

Information backup copies are made in compliance with the Information Backup and Recovery Procedure.

Main Principles for Technical Resources Destruction

Destruction of information carriers of the data centre and individual computers should be done according to the ordinance of the CITO and by preparing and signing a relevant act. Signed acts should be stored in the files of the CITO
Technical destruction of information carriers of the data centre and individual computers should be done in compliance with the instructions of the CITO.
Personal Data is destroyed when the term of their storage defined in compliance with applicable legislation, and internal rules of the Company set in the Policy and Register expires.

Main Principles for Storage of Personal Data

Electronic and paper files containing Personal Data are stored for the term defined by the Policy and Register.
The Company reviews the terms of storage of Personal Data defined by the Policy and Register as necessary, however, at least once in 2 (two) years.
In the course of the assessment of the terms of storage of Personal Data the Company considers minimum the following aspects:
- The Personal Data is stored for at least until they are needed for attaining the purpose of processing;
- The terms of storage of Personal Data are aligned with the terms of storage defined by legislation in compliance with the purpose of storage of Personal Data;
- Personal Data is stored as long as the Company needs to preserve evidence in case of initiating a legal claim and/ or starting litigation;
- Personal Data may not be erased from documents if this affects the legal force of the document.
An indicative list of Personal Data retention terms applied by the Company:
- KYC and anti-money laundering and counter-terrorist financing-related data:

Document Type	Retention period
AML registrations journals data	8 years from the date of termination of transactions or business relationship with the customer (should be clarified)
Copies of the customer’s identity documents, beneficiary’s identity data, beneficiary’s identity data, live video (live video broadcast) record, other data obtained during the customer’s identification, invoices and contract documents	8 years from the date of termination of transactions or business relations with the customer (should be clarified)
Business correspondence with the customer	5 years from the date of termination of transactions or business relationship with the customer (should be clarified)
Documents and data confirming a monetary transaction or transaction or other legally valid documents and data related to the execution of monetary transactions or conclusion of transactions	8 years from the date of execution of the monetary transaction or conclusion of the transaction (should be clarified)
The records regarding the results of the investigation of suspicious transactions	5 years (should be clarified)

Retaining data until the expiry of limitation periods of the claims:

Document Type	Retention period
Personal Data collected in the course of a contractual or pre-contractual relationship between the Data Subject and the Company	10 years as of the claim falling due (i.e. as of the entitled person obtaining the right to claim performance of the obligation corresponding to the claim) (should be clarified)
Data of potential customers (for whom an offer was provided, but no contract was concluded)	2 years from the date of the decision not to conclude a contract – taking into account the 2-year limitation period for filing a complaint to the State Data Protection Inspectorate (should be clarified)

Accounting documents:

Document Type	Retention period
Accounts, books of account and records	Minimum 10 years. The 10-year retention period starts in the year following the expiry of the calendar year in which the accounting year (to which the information relates) was closed (should be clarified)

Tax related documents:

Document Type	Retention period
The general obligation of taxpayers to provide (upon request of the tax inspector) all information that may be relevant to their tax position, including all books, records and other data carriers	The retention of documents for tax purposes follows the rules in the Law on Tax Administration and the Law on Value Added Tax under which VAT invoices must be preserved for 10 years after they were issued (should be clarified)

Employment-related documents:

Document Type	Retention period
Employment contract	50 years as of the expiry of the employment contract (should be clarified)
Reports on employee performance review meetings and assessment interviews (competency database)	No specific maximum retention period, general rules apply. Reports must not be retained longer than necessary for their original purpose
Records of salaries and wages	Minimum 50 years. Requests from employees to apply for a non-taxable income amount, requests to provide support for withholding tax discount purposes must be retained in the Company’s records (should be clarified)
Data of rejected job applicants (e.g. application letters, CVs, references, certificates of good conduct, job interview notes, assessment and psychological test results)	Personal Data for refused candidates must be deleted as soon as the recruitment process has been concluded. The retention period starts when the application process ends (another candidate is chosen).

Surveillance records, performed by the Company:

Document Type	Retention period
CCTV camera recordings	90 days as of when the recording was made unless a longer retention period is necessary for the purposes of investigating the specific incident (should be clarified)

Following the expiration of the term of storage, Personal Data and/ or paper and electronic documents are destroyed, anonymised or transferred to the state archive in specific cases. Every Responsible Person is responsible for the implementation of the deletion or anonymisation.

Main Principles for Deletion and Destruction of Personal Data

Information that contains Personal Data and is no longer needed for attaining the purposes of processing defined by the Company and the storage of which is not provided for by applicable legislation should be destructed. Electronic information is destroyed in such a way that it is not possible to restore information files. Written (paper) information is destroyed in such a way the information contained therein may not be restored.
It is prohibited to transfer IT devices to Third Parties if they contain Personal Data. The above prohibition should also be compiled within cases when IT devices are transferred for utilization. If an IT device needs a warranty repair, prior to its delivery for repair, the security of Personal Data contained by it should be secured.
Personal Data which have become incomplete, obsolete, false, unlawfully processed or no longer needed for attaining the purpose of processing Personal Data defined by the Company, are immediately rectified, updated or deleted.
Upon terminating processing of Personal Data and/or upon expiry of the term of storage thereof, if Personal Data is not anonymised, the Company or according to the Company instructions- the Personal Data processors irrecoverably deletes Personal Data.
Paper documents containing Personal Data or their drafts are destroyed in compliance with the procedure defined by legislation after data processing and/or expiration of the term of storage if they are not transferred to the archive.
After the end of the necessity of their use, technical resources containing Personal Data (USB, CD, HDD, etc.) are transferred to the IT Department which destructs technical resources in a centralized manner in such a way that it is not possible to restore the information stored there and deleted.
Deletion of Personal Data is recorded (documented) by preparing an act on the destruction of Personal Data in the case of necessity, by not permitting the inclusion of information about destructed Personal Data in the relevant act.
Deletion of unstructured data: all the Company employees shall perform the clean-up of not necessary unstructured Personal Data (if any), stored on their computers, on a quarterly basis.

9. RIGHTS, DUTIES, RESTRICTIONS AND LIABILITY OF USERS OF PERSONAL DATA

The Company employees are users of the Personal Data; therefore, they should ensure the interests of the Data Subject and comply with the requirements of processing of Personal Data provided by the Policy and the Regulation.
The Personal Data should be processed (including arrangement, blocking, deletion and destruction) in such a way that no loss or damage is caused to the Data Subject or the Company.
If unexpected conditions have emerged (incidental loss, destruction, damage of the Data Subject data, a Security Incident, Data breach), the Head of IT and DPO should be notified immediately and jointly solve the situation, as well as preserve evidence of the circumstances.
The Personal Data of Data Subjects may only be used for the purpose of processing provided for by the Policy, agreement with the Data Subject, Privacy policy and for the purposes and terms defined in the Policy and Register.
Disclosure of Personal Data is only possible in the following cases:
- The Company only discloses Personal Data to Authorized Persons if there is a relevant legal basis thereof.
- In the cases provided by legislation, the Company discloses Personal Data to state and local government officials (including state authorities in the area of national security, defence and criminal law or for the purpose of providing the state financial interests in tax matters) who have been identified prior to receipt of Personal Data. Personal Data is disclosed based on a written application or an agreement specifying the purpose of use of Personal Data if legislation does not provide to the contrary. Transfer of data to the above authorities does not have to be notified to the Data Subject if the applicable legislation does not provide for this.
- Transfer of Personal Data to Authorized Persons is done in the cases provided for by legislation by assuring this on a case-by-case basis. If other internal regulations do not provide to the contrary, communication with mass media or other Third Parties not performed within daily business operations only takes place with the approval of the Management Board of the Company.
- The fact of digital copying is recorded by the Information System. It is prohibited to copy documents containing Personal Data without a relevant authorisation.
- If Personal Data are disclosed to the recipient of Personal Data who is located or processes data outside the European Union or the European Economic Area, the Company ensures additional assessment by identifying the presence of the additional justification provided for by the Regulation.
Employees involved in the processing of Personal Data are obliged not to disclose Personal Data also after termination of the employment agreement. Employees who process Personal Data or who have access to Personal Data should confirm in writing compliance with confidentiality regarding Personal Data which have become known to them.

10. TRANSFER LIMITATION. PERSONAL DATA SHARING BY EMPLOYEES

Transfer Limitation

As a general rule the Personal Data are processed within the European Union/European Economic Area (EU/EEA).
Given the global nature of financial services and technological solutions and to process Personal Data for the purposes specified in the Policy, for the provision of individual services Personal Data may be transferred for Processing to the Personal Data receivers located outside the European Union and the European Economic Area, for instance, if their services are provided by a counterparty (processor, separate controller, joint controller). Any such international transfer of Personal Data is done in compliance with the requirements of the applicable laws and by informing the DPO before transfer. The transfer and processing of Data Subject data outside of the EU/EEA can take place provided there is a legal basis and appropriate safeguards are in place. Appropriate safeguards include for example:
- The EU Standard Contractual Clauses or other approved clauses, code of conduct, and certifications approved in accordance with the GDPR.
- The country outside of the EU/EEA where the recipient is located has an adequate level of data protection as decided by the EU Commission.
- The recipient is certified under the Privacy Shield (applies to recipients located in the United States).

Personal Data Sharing by Employees

It is prohibited to copy files containing Personal Data on external data carriers, except, if the permission of the Responsible Person or the Management Board has been received for such acts, or this is done in compliance with the Regulations or an approved procedure of performance of official duties.
Sending of Personal Data is done in a coded manner as far as possible. Protection of the set of information to be sent is provided by using a unique password for accessing the information available only to particular Authorized Persons and/ or the information addressee.
Personal Data recorded in a paper form are stored by the employee in a closed document storage as far as possible.
It is prohibited to leave documents or their drafts recording Personal Data at places where they are accessible without a particular authorisation or control to the Company employees who are not Authorized Persons and to Third Parties (for example, by leaving documents without any control on the desk upon leaving the workplace (the “policy of clean desk” should be followed).

11. EMPLOYEES TRAINING

The Company’s actions for providing training to employees:
- The Company provides training to its employees and information to them on the measures of protection of Personal Data in a minimum of 2 (two) ways, in particular, by performing the initial training and by performing regular training.
- The initial training is provided as the employee starts performance of official duties by presenting:
- the Policy and other related procedures are in force in the Company;
- the employee data processing notification;
- other regulations applicable to the employee.
After the initial training an employee signs the acknowledgement of the Policy which can be used to demonstrate to the regulator that the Policy has been received by the employee and he or she is aware of his or her obligations in case of a data breach.
Regular training takes place periodically, however, at least once in 2 (two) years when actual training of employees is done in the form of a lecture or by sending improved and updated procedures to them.

12. DATA PROTECTION OFFICER

The Management Board assigns a DPO, who could be an employee of the Company or an outside consultant.
The Management Board could define more particular requirements for the DPO, but at least it should include professional qualities and expert knowledge of data protection law and practices, as well as the ability to fulfil the tasks and a good understanding of the way how the Company operates.
The DPO is subordinated to the CISO of the Company. To avoid conflict of interest between the DPO’s responsibilities and duties, and other duties within the Company, the DPO does not operate any other role in the Company.
The Management Board and the CISO ensure that the DPO is duly and timely involved in all the matters related to the protection of Personal Data.
The Management Board and the CISO support the DPO in performing his/ her assignments, provide resources to enable the DPO to perform the above tasks and provide access to the Personal Data and the acts of processing of Personal Data, as well as provide the possibility of maintaining special knowledge to the DPO.
The DPO‘s tasks primarily are:
- to inform and advise employees how to be in compliance with the Regulation and other regulatory enactments on the protection of Personal Data;
- to give advice and recommendations to the Company about the interpretation or application of the data protection rules;
- to monitor the compliance of the Company’s performance with the Regulations and other external and internal regulatory enactments of protection of Personal Data, including division of duties, informing and training of employees involved in acts of processing of Personal Data, are complied with;
- to manage internal policies and registers necessary as well as make sure the Company is following them through,
- to provide advice regarding the Data Protection Impact Assessment and monitor its performance;
- to handle complaints or requests by the Data Subjects;
- to report any failure to comply with the GDPR or applicable data protection rules;
- to cooperate with the Supervisory Authority and to be the contact of the Supervisory Authority on matters related to processing of Personal Data, including in relation to prior discussion and other matters;
The DPO‘s rights primarily are:
- to receive the support of the Management Board of the Company for the performance of its tasks;
- to collect information in order to identify the processes of Personal Data processing, to analyze and to monitor compliance of Personal Data processing with the Regulation and to inform, provide advice and recommendations to the Management Board or employee in relation to the processing of Personal Data;
- to perform the inspection of processing of Personal Data without providing a prior notice;
- to be aware of the Company documents, technical and organizational requirements affecting the processing of Personal Data, as well as to receive timely information about Security Incidents and to familiarize with the register of Security Incidents;
- to participate in the adoption of resolutions affecting the matters of protection of Personal Data, to be aware of relevant documents in order to express the opinion and to provide advice;
- to draw the Company’s attention to any failure to comply with the applicable data protection rules.

13. PROFILING AND AUTOMATED DECISION MAKING

13.1. Profiling refers to the automatic Processing of Personal Data used to assess certain personal characteristics of a Data Subject, for example, the economic situation, personal preferences, interests, and place of residence of such individuals. Profiling is, for example, used to make analysis for the Data Subject advice, marketing purposes, system development, Automated decision-making such as credit assessments, risk management and transaction monitoring to counter fraud.
13.2. The Company may perform automated decisions for identity checks, risk management, anti-money laundering and international sanctions checks, and politically exposed person checks, for monitoring the Data Subject’s account and Data Subject’s behaviour in using the Company products to detect fraud and financial crime and implement international sanctions. In these cases, manual decision-making could be also involved.

Automated decision-making is prohibited unless the Data Subject provides Explicit consent, processing authorized by law or it is necessary for the performance of a contract. If decisions are based solely on Automated decision making then Data Subjects must be informed of their right to object and safeguards must be in place to protect Data Subject’s rights. DPIA must be carried out before carrying out any Automated decision-making activity.

14. TECHNICAL AND ORGANIZATIONAL MEASURES

The Company approves internal regulations to implement organizational measures to fulfil the Policy, such as:
- Processing of Personal Data, includes Privacy policy, consents, use of data for marketing purposes, monitoring of cookies and online activities;
- Human resource management and security:
  - Processing and informing of employees’ and applicants’ data;
  - Monitoring of employees’ devices, Internet and other types, access of employees;
  - Files and communications (are integrated into Information security policy);
  - Video surveillance;
  - Staff training;
- Processing of Personal Data of suppliers and cooperation partners;
- Review and execution of requests of Data Subjects;
- Involvement of other persons in Data processing:
  - Transfer of Data to other controllers;
  - Processors’ access to data;
  - transfer of data outside the EU or international organizations;
  - obtaining data from Third Parties (eg external databases);
- ensuring accountability:
  - keeping a Register of data processing;
  - activity of a Data Protection Officer;
  - Data Protection Impact Assessment procedures;
  - the procedure for the assessment of legitimate interests;
- Procedures for storage, archiving and destruction of Personal Data;
- a job description of the DPO;
- Data protection violations:
  - identifying and reporting on Data protection breaches;
  - register of Data protection breaches;
  - Data protection breach notification form to the Supervisory Authority;
  - Data breach notification form for Data Subjects;
- Keeping a register of processing operations;
The Company implements technical measures to fulfil the Policy such as:
- Pseudonymization and encryption of data and other Privacy by design measures;
- the ability to ensure the continuous processing of processing systems and services
- confidentiality, integrity, availability and resilience;
- the ability to restore the availability of and access to Data in a timely manner if it has occurred physical or technical accident;
- regular testing of the effectiveness of Technical and organizational measures of the process,
- evaluation and assessment to ensure the security of processing.
For any new process, process related to a new product and for any significant modification of an existing process, the following organizational measures shall be taken by the Responsible Person:
- Identify the categories of Personal Data used in the process, determine who is the Data Subject(s) of these data (e.g.: customer, employee); define the purpose of their processing within the specific process and assign the correct legal basis. If the assigned legal basis is consent – create/update relevant procedures related to the collection of consent.
- Verify whether all Personal Data intended to be used in the process is necessary to attain the purpose identified. In case excessive data is attested – consider whether another purpose justifies their processing. If yes – document it, if no distinct purpose is attested – limit the process to the use of necessary data only.
- Determine whether all or some of the Personal Data identified for this process shall be shared with one or more external parties (partner, supplier, etc.). If yes, determine if the external party is a data processor or a joint data controller and:
  - Verify whether there is a data processor agreement in place with each of the identified Third Parties.
  - Then verify whether the current data processor agreements cover the categories of data disclosed within this process and the purpose of the disclosure.
  - If there is no data processor agreement in place or the existing agreement does not cover the data disclosed within this process – ensure that the disclosed data is covered by an agreement before the first disclosure.
- Define the period for which the Personal Data shall be retained within this process or with relation to this product and make sure that deletion procedures are in place:
  - Retention before expiration of purpose – define and document the event that will mark the expiration of purpose. (e.g: termination of contract).
  - Retention after expiration of purpose: define the purpose and legal basis for retaining the data after expiration of purpose (e.g.: fulfill a requirement of an AML legislation), verify the retention period allowed by law for this purpose and document it. Specify which data categories need to be stored for this purpose – as the rest shall be deleted.
  - Inform CITO about the assigned retention rules. Confirm with him/her that the rules are integrated in the IT systems.
  - Make sure a deletion rule/procedure is created for the data that are stored elsewhere than in central systems: e.g. in physical archives or local drives.
- Verify whether the data and the purpose of their processing are covered by the Privacy Policy. If not – contact the owner of the Privacy Policy and solicit an adjustment or adopt a different means to inform Data Subjects.
- Identify the need for a DPIA and perform it if needed.
- Consult the DPO when conducting the DPIA and make sure that the DPO is informed about the result.
- Decide upon potential adjustments to the process or product based on the advice given by the DPO based on DPIA results.
- Document all the information identified based on the above steps.
- Use the assessed information to describe the GDPR compliance of the process/product within the product/process approval procedure.

15. PRIVACY POLICY

The Company obtains Personal Data for specified purposes and does not use it for a purpose that differs from stated in the Policy, Privacy Policy and Register.
The Company approves the Privacy Policy and makes it available publicly.
Privacy Policy establishes basic principles on Personal Data processing of the Company. Privacy Policy is applicable if a Data Subject uses, has used or has intention to use financial services provided by the Company, including the relationship with the Data Subject established before this Policy enters into force.
Before starting to use the Company’s services, the Data Subject must read and confirm acknowledgement and consent with the Privacy policy. The Data Subject’s confirmation is stored in the logs of the Company’s IT system.

16. DATA SUBJECT’S RIGHTS

The Company ensures, that Data Subjects have the following rights regarding data processing, and the data that is recorded about them:
- To make Data Subject access requests regarding the nature of information held and to whom it has been disclosed;
- To prevent processing likely to cause damage or distress;
- To prevent processing for purposes of direct marketing;
- To be informed about the mechanics of the Automated decision-making process that will significantly affect them;
- To not have significant decisions that will affect them taken solely by automated process;
- To sue for compensation if they suffer damage by any contravention of the Regulations;
- To take action to rectify, block, erase, including the right to be forgotten, or destroy inaccurate data;
- To request the Supervisory Authority to assess whether any provision of the Regulations has been contravened;
- To have Personal Data provided to them in a structured, commonly used and machine-readable format, and the right to have that data transmitted to another controller;
- To object to any Automated decision-making that is occurring without consent, unless it is necessary for entering into, or performance of, a contract between the Data Subject and the Company or is authorized by law to which the Company is subject and which also lays down suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests.
The Company ensures that Data Subjects may exercise these rights:
- Data Subjects may make data access requests as described in the Procedure on Handling Data Subject Requests and Complaints. This procedure also describes how the Company will ensure that its response to the Data access request complies with the requirements of the Regulation.
- Data Subjects have the right to complain to the Company related to the processing of their Personal Data, the handling of a request from a Data Subject and appeals from a Data Subject on how complaints have been handled in line with the relevant procedure on handling Data Subject requests and complaints.

17. DATA BREACH MANAGEMENT

Personal Data breach and notification to State Data Protection Inspectorate and Data Subjects is described in detail in Data Breach Management and Escalation Procedure.

18. DATA PROTECTION IMPACT ASSESSMENT

The Company ensures that it does not collect information that is not strictly necessary for the purpose for which Persona data is obtained and Data Protection Impact Assessment is made.
DPIA is mandatory in such cases:
- The processing of Personal Data shall be carried out for the purposes of scientific or historical research in at least one of the following cases:
  - where special categories of Personal Data are processed without the consent of the Data Subject or where the processing of Personal Data is carried out by linking or combining data sets;
  - when processing data of minors;
  - when processing a personal code.
- Large-scale processing of Personal Data where the Personal Data is received not from Data Subject and the provision of information provided for in Article 14 (1) and (2) of the GDPR is impossible or would require a disproportionate effort or could make it impossible or severely hinder the achievement of processing objectives.
- Processing of Personal Data where informing the recipients to whom the Personal Data have been disclosed of the rectification, erasure or limitation of the processing of Personal Data in accordance with Article 19 of GDPR is not possible or would require a disproportionate effort.
- Processing of biometric data for identification purposes in order to perform monitoring or control of Data Subjects or when processing Personal Data of vulnerable Data Subjects.
- Processing of genetic data for the purpose of assessing or scoring the characteristics of the Data Subject, including profiling and forecasting.
- Processing of personal video data where video surveillance is carried out in at least one of the following cases:
  - on-premises and/or areas which are not owned by the Company or on other lawful grounds, where video surveillance is carried out in accordance with the principles relating to the processing of Personal Data laid down in Article 5 of GDPR;
  - in health care, social care, prisons and other institutions where services are provided to vulnerable persons;
  - together with sound recording.
- Recording telephone conversations.
- Processing of Personal Data using innovative technologies or new technologies using existing technologies for the processing of Personal Data of vulnerable Data Subjects.
- Processing of children’s Personal Data for direct marketing purposes, assessment of children’s personal aspects based on automated processing, including profiling, or where information society services are offered directly to children.
- Processing of Personal Data of employees for monitoring or control purposes: processing of personal video and / or audio data at the workplace and / or at the data the Company ‘s premises or areas where his employees work; processing of Personal Data relating to the monitoring of employees, communication, behavior, location or movement.

19. PROCESSING OF EMPLOYEES PERSONAL DATA

The general provisions of the Policy regarding the protection of Personal Data are applicable to the processing of the Personal Data of the Company employees and candidates.
The Company only processes the employee and candidates Personal Data that are necessary for establishing, maintaining or termination of the legal employment relationship and performance of the obligations provided for by applicable legislation. In other cases, processing of Personal Data may only be done based on the ordinance of the Management Board by complying with the applicable conditions of processing of Personal Data.
The Company maintains the Personnel and Candidates‘ Data Processing Policy.
The Personal Data of employees and candidates may only be used for the purposes defined in the internal policies and Register. The users of employees’ Personal Data are accountants, personnel specialists and the Management Board of the Company. Users of employees’ and candidates’ Personal Data are authorized to receive any information about the Personal Data stored in the Company. Users of Personal Data provide access to Personal Data to state and local government officials in the cases provided for by the law. Users of Personal Data only disclose Personal Data to the state and local government officials whom they have identified prior to disclosure of data in compliance with the procedure provided for by the Regulations

20. COOKIE POLICY AND CONSENT

The Company approves Cookie Policy and makes it available publicly. The Company asks for website visitors’ consent to the Cookie Policy by ticking Yes in the check box.
Cookie Policy describes the use of cookies on the website kartiera.eu , indicating the purpose of the use of cookies, as well as users’ rights during the use of cookies. Cookies help to provide, improve and protect the financial services provided by the Company, providing more convenient offers in response to client’s needs and more convenient and safer use.
The Company considers the consent received by the Data Subject to be freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her.
CISO/DPO is responsible for Cookie Policy revision at least once per two years.

21. PROCESSORS OF PERSONAL DATA AND CONTRACTS WITH PROCESSORS

The Company is entitled to entrust the processing of Personal Data to a processor of Personal Data by applying the terms provided by the present chapter as a minimum.
The Company only cooperates with the processors who provide sufficient guarantee that the relevant technical and organizational measures will be implemented providing for compliance with the requirements of the Regulation and protection of the Data Subject’s Personal Data.
Prior to starting cooperation and signing a cooperation contract with the processor of Personal Data, the Responsible Persons, DPO and/ or the Management Board ensure the ability of the processor of Personal Data to comply with the Company instructions for ensuring secure processing of the Personal Data transferred to the processor of Personal Data.
The Responsible Person in cooperation with DPO, considering the nature, and scope of the Personal Data transferred to the processor of Personal Data and the essence of processing, assesses the necessity to perform regular inspections of the operation of the processor of Personal Data, in order to examine compliance with the Company’s as the controller’s instructions for ensuring secure processing of the Personal Data transferred to the processor of Personal Data compliant with the cooperation contract.
Prior to the transfer of Personal Data to the processor of Personal Data a written data protection agreement shall always be signed (unless the transfer of Personal Data is performed according to the law, e.g. to state authority) by stipulating the obligations of the processor of Personal Data stipulated by legislation, including the requirements of Article 28 of GDPR. The Company is entitled to also use the form proposed by the processor of Personal Data if the conditions included there fully comply with the requirements of the Company and valid legislation.
The Company does not permit the involvement of not assessed sub-processors without a written consent of the Company and consulting DPO. In any case the Company without unreasonable delay should be notified after involvement of a sub-processor, providing to the Company the possibility to terminate the relevant data processing agreement or require replacement of the sub-processor, as required.
The Company maintains the register of processors and sub-processors of Personal Data where it lists the processors of Personal Data, the venue of processing, the form of cooperation, the types of Personal Data, and implements control over the processor of Personal Data. CITO is responsible for updating the information about the processor in the Register of processing of Personal Data, and ensures it contains processors and sub-processors of Personal Data. CITO Informs CISO/DPO about new processors and sub-processors in the Register.
If Personal Data is disclosed to the processor of Personal Data who is located or processes data outside the European Union or the European Economic Area, the Company ensures additional assessment by identifying the presence of the additional justification provided for by GDPR.

22. FINAL CLAUSES

Enforcement of the Policy shall be the responsibility of the Management Board. The process shall be supervised by the CISO and DPO (the Process Owners).
The Process Owners shall review the Policy annually and propose modifications hereof to the Management Board as necessary.