Personal Data Protection Policy of Amernet Sp. z o.o.
1. Purpose of the policy
This Policy has been drawn up to fulfil the obligations of Amernet Sp. z o.o., with its registered office in Warsaw, as a controller of Personal data and as a processor within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
The purpose of the Policy is to protect the Personal data processed by Amernet Sp. z o.o., with its registered office in Warsaw, against all kinds of threats, internal and external, deliberate or accidental.
2. Definitions
The terms used in this Policy have the following meanings:
Controller – the controller of Personal data: Amernet Sp. z o.o., with its registered office at ul. Puławska 487, 02-844 Warsaw, entered in the register of entrepreneurs of the National Court Register kept by the District Court in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000214118, REGON: 015766236, NIP (tax ID): 5213301231;
Security of processing of Personal data – maintaining the confidentiality, integrity and accountability of Personal data;
Personal data – any information relating to an identified or identifiable natural person. An “identifiable person” is a person whose identity can be determined directly or indirectly, in particular by reference to one or more factors specific to that person;
Documentation – the Controller’s documentation relating to the processing of Personal data, consisting of the following documents:
a. Record of processing activities (Annex 1 to the Policy),
b. List of Personal data filing systems (Annex 2 to the Policy),
c. Risk assessment procedure (Annex 3 to the Policy),
d. General risk assessment (Annex 4 to the Policy),
e. Data retention table (Annex 5 to the Policy),
f. IT system management instructions (Annex 6 to the Policy),
g. List of premises (Annex 7 to the Policy),
h. IT asset inventory (Annex 8 to the Policy),
i. E-mail information clause (e-mail footer) (Annex 9 to the Policy),
j. Information clause – employees / contractors (Annex 10 to the Policy),
k. Information clause – recruitment (Annex 11 to the Policy),
l. Procedure in the event of a breach of Personal data protection rules (Annex 12 to the Policy),
m. Register of Personal data breaches (Annex 13 to the Policy),
n. Template data processing agreement (Annex 14 to the Policy),
o. Record of categories of processing activities (processor’s record) (Annex 15 to the Policy),
p. Template statement by an employee/contractor confirming familiarity with the GDPR documentation (Annex 16 to the Policy),
q. Template authorisation to process Personal data (Annex 17 to the Policy),
r. Register of persons authorised to process Personal data (Annex 18 to the Policy),
s. documentation relating to checks, inspections and any administrative proceedings concerning the protection of Personal data,
t. originals and copies of documents relating to the protection of Personal data, in particular resolutions of the Controller’s Management Board and other necessary rules and procedures.
Integrity of Personal data – the property ensuring that Personal data have not been altered or destroyed in an unauthorised manner;
Contractor – a self-employed natural person providing services to the Controller under a civil-law contract;
Personal data breach – an intentional or accidental breach of the technical and organisational measures applied to protect Personal data;
Policy – the personal data protection policy, i.e. this document together with all its annexes, which form an integral part of it;
Confidentiality – the property ensuring that information (e.g. Personal data) is available only to authorised persons;
Processing of Personal data – any operation performed on Personal data, such as collection, recording, storage, organisation, alteration, disclosure and erasure, in particular operations performed in IT systems;
PUODO – the President of the Personal Data Protection Office (Poland’s supervisory authority);
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
Accountability – the property ensuring that the actions of an entity can be attributed unambiguously to that entity alone;
IT system – the IT infrastructure comprising the entire information system: IT systems and applications, a set of cooperating devices, programs, information processing procedures and software tools used to process Personal data;
Act – the Polish Personal Data Protection Act of 10 May 2018 (consolidated text: Journal of Laws 2019, item 1781);
User – a person authorised to have direct access to Personal data processed in the IT system, who has an assigned identifier (login) and password;
Personal data filing system – any structured set of personal data accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional basis.
3. Personal data
The Controller keeps a Record of processing activities in which all Personal data processing operations carried out in the course of the Controller’s business are recorded. The Record contains all the information referred to in Article 30 GDPR, in particular:
a) Personal data processing operations;
b) who has or may have access to the Personal data processed;
c) the purpose for which the Personal data are processed;
d) whose Personal data are processed;
e) the categories of Personal data processed;
f) the legal basis for processing the Personal data;
g) the source of the Personal data;
h) the retention period of the Personal data processed;
i) the entities to which processing of the Personal data has been entrusted;
j) whether a data protection impact assessment (DPIA) has been carried out for the processing operation;
k) whether the Personal data are transferred outside the EU.
The Personal data processed are mainly information concerning:
a) the Controller’s employees and contractors, processed in accordance with the law in connection with recruitment and the employment/cooperation relationship;
b) the Controller’s day-to-day operations, such as data:
i) relating to any claims of the Controller,
ii) relating to the Controller’s current financial settlements;
c) resulting from and necessary for the proper provision of services by the Controller.
4. Role of the Controller
Provisions of the Policy referring to obligations or actions of the Controller should be understood as actions performed directly by the Controller’s Management Board.
The acts and omissions of each employee or contractor of Amernet Sp. z o.o., with its registered office in Warsaw, in the course of processing Personal data as part of their duties, are also acts or omissions of the Controller.
The Controller is responsible for processing and protecting Personal data in accordance with the law, including introducing procedures that ensure the correct processing of Personal data and protect them against disclosure to unauthorised persons, alteration or removal by unauthorised persons, processing in breach of the Act, and loss, damage or destruction.
When processing Personal data, appropriate steps must be taken to ensure their proper protection, in particular to ensure that throughout the processing period the Personal data are:
– processed lawfully;
– collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes;
– accurate and adequate in relation to the purposes for which they are processed;
– kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the Personal data were obtained;
– secured by technical and organisational measures ensuring the accountability, integrity and confidentiality of Personal data;
– processed in an IT system with a level of security and safeguards appropriate to the threats identified in the Controller’s General risk assessment, which forms Annex 4 to the Policy;
– deleted in accordance with the time limits set out in the Personal data retention table, which forms Annex 5 to the Policy.
In the processing of Personal data, the Controller is responsible for granting, changing and withdrawing authorisations to process Personal data in accordance with the Policy.
5. Division of responsibilities in the processing of Personal data
The Controller’s Management Board
In accordance with the guidelines of the Article 29 Working Party, an analysis was carried out which established that there is no obligation to appoint a data protection officer. The analysis showed that the conditions set out in Article 37(1) GDPR are not met, and the Controller’s Management Board is therefore not obliged to appoint a Data Protection Officer.
The Controller’s Management Board manages and controls the processing of Personal data. The Management Board consists of Artur Włodarczyk, contact details: tel. +48 602 220 422; e-mail: [email protected].
The Controller’s Management Board acts in the name and on behalf of the Controller and is responsible for compliance by all persons processing Personal data in the course of the Controller’s business.
The Controller’s Management Board is responsible for processing and protecting Personal data in accordance with the law, including implementing and observing procedures that ensure the correct processing of Personal data and protect them against disclosure to unauthorised persons, alteration or removal by unauthorised persons, processing in breach of the Act, and loss, damage or destruction.
The duties of the Controller’s Management Board include in particular:
a) defining Personal data protection rules, procedures and instructions;
b) initiating procedures to sanction persons guilty of breaching Personal data protection laws and rules;
c) supervising the implementation of appropriate organisational, technical and physical measures to protect the Personal data processed;
d) reviewing contracts with regard to provisions governing access to Personal data and their disclosure to other entities;
e) reviewing requests received by the Controller for disclosure of Personal data as regards whether disclosure is permissible and the scope of the data to be disclosed;
f) responding when a person whose Personal data are processed contacts the Controller, in accordance with the Procedure for responding to data subject requests, which forms Annex 14 to the Policy;
g) supervising the adaptation of the functionality of systems processing Personal data to the requirements of the Act;
h) familiarising the Controller’s employees and contractors with Personal data protection laws and rules, informing them of the risks associated with processing, and documenting this;
i) supervising or conducting regular training on Personal data protection rules and laws;
j) representing the Controller in dealings with PUODO;
k) responding to and analysing reported incidents involving a breach or risk of a breach of Personal data protection;
l) checking the fulfilment of technical and organisational obligations related to Personal data protection;
m) keeping and updating the Documentation;
n) defining and drafting rules and procedures for using the IT system;
o) granting and withdrawing employees’ and contractors’ access rights to individual:
i. applications,
ii. programs,
iii. operating systems,
iv. electronic devices;
p) carrying out security audits of the IT system whenever necessary, but at least once a month;
q) keeping the IT asset inventory up to date on an ongoing (regular) basis.
6. Sanctions for breaching Personal data protection
A breach of Personal data protection by an employee or contractor may result in them being charged with an offence under Article 266 § 1 of the Polish Criminal Code (Act of 6 June 1997 – Criminal Code, consolidated text: Journal of Laws 2020, item 1444).
In such a case, in accordance with Article 66 of the Polish Labour Code (Act of 26 June 1974 – Labour Code, consolidated text: Journal of Laws 2020, item 1320), the employment contract of an employee held in pre-trial detention expires after 3 months of the employee’s absence from work due to detention, unless the Controller has earlier terminated the employment contract without notice through the employee’s fault.
Under Article 100 § 2(5) of the Labour Code, an employee is obliged to keep secrets defined in separate regulations. Personal data designated as confidential by the Controller constitute such a secret, and its disclosure – depending on the scope of the Personal data disclosed and the intent of the employee making the unauthorised disclosure – may constitute a breach or a serious breach of employee duties.
An employee or contractor who discloses or uses Personal data without authorisation in a manner contrary to their purpose (e.g. using Personal data for private purposes), or processes them in a manner inconsistent with the procedures adopted in the Controller’s organisational structure, may be given a caution or a reprimand.
Under Article 52 § 1 of the Labour Code, the Controller as employer may terminate an employment contract without notice through the employee’s fault in the event of a serious breach of the employee’s basic duties. Such a breach includes failure to keep Personal data confidential or processing them in a manner grossly contrary to the Policy.
Sanctions concerning the disclosure of confidential Personal data apply accordingly to disclosure by an employee or contractor of information about how Personal data are secured at the Controller.
Irrespective of liability under generally applicable law, a breach of the rules set out in this Policy may be deemed a serious breach of obligations arising from contracts and statements made.
In the case of contractors, a breach of the Personal data processing rules described in this Policy also constitutes a material breach of the contract between the Controller and the contractor.
7. Information obligation
Employees or contractors conducting recruitment of new employees or contractors on behalf of the Controller must provide the candidate with an information clause in line with the template information clause – recruitment, which forms Annex 11 to the Policy.
The persons responsible for hiring must provide employees or contractors with an information clause in line with the template information clause – employees/contractors, which forms Annex 10 to the Policy.
Where explicit consent must be obtained from the data subject before their Personal data are processed, the employee or contractor must obtain such consent. The wording of the consent should be agreed with the Controller’s Representative.
8. Training
Before being allowed to process Personal data, an employee or contractor should be trained. The training covers the Personal data protection laws, the implementing acts issued under them and the instructions in force at the Controller.
Training is conducted electronically under the supervision of the Controller’s Management Board.
To ensure an appropriate level of knowledge of Personal data protection, training should be repeated periodically or whenever necessary.
After the training and after reading the Documentation, the employee or contractor signs a written statement in line with the template statement of an employee/contractor confirming familiarity with the GDPR documentation.
9. Authorising persons to process Personal data
Personal data may be processed only after the employee or contractor has received a formal authorisation to process Personal data, issued by the Controller’s Management Board or a person authorised by it.
The person granting the authorisation must first verify that the employee or contractor, in the form adopted by the Controller: (a) has completed training on Personal data processing rules, (b) has submitted a statement confirming familiarity with the Documentation in the form adopted by the Controller, (c) has signed a confidentiality statement.
If the employee or contractor meets all the above requirements, they are granted authorisation to process Personal data.
The authorisations referred to above are recorded in a register of authorisations kept electronically in the IT system.
The authorisations referred to above are kept with the personnel files or, for persons who are not employees within the meaning of the Labour Code, in the files relating to the conclusion and performance of the cooperation, service or specific-task contract.
Rules similar to those described above apply to persons who are not employees or persons with whom the Controller has concluded a service or specific-task contract and who are authorised to process Personal data.
10. Exchange of information concerning Personal data
Persons authorised to process Personal data within the Controller’s organisational structure must strictly comply with this Policy and the other procedures in force in the Company in order to protect the information exchanged concerning Personal data and the Personal data themselves.
11. Technical and organisational measures ensuring the confidentiality, integrity and accountability of the Personal data processed
The following organisational safeguards are applied to protect Personal data:
– the Policy has been drawn up and implemented,
– a General risk assessment has been carried out;
– only persons holding authorisations granted by the Controller or a person authorised by it are allowed to process Personal data;
– a register of persons authorised to process Personal data is kept;
– persons allowed to process Personal data have been familiarised with the laws on the protection of such data and with the IT system security rules;
– persons allowed to process Personal data have been obliged to keep them confidential;
– Personal data are processed in conditions that protect them against access by unauthorised persons;
– data processing agreements are used when cooperating with entities processing Personal data controlled by Amernet Sp. z o.o., with its registered office in Warsaw, and with entities on whose behalf Amernet Sp. z o.o., with its registered office in Warsaw, processes Personal data as a processor.
The following physical safeguards are applied to protect Personal data:
– Personal data are not stored on the Controller’s servers; everything is stored in cloud software listed in detail in the IT asset inventory;
– individual computers can be accessed only by the persons to whom they have been entrusted;
– employees and associates have been trained in social engineering attacks;
– rooms containing resources that process Personal data are locked, and only authorised persons have access to them.
The following hardware safeguards of the IT and telecommunications infrastructure are applied to protect Personal data:
– a firewall is used to separate the local network from the public network;
– a user name and password are required to use resources stored in the cloud;
– anti-virus software is used to minimise the risk of malicious software interfering with IT systems and Personal data.
12. Risk assessment
A proper risk assessment makes it possible to introduce security measures in advance that either significantly reduce the risk of a specific event or at least effectively limit its negative consequences if such an event does occur.
To identify the Controller’s weaknesses (vulnerabilities) that could, in certain situations, lead to a breach of Personal data protection, the Controller’s Management Board carries out a general risk assessment.
When assessing risk, the Controller’s Management Board must take into account the risk of unauthorised or accidental: (a) destruction of Personal data; (b) loss of Personal data; (c) modification of Personal data; (d) unauthorised disclosure of Personal data; (e) unauthorised access to Personal data.
13. Rules for protecting Personal data in non-electronic filing systems
Documents and printouts containing Personal data are kept in locked rooms or cabinets accessible only to authorised persons.
Working, incorrect or outdated printouts are destroyed without delay using a paper shredder or in another way that ensures their effective deletion or anonymisation.
All employees and contractors of the Controller have been informed of the need to apply a clean desk policy in order to reduce the risk of unauthorised persons accessing Personal data.
14. Entrusting processing – procedure for concluding agreements
Entrusting data to a subcontractor (processor)
Before any Personal data contained in Personal data filing systems are transferred, it must be checked whether the subcontractor has signed a confidentiality agreement or statement.
The next step is to conclude a data processing agreement. If a change to the template or the use of a different template (e.g. the other party’s) is requested, the agreement must be approved by the Controller’s Management Board before it is concluded.
The contact details of the processor’s staff authorised to supervise the processing of Personal data under the agreement must be established.
The process of concluding a data processing agreement ends with the Controller’s Representative making an appropriate entry in the Record of processing activities.
Entrusting Personal data to the Controller as a processor
In order to process Personal data as a processor on behalf of another controller, a data processing agreement must first be concluded. If a change to the template or the use of a different template (e.g. the other party’s) is requested, the agreement must be approved by the Controller’s Management Board before it is concluded.
It must also be ensured that a contact person for the client (controller) has been designated within the Controller’s organisation.
Next, it must be ensured that the employee or contractor allowed to process Personal data under the agreement holds the relevant authorisations.
The process of concluding a data processing agreement ends with the Controller’s Management Board making an appropriate entry in the Record of categories of processing activities.
Termination of any data processing agreement
When a data processing agreement ends or is terminated, for whatever reason, it must be ensured that:
a) the authorisations of the persons processing the Personal data are withdrawn;
b) those persons’ physical access to the Personal data is blocked;
c) the withdrawal of authorisations and the termination are recorded in the relevant register (the Record of processing activities and the Register of persons authorised to process Personal data, or the Record of categories of processing activities (processor’s record));
d) the Personal data are deleted in accordance with the Personal data retention table.
Any deviation from the above procedure will be treated as a breach of the rules for protecting Personal data processed by the Controller.
15. Procedure where Personal data must be transferred to a third country
The Controller may transfer Personal data to countries outside the EU, provided that appropriate safeguards are in place for the protection of the Personal data and the rights of the data subjects.
Irrespective of the procedure described in section 14 of the Policy, before any Personal data contained in Personal data filing systems are transferred, it must be checked whether the non-EU entity has concluded an arrangement/agreement with the Controller based on the standard contractual clauses approved by the European Commission, the use of which is governed by Article 46 GDPR.
16. Procedure in the event of a breach or suspected breach of Personal data protection
On receiving information from any source about a potential Personal data breach, the Controller must immediately take the necessary steps to establish whether such an event has occurred and, if so, whether it constituted a Personal data breach.
This obligation can only be fulfilled with the full cooperation of the Controller’s Management Board, employees and contractors. Therefore, anyone who finds or suspects that the Personal data protection rules may have been breached must inform the Controller’s Management Board of their observations without delay.
The procedure in the event of a breach or suspected breach of Personal data protection aims to:
a) take remedial measures to stop the undesirable effects of the event;
b) document and analyse the course of the event;
c) assess:
i) whether a Personal data breach has occurred,
ii) whether the breach was more than unlikely to result in a risk to the rights and freedoms of natural persons,
iii) whether the data subjects should be notified;
iv) whether PUODO should be notified;
d) implement additional safeguards or other technological or procedural changes that increase the security of Personal data.
Annexes
- Record of processing activities;
- List of Personal data filing systems;
- Risk assessment procedure;
- General risk assessment;
- Personal data retention table;
- IT system management instructions;
- List of premises;
- IT asset inventory;
- E-mail information clause (e-mail footer);
- Information clause – employees / contractors;
- Information clause – recruitment;
- Procedure in the event of a breach of Personal data protection rules;
- Register of Personal data breaches;
- Template data processing agreement;
- Record of categories of processing activities (processor’s record);
- Template statement by an employee/contractor confirming familiarity with the GDPR documentation;
- Template authorisation to process Personal data;
- Register of persons authorised to process Personal data.
This is a translation provided for information. In case of discrepancies, the Polish version prevails.