The purpose of this document is to provide a concise policy statement regarding the Data Protection obligations of PES s.a with regard to the product and Services. This includes obligations in dealing with personal data, in order to ensure that the organisation complies with the requirements of the relevant legislation, namely the GDPR.
PES s.a must comply with the Data Protection principles set out in the relevant legislation. This Policy applies to all Personal Data collected, processed and stored by PES s.a in relation to its service providers and clients in the course of its activities.
The policy covers both personal and sensitive personal data held in relation to data subjects. The policy applies equally to personal data held in manual and automated form.
All personal and sensitive Personal Data will be treated with equal care by PES s.a. Both categories will be equally referred to as Personal Data in this policy, unless specifically stated otherwise.
This policy should be read in conjunction with the associated Data Subject Access Request procedure, the Data Retention and Destruction Policy, the Data Retention Periods List and the Data Loss Notification procedure.
PES s.a en tant que Responsable du traitement
In the course of its daily organisational activities, PES s.a acquires, processes and stores personal data in relation to:
- His employees
- Third-party service providers engaged with his employees
In accordance with the GDPR, this data must be acquired and managed fairly. Not all staff members will be expected to be experts in Data Protection legislation. However, Vanderbilt International is committed to ensuring that its staff have sufficient awareness of the legislation in order to be able to anticipate and identify a Data Protection issue, should one arise. In such circumstances, staff must ensure that the Data Protection Officer is informed, in order to ensure that appropriate corrective action is taken.
Due to the nature of the services provided by PES s.a, there is a regular and active exchange of personal data between Vanderbilt International and its Data Subjects. In addition, Vanderbilt International exchanges personal data with Data Processors on the Data Subjects’ behalf.
This is consistent with PES s.a obligations under the terms of its contract with its Data Processors.
This policy provides the guidelines for this exchange of information, as well as the procedure to follow in the event that a PES s.a staff member is unsure whether such data can be disclosed.
In general terms, the staff member should consult with the Data Protection Officer to seek clarification.
Subject Access Requests
Any formal, written request by a Data Subject for a copy of their personal data (a Data Subject Access Request) will be referred, as soon as possible, to the Data Protection Officer, and will be processed as soon as possible in accordance with GDPR regulations.
It is intended that by complying with these guidelines, PES s.a will adhere to best practice regarding the applicable Data Protection legislation.
The Data Protection Principles
The following key principles are enshrined in the GDPR legislation and are fundamental to the PES s.a Data Protection policy.
In its capacity as Data Controller, PES s.a ensures that all data shall:
...be obtained and processed fairly and lawfully.
For data to be obtained fairly, the data subject will, at the time the data are being collected, be made aware of :
- The identity of the Data Controller PES s.a
- The purpose(s) for which the data is being collected
- The person(s) to whom the data may be disclosed by the Data Controller
- Any other information that is necessary so that the processing may be fair.
PES s.a will meet this obligation in the following way :
- Where possible, the informed consent of the Data Subject will be sought before their data is processed.
- Where it is not possible to seek consent, PES s.a will ensure that collection of the data is justified under one of the other lawful processing conditions – legal obligation, contractual necessity, etc.;
- The Data Subject’s data will not be disclosed to a third party other than to a party contracted to PES s.a and operating on its behalf.
...be obtained only for one or more specified, legitimate purposes.PES s.a will obtain data for purposes which are specific, lawful and clearly stated. A Data Subject will have the right to question the purpose(s) for which PES s.a holds their data, and Vanderbilt International will be able to clearly state that purpose or purposes
...not be further processed in a manner incompatible with the specified purpose(s).Any use of the data by PES s.a will be compatible with the purposes for which the data was acquired.
...be kept safe and secure.PES s.a will employ high standards of security in order to protect the personal data under its care. Appropriate security measures will be taken to protect against unauthorized access to, or alteration, destruction or disclosure of any personal data held by PES s.a in its capacity as Data Controller. Access to and management of staff and customer records is limited to those staff members who have appropriate authorisation and password access.
...be kept accurate, complete and up-to-date where necessary.PES s.a :
- ensure that administrative and IT validation processes are in place to conduct regular assessments of data accuracy;
- conduct periodic reviews and audits to ensure that relevant data is kept accurate and up-to-date. PES s.a conducts a review of sample data every years to ensure accuracy; Staff contact details and details on next-of-kin are reviewed and updated every five years.
- conduct regular assessments in order to establish the need to keep certain Personal Data.
...be adequate, relevant and not excessive in relation to the purpose(s) for which the data were collected and processed.PES s.a will ensure that the data it processes in relation to Data Subjects are relevant to the purposes for which those data are collected. Data which are not relevant to such processing will not be acquired or maintained.
...not be kept for longer than is necessary to satisfy the specified purpose(s).PES s.a has identified an extensive matrix of data categories, with reference to the appropriate data retention period for each category. The matrix applies to data in both a manual and automated format. Once the respective retention period has elapsed, PES s.a undertakes to destroy, erase or otherwise put this data beyond use.
...be managed and stored in such a manner that, in the event, a Data Subject submits a valid Subject Access Request seeking a copy of their Personal Data, this data can be readily retrieved and provided to them.PES s.a has implemented a Subject Access Request procedure by which to manage such requests in an efficient and timely manner, within the timelines stipulated in the legislation.
Data Subject Access Requests
As part of the day-to-day operation of the organisation, PES s.a staff engage in active and regular exchanges of information with Data Subjects. Where a formal request is submitted by a Data Subject in relation to the data held by PES s.a, such a request gives rise to access rights in favour of the Data Subject.
There are specific timelines within which PES s.a must respond to the Data Subject, depending on the nature and extent of the request. These are outlined in the Data Subject Access Request process.
PES s.a staff will ensure that, where necessary, such requests are forwarded to the Data Protection Officer in a timely manner, and they are processed as quickly and efficiently as possible, according to GDPR.
As a Data Controller, PES s.a ensures that any entity which processes Personal Data on its behalf (a Data Processor) does so in a manner compliant with the Data Protection legislation.
Failure of a Data Processor to manage PES s.a data in a compliant manner will be viewed as a breach of contract, and will be pursued through the courts.
Failure of PES s.a staff to process Personal Data in compliance with this policy may result in disciplinary proceedings.
What kinds of information do we collect?
Users of SPC Connect need to enter the following mandatory information during the registration process:
- First and Last Name
- Phone number
- Company name
- VAT number
- Company type
- Security Question information
In addition to the above, the following optional fields may also be added by the user during the registration process. :
- Cell numlber
- Fax number
Users of SPC Connect need to enter the following mandatory information during the request contact process :
- Phone number
- How did you hear about us
In addition to the above, the following optional fields may also be added by the user during the request contact process :
- Would you like to receive our newsletter
How do we use this information ?
We use the information collected to provide a response to our customers' requests for our services; Our company also uses this information to keep abreast of new services / products from PES s.a.
Where and how is my information stored ?
Your information is stored within the EU and will not be transferred outside the EU. All PES s.a information data is hosted on a database. Backups of the database happen regularly. Personal data is not replicated on any other system or used for any other purpose. The database access is strictly password protected. Only software engineers within PES s.a with the absolute need to access the database are allowed to do so. All access is strictly for management and control of the system, or for necessary debugging purposes.
How long is my data stored?
All information is saved as long as the user remains PES s.a customers. The user can delete his account at any time on the website. After the account is deleted, all user information is deleted, but related information may contain links to the "deleted" user, for example, in the audit logs. Only the username will be used to reach this information. If a PES s.a customer does not order products for 2 years, the account owner will be contacted. If he does not want to be one of our customers, the account will be deleted.
How is my data protected?
The database access is strictly password protected. Only software engineers within PES s.a with the absolute need to access the database are allowed to do so. All access is strictly for management and control of the system, or for necessary debugging purposes.
How is this information obtained?
PES s.a clients enter data manually through the web interface, are collected through physical surveys, or by simple requests from them by phone or email.
Legal basis on which processing of personal data is based?
Users accept the “terms and conditions” and “data protection policy” of the PES s.a account on registration and the ability to delete their personal data exists within the website.
How can I manage, delete or rectify information about me?
A user can manage, delete or rectify their account at any time by contacting the marketing department.
The information is deleted as detailed above.
How do I request access to my data