Privacy policy (GDPR)

The Personal Data Protection Policy (Security Policy) is the core document that sets out how the Company complies with personal data protection principles and describes the processes relating to such protection, and therefore to the application of the GDPR.

Personal data protection policy

1. This document, entitled "Personal Data Protection Policy", sets out the requirements, principles and rules for the protection of personal data at bRenewal, a brand of Philip Rockwell LTD (hereinafter "the Company").

This Policy is a data protection policy within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, p. 1), hereinafter "the GDPR".

The Policy describes the data protection principles in force at Philip Rockwell LTD, together with model procedures and instructions for specific areas of personal data protection. The partners of Philip Rockwell LTD, acting as the Controller, are responsible for implementing and maintaining this Policy. The application of the Policy is the responsibility of the Controller and the persons designated by the Controller. Where the Company transfers personal data to its business partners, the Company ensures that they act in accordance with this Policy to the appropriate extent.

2. The definitions and terms used in this Policy and the related documentation have the following meanings:

Policy means this Personal Data Protection Policy, unless the context clearly indicates otherwise.

GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, p. 1).

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In this personal data processing documentation, the Controller means Philip Rockwell LTD.

Personal data means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Filing system" means any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Restriction of processing" means the marking of stored personal data with the aim of limiting their processing in the future.

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Authorised person means a person who has received authorisation from the Controller to process personal data.

Authorisation means a statement issued by the Controller identifying by name the person entitled to process personal data within the scope specified in that statement.

System user means an authorised person who has been granted access to IT systems that process personal data for which Philip Rockwell LTD is the Controller.

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

Recipient means a natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not.

"Personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Personal data processing documentation means the personal data processing security policy, the IT system management instructions, the authorisation to process personal data, the declaration of compliance with personal data protection and the established procedures, the register of persons authorised to process data, the data processing agreement, the register of recipients of personal data, the register of filing systems, the register of data carriers and software, the register of processors, the records of processing activities, the register of data access requests, the information notices for data subjects, the objection to a processor, the list of legal bases for processing, the data protection impact assessment procedure and the risk management procedure.

Data export means the transfer of personal data to a third country or an international organisation.

DPO means the Data Protection Officer.

RPA means the Records of Processing Activities.

General principles of personal data protection

1. Personal data protection principles applied by the Controller:

Lawfulness - the Company takes care to protect privacy and processes data in accordance with the law.

Security - the Company ensures an appropriate level of data security by taking continuous action in this area.

Rights of the individual - the Company enables data subjects to exercise their rights and gives effect to those rights.

Accountability - the Company documents how it fulfils its obligations so that it can demonstrate compliance at any time.

2. Data protection principles

The Controller processes personal data on a legal basis and in accordance with the law (lawfulness); fairly and honestly (fairness); in a manner that is transparent to the data subject (transparency); for specified purposes and not "just in case" (data minimisation); to no greater extent than necessary (adequacy); with care for the accuracy of the data (accuracy); for no longer than necessary (storage limitation); and while ensuring appropriate security of the data (security).

Data protection system

The Controller's personal data protection system consists of the following activities and elements:

1) The Controller identifies personal data resources, data categories and the relationships between data resources, and identifies the ways in which the data are used.

2) The Controller ensures, identifies and verifies the legal bases for processing and records them in the Register, including by:

a) maintaining a system for managing consents to data processing and distance communication,

b) keeping an inventory of, and specifying in detail the justification for, cases in which the Controller processes data on the basis of legitimate interest.

3) The Controller fulfils its information obligations towards data subjects and ensures that their rights are handled by responding to requests received in this respect, including as follows:

a) The Controller provides data subjects with the information required by law when collecting data and in other situations, and organises and ensures documentation of the fulfilment of these obligations (information notices and registers).

b) The Controller verifies and ensures that each type of request can be effectively handled by the Controller and its processors (information notices).

c) The Controller provides adequate resources and procedures to ensure that data subject requests are handled within the time limits and in the manner required by the GDPR, and are documented.

d) The Company applies procedures to determine whether it is necessary to notify data subjects affected by an identified personal data breach (personal data breach register).

4) The Controller ensures an appropriate level of data security, including:

5) The Controller has rules for selecting processors acting on its behalf, requirements concerning the conditions of processing (data processing agreement) and rules for verifying the performance of data processing agreements.

6) The Controller manages changes affecting privacy. To this end, the procedures for launching new projects and investments take into account the need to assess the impact of a change on data protection and to ensure privacy (including compatibility of processing purposes, data security and data minimisation) at the design stage of a change or investment, or at the outset of a new project.

Information obligations

1. The Controller ensures that the information and communications provided to data subjects are clear and easy to read.

2. The Controller ensures compliance with the statutory time limits for fulfilling its obligations towards data subjects.

3. The Controller implements adequate methods of identifying and authenticating individuals for the purposes of exercising individual rights and fulfilling information obligations.

4. In order to give effect to individual rights, the Controller maintains procedures and mechanisms that make it possible to identify the data of specific individuals processed by the Company, to consolidate such data, and to amend and erase them in an integrated manner.

5. The Controller documents the handling of information obligations, notifications and data subject requests.

6. The Controller determines lawful and effective ways of fulfilling its information obligations.

7. The Controller informs the data subject where the time limit for handling his or her request is extended beyond one month.

8. The Controller informs the data subject about the processing of his or her data when the data are collected from that person.

9. The Controller informs the data subject about the processing of his or her data when the data have not been obtained directly from that person.

10. The Controller determines, where possible, how to inform individuals about the processing of data that does not require identification.

11. The Controller informs the data subject of any planned change to the purpose of processing.

12. The Controller informs the data subject before a restriction of processing is lifted.

13. The Controller informs recipients of personal data of any rectification, erasure or restriction of processing (unless this proves impossible or involves disproportionate effort).

14. The Controller informs the data subject of the right to object to processing at the latest at the time of the first communication with that person.

15. The Controller notifies the data subject without undue delay of a personal data breach where the breach is likely to result in a high risk to the rights and freedoms of that person.

Data subject requests

1. When giving effect to the rights of data subjects, the Controller implements procedural safeguards to protect the rights and freedoms of third parties. In particular, where the Controller receives credible information that complying with a request for a copy of data or with the right to data portability may adversely affect the rights and freedoms of others (e.g. rights relating to the protection of other persons' data, intellectual property rights, trade secrets, personal rights, etc.), the Controller may contact the data subject to clarify any doubts or take other steps permitted by law, including refusing to comply with the request.

2. Where a data subject has submitted a request concerning his or her rights, the Controller informs that person if it does not process, or has ceased to process, data concerning him or her.

3. Within one month of receiving a request, the Controller informs the data subject of any refusal to act on the request and of the data subject's related rights.

4. At the request of a data subject concerning access to their data, the Controller informs the data subject whether it processes their data and provides details of the processing in accordance with Article 15 GDPR (the scope corresponds to the information obligation when collecting data), and grants the data subject access to the data concerning them. Access to data may be provided by issuing a copy of the data, provided that a copy issued in exercise of the right of access will not be regarded by the Company as the first free copy of the data for the purposes of fees for copies of data.

5. Upon request, the Controller provides the data subject with a copy of the data concerning them and records the fact that the first copy has been issued. The Controller introduces and maintains a price list for copies of data, according to which it charges fees for further copies. The price of a copy of data is calculated on the basis of the estimated unit cost of handling a request for a copy of data.

6. The Controller rectifies inaccurate data at the request of the data subject. The Controller has the right to refuse rectification unless the data subject reasonably demonstrates the inaccuracy of the data whose rectification they request. Where data are rectified, the Company informs the data subject about the recipients of the data at the data subject's request.

7. The Controller completes and updates data at the request of the data subject. The Controller has the right to refuse to complete data if doing so would be incompatible with the purposes of processing (e.g. the Company is not required to process data it does not need). The Controller may rely on the data subject's statement regarding the data to be completed, unless this is insufficient in light of the procedures adopted by the Company (e.g. regarding the collection of such data) or the law, or there are grounds to consider the statement unreliable.

8. At the request of the data subject, the Controller erases data where:

– the data are no longer necessary for the purposes for which they were collected or otherwise processed,

– consent to their processing has been withdrawn and there is no other legal basis for the processing,

– the data subject has successfully objected to the processing of the data,

– the data have been processed unlawfully,

– erasure is required to comply with a legal obligation,

– the request concerns data of a child collected on the basis of consent in relation to the offer of information society services directly to a child (e.g. a child's profile on a social networking site, participation in a competition on a website).

The Controller defines the manner of handling the right to erasure so as to ensure the effective exercise of this right while respecting all data protection principles, including security, and to verify whether any of the exceptions referred to in Article 17(3) GDPR apply.

Where the data subject to erasure have been made public by the Controller, it takes reasonable steps, including technical measures, to inform other controllers processing those personal data of the need to erase the data and any links to them.

Where data are erased, the Company informs the data subject about the recipients of the data at the data subject's request.

Restriction of processing

1. The Controller restricts the processing of data at the request of the data subject where:

a) the data subject contests the accuracy of the data – for a period enabling the accuracy of the data to be verified,

b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,

c) the Company no longer needs the personal data, but they are required by the data subject for the establishment, exercise or defence of legal claims,

d) the data subject has objected to processing on grounds relating to their particular situation – pending verification of whether the Company's legitimate grounds override those of the data subject.

3. During the restriction of processing, the Controller stores the data but does not otherwise process them (does not use or transfer them) without the consent of the data subject, except for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest. The Company informs the data subject before the restriction of processing is lifted. Where processing is restricted, the Company informs the data subject about the recipients of the data at the data subject's request.

4. At the request of the data subject, the Company provides, in a structured, commonly used and machine-readable format, or transmits to another entity where technically feasible, the data concerning that data subject which they have provided to the Company and which are processed in the Company's IT systems on the basis of the data subject's consent or for the purpose of concluding or performing a contract with them.

Objection to processing

1. If a data subject objects, on grounds relating to their particular situation, to the processing of their data, and the data are processed by the Controller on the basis of legitimate interest or of a task carried out in the public interest, the Controller will uphold the objection unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims.

2. Objection in the case of scientific or historical research or statistical purposes. If the Controller conducts scientific or historical research or processes data for statistical purposes, the data subject may object to such processing on grounds relating to their particular situation. The Company will uphold such an objection unless the processing is necessary for the performance of a task carried out in the public interest.

3. Objection to direct marketing. If a data subject objects to the processing of their data by the Controller for direct marketing purposes (including any related profiling), the Controller will uphold the objection and cease such processing.

4. Right to human intervention in automated processing. If the Controller processes data by automated means, including in particular profiling, and consequently takes decisions producing legal effects concerning the data subject or similarly significantly affecting them, the Controller ensures the possibility of obtaining human intervention and a human decision on the part of the Company, unless such an automated decision is necessary for entering into or performing a contract between the data subject and the Company, is expressly authorised by law, or is based on the explicit consent of the data subject.

Data minimisation

The Controller ensures the minimisation of data processing in terms of: the adequacy of the data for the purposes (the amount of data and the scope of processing), access to the data, and the data retention period.

a) Minimisation of scope

– As part of the GDPR implementation, the Controller has verified the scope of the data collected, the scope of their processing and the amount of data processed in terms of their adequacy for the purposes of processing.

– The Controller periodically reviews the amount of data processed and the scope of their processing at least once a year.

– The Controller verifies changes in the amount and scope of data processing as part of its change management procedures.

b) Minimisation of access

The Controller applies the following restrictions on access to personal data:

– legal (confidentiality undertakings, scopes of authorisation),

– physical (access zones, locking of premises),

– logical (restrictions on permissions to systems processing personal data and to network resources in which personal data reside).

The Controller applies physical access control.

The Controller updates access permissions in the event of changes in staff composition, changes in individuals' roles, and changes of processors.

The Controller periodically reviews the established system users and updates them at least once a year.

Detailed rules on physical and logical access control are set out in the Company's physical security and information security procedures.

c) Minimisation of time

The Controller implements mechanisms for controlling the personal data life cycle, including verification of the continued usefulness of data against the deadlines and checkpoints specified in the Records of Processing Activities.

Data whose usefulness diminishes over time are erased from the Controller's systems as well as from working and main files. Such data may be archived and may be contained in backup copies of systems and information processed by the Controller. The procedures for archiving and use of archives, and for creating and using backup copies, take into account the requirements for controlling the data life cycle, including data erasure requirements.

Security

The Controller ensures a level of security appropriate to the risk to the rights and freedoms of natural persons resulting from the processing of personal data.

1. Risk analyses and adequacy of security measures

The Controller carries out and documents analyses of the adequacy of personal data security measures. To this end:

(1) The Controller ensures an appropriate level of knowledge of information security, cybersecurity and business continuity − internally or with the support of specialised entities.

(2) The Controller categorises data and processing activities in terms of the risk they present.

(3) The Controller carries out analyses of the risk to the rights or freedoms of natural persons for data processing activities or categories thereof. The Company analyses possible personal data breach situations and scenarios, taking into account the nature, scope, context and purposes of the processing and the risks of varying likelihood and severity to the rights or freedoms of natural persons.

(4) The Controller determines the applicable organisational and technical security measures and assesses the cost of their implementation. In particular, the Company determines the suitability of applying such measures and approaches as:

a) pseudonymisation,

b) encryption of personal data,

c) other cybersecurity measures contributing to the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services,

d) business continuity and disaster recovery measures, i.e. the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident.

2. Breach notification

The Controller applies procedures enabling the identification, assessment and notification of an identified personal data breach to the Personal Data Protection Office (UODO) within 72 hours of becoming aware of the breach.

Processors

The Controller has rules for the selection and verification of processors processing data on behalf of the Company, developed to ensure that processors provide sufficient guarantees to implement appropriate organisational and technical measures to ensure security, the exercise of data subjects' rights and the fulfilment of other data protection obligations incumbent on the Company.

Privacy by design

The Controller manages changes affecting privacy in such a way as to ensure appropriate security of personal data and the minimisation of their processing.

To this end, the Controller's rules for conducting projects and investments refer to the principles of personal data security and minimisation, requiring a privacy and data protection impact assessment, and the consideration and design of security and data processing minimisation from the outset of the project or investment.

Questions about your personal data: office@brenewal.eu