Privacy policy

2. GENERAL TERMS OF PRIVACY POLICY

2.1. This Privacy Policy (hereinafter – Policy):

Describes how GD SPHERE (hereinafter – GD SPHERE), collects, obtains (receives), stores, protects, uses, destroys (erase), retrieves and otherwise legally processes Your Personal Data, types and categories of such Personal Data, and purposes and legal grounds of the processing, and informs You about Your rights regarding the processing of Your Personal Data by GD SPHERE.

2.2. GD SPHERE collects and processes Your Personal Data in accordance with: Public Information Act, Personal Data Protection Act, Electronic Communications Act (hereinafter referred to as -Acts) and the Data Protection Ordinance (hereinafter referred to as DPO), Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (hereinafter referred to as GDPR), other regulatory enactments, and only:

for the legitimate aims and purposes and on the legitimate grounds, which are expressly and clearly defined in this Policy, and strictly to the extent and in amounts and strictly for the time frames necessary to achieve the purposes, for which the Personal Data is collected and processed, and subject to implementation of the appropriate technical and organisational measures in order to safeguard the rights and freedoms of the Data Subject (You), including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage of Personal Data.

2.3. In addition to the definitions, set forth in other sections of this Policy, such definitions are used herein:

2.3.1. “Personal Data” means any information relating to You, as an identified or identifiable natural person (‘data subject’);

2.3.2. “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

2.3.3. “Controller” means- GD SPHERE , email: [email protected];

2.3.4. “You” and/or “Your” means any natural person (Data subject), whose Personal Data is processed by GD SPHERE , when:

You use GD SPHERE Services or register as or enquire about becoming a GD SPHERE customer, subscriber or user; You apply for a job, and/or establish, amend, terminate employment relations with GD SPHERE and You submit Your Personal Data or GD SPHERE acquires Your Personal Data from public databases on/or governmental/municipal/local authorities during employment relations with You in accordance with the law; You register, enter, post, share, modify Your Personal Data in, or close Your user account; You offer or provide goods or services to GD SPHERE; You use, visit, surf or browse the or navigate through the Website www.GD SPHEREcourier.com (hereinafter- Website); You communicate with GD SPHERE in any way, including, but not limited to orally, in written, by phone, via e-mail, via communication forms on the Website, via GD SPHERE profile in social networks etc.; You submit or post any and all Your information, content, including photographs or comments to the Website, Your user profile, or GD SPHERE profiles in the social networks; GD SPHERE receives Your Personal Data from law enforcement authorities or courts and/or other competent authorities; GD SPHERE receives Your Personal Data from the Group Account holder; GD SPHERE receives Your Personal Data from its’ agents with Your consent, given to this agent; GD SPHERE receives Your Personal Data from You or the third party with Your consent, given to this third party; GD SPHERE acquires the information and Your Personal Data from credit reference and fraud prevention agencies (only if required by law); 2.3.5. “Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the controller;

2.3.6. “Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her;

2.3.7. “Personal Data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;

2.4. GD SPHERE ensures the confidentiality, privacy and security of Your Personal Data, as well as the legality of the data processing in accordance with the Acts and GDPR, and other related regulatory enactments.

3. SPECIAL TERMS ON DATA PROCESSING WHILE USING GD SPHERE SERVICES

3.1. By using GD SPHERE Services, You confirm, acknowledge and understand that GD SPHERE cooperates with partners, some of whom are not located in Estonia or EEA. By accepting this Policy and using GD SPHERE Services You acknowledge and agree that some of Your Personal Data will be processed by our partners.

3.2. GD SPHERE warrants, that GD SPHERE cooperates only with partners, who are providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that any Your Personal Data processing will meet the requirements of the Acts and GDPR, and other.

3.3. GD SPHERE can share or provide Your identification data, as name, surname, ID document data, correspondence/contact data, payment requisites etc. with or to the partners in the purpose to provide to You GD SPHERE services or services which You ordered from a partner of GD SPHERE (GD SPHERE is subcontractor).

3.4. If provided by law, including international treaties between Estonia and the residence state of our partners, GD SPHERE may disclose Your identity and contact information to governmental institutions, law enforcement body, court or other authorized institution or organization of the residence state of our partners, on the basis of the legal, grounded and valid request of such authority, institution or law enforcement body, court or other authorized institution or organization.

4. THE PERSONAL DATA GD SPHERE PROCESSES, LEGITIMATE PURPOSES AND GROUNDS AND PERSONAL DATA

4.1. You are solely responsible for the validity, accuracy, correctness, reliability, quality, stability, completeness or up-to-dateness of Your Personal Data, You personally provide to GD SPHERE and/or its Agents.

4.2. GD SPHERE does not knowingly collect personal information from or on behalf of someone under 18. If You are under 18 do not register on the Website or provide any information about Yourself to GD SPHERE without consent, which must be given or GD SPHERE must be authorised by the holder of parental responsibility over You. GD SPHERE shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over You, taking into consideration available technology. If GD SPHERE learns to have collected or received Personal Data from or on behalf of someone under 18 without consent of the holder of parental responsibility GD SPHERE will remove/erase such information and/or user account and not make future process Your Personal Data.

4.3. GD SPHERE does not process Your sensitive and other Personal Data, which processing is forbidden or restricted by law. You should not provide sensitive or special data, that is, data concerning racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, genetic and biometric data, data concerning health, or data concerning your sexual life or sexual orientation, in any material You submit to GD SPHERE in any way.

4.4. No automated individual decision making or profiling is performed in the course of the data processing of GD SPHERE.

4.5. When You are using GD SPHERE Services, GD SPHERE offers You choices (privacy preferences) regarding how GD SPHERE contacts You for marketing related communications (Promotional Data) and whether GD SPHERE uses information regarding Your online activities on the Website for marketing purposes. To learn about ways to register Your privacy preferences with GD SPHERE please contact GD SPHERE . You may also register a do-not-contact requests by sending an email to [email protected]. If You register a do-not-contact request, GD SPHERE may still contact You for non-promotional purposes, such as emails about Your accounts or our ongoing business relations.

4.6. You may refuse to accept browser cookies through Your browser settings. However, if You select this setting, You may be unable to access certain parts of GD SPHERE Services and the Website. Unless You set your browser to refuse cookies, GD SPHERE system may issue cookies when you direct your browser to GD SPHERE Services. If You disable cookies on Your Internet browser, GD SPHERE also may stop some processing of Your Personal Data when You visit the Website. For more details on how GD SPHERE uses cookies see Cookies Policy.

5. THE LEGITIMATE INTERESTS OF THE GD SPHERE

5.1. Legitimate interests of GD SPHERE are:

5.1.1. To enter into and to perform the Agreement between You and GD SPHERE or between You and general contractor, who transferred part of contractual obligations to GD SPHERE;

5.1.2. To ensure and protect the interests and rights of GD SPHERE (for example, to file an objection, claim or pretension, and/or to bring an action to a court or arbitrage)

5.1.3. To provide GD SPHERE Services;

5.1.4. To ensure the cyber, network and information security of GD SPHERE systems;

5.1.5. To develop and to enchase the GD SPHERE Services and business activities;

5.1.6. To support and analyse the performance of the Webpage;

5.1.7. To detect and prevent fraud, including the violations against GD SPHERE and its rights;

5.1.8. To maintain the personnel and employment management;

5.1.9. To maintain the accountancy management;

5.1.10. To comply with local and foreign law, law enforcement, court and regulatory bodies’ (governmental and municipal /local authorities) requirements;

5.1.11. To operate the day-to-day running of the business and plan for strategic growth, including managing of customer, client, user, vendor, contractor, supplier and other relationships, sharing intelligence with stakeholders, implementing safety procedures, and planning and allocate resources and budget (General Corporate Operations and Due Diligence);

5.1.12. To protect the rights or property of GD SPHERE , its agents, members, customers, and others including to enforce GD SPHERE agreements, policies and terms of use of its Services.

5.1.13. To respond to emergencies;

5.1.14. To communicate with the users, clients, customers, suppliers etc business partners of GD SPHERE (send and receive Your correspondence, and provide the correspondent with an accurate, timely and apropos reply to You);

5.1.15. To initiate, render, bill, and collect payments for GD SPHERE Services;

5.1.16. To facilitate or verify the appropriate calculation of taxes, fees, or other obligations due to a local, state, or federal government requirement; or determine eligibility for government benefits.

5.1.17. To comply with legal or regulatory obligations to which GD SPHERE is subjected.

6. YOUR CONSENT

6.1. When and where the processing of Your Personal Data is a subject to Your Consent, You may give Your Consent and GD SPHERE shall consider that Your Consent is received, if:

6.1.1. You have provided GD SPHERE with Your freely given, specific, deliberate, informed and unambiguous reference, or statement of Your consent on the processing of Your Personal Data, or

6.1.2. You have performed a clear affirmative activity confirming Your consent to the processing of the Personal Data, or

6.1.3. You have in any way (in writing, orally or electronically)- accepted this Policy, including, but not limited to:

When browsing, using, surfing or visiting the Website – You have read and accepted this Privacy policy by clicking “I have read and accept” button. When coming into agreement with GD SPHERE – You have read and accepted this Privacy policy and acknowledged it in the agreement. When submitting any Personal Data to GD SPHERE within any correspondence (including, claims, orders, letters, questions, job applications, posts on the Website or social networks)-You have submitted the information and Personal Data, voluntarily,and to the extents and in amounts that You independently and at Your sole discretion considered to be necessary for the GD SPHERE to process. 6.2. You are entitled to withdraw Your consent in any time.

6.3. In case if, upon receipt of Your withdrawal, GD SPHERE has reasonable doubts concerning Your identity, GD SPHERE may request the provision of additional information necessary to confirm Your identity.

6.4. Upon receipt of Your withdrawal, GD SPHERE shall ascertain Your identity and will stop processingYour Personal Data, based on Your prior consent given for this processing purpose. If the processing is based on the legitimate interests of GD SPHERE , You have a right to object to processing rather than withdrawal of consent.

6.5. The withdrawal of Your consent will not affect the lawfulness of Your Personal Data processing based on Your consent, performed before GD SPHERE has received Your withdrawal.

6.6. If and when after withdrawal of the consent, You perform any of the confirmative actions set forth in this Clause, GD SPHERE will consider that the consent is given again.

7. THE RECIPIENTS OF YOUR PERSONAL DATA/DISCLOSURE OF YOUR PERSONAL DATA

7.1. GD SPHERE may disclose Your Personal Data to third parties, as follows, who provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of GPDR , Acts and DPO and ensure the protection of the rights of the data subject (You):

7.1.1. GD SPHERE business partners, suppliers and contractors, who help GD SPHERE to provide GD SPHERE Services, including, but not limited to the banks, payment service providers, information system consultants and analytical and research service providers;

7.1.2. GD SPHERE professional advisers (including accountants and lawyers) that assist GD SPHERE in carrying out its business and legal activities;

7.1.3. Law enforcement agencies and other authorized persons in connection with the prevention,investigation and detection of crime or any suspected criminal, administrative or civil wrongdoing;

7.1.4. to the courts, law enforcement, court and regulatory bodies’ (governmental and municipal /local authorities)third parties, if GD SPHERE is under a duty to disclose or share Your Personal Data in order to comply with any legal obligation or instructions of a regulatory body (including in connection with a court order), or in order to enforce or apply the terms of any agreements GD SPHERE has with or otherwise concerning You (including agreements between You and us) or to protect rights, property or safety of customers, employees of GD SPHERE or other third parties of the GD SPHERE;

7.1.5. To third parties and in cases, defined in Clause 2 of this Policy;

7.1.6. GD SPHERE may also disclose Your Personal Data to other third parties, for example:

in the event that GD SPHERE sells or buys any business or assets GD SPHERE will disclose Your Personal Data to the prospective seller or buyer of such business or assets; if GD SPHERE or substantially all of GD SPHERE assets are acquired by a third party, Personal Data held by GD SPHERE will be one of the transferred assets; Other Third Parties with Your Consent. GD SPHERE may share information with other third parties with your previous consent.

7.2. Third Party Application and Service Providers: You may choose to use services offered by third parties through GD SPHERE services. In each case, the procession of Your Personal Data you give a third party will be subject to its terms, conditions, and policies—not this policy. You should review a third party’s privacy policy and terms of service before providing your information or using the service. You may also choose to give personal information directly to third parties when using GD SPHERE Services or when cooperating with GD SPHERE in other ways (employment, business cooperation etc.). In each case, Personal Data you give a third party will be subject to its terms, conditions, and policies—not this policy. You should review a third party’s privacy policy and terms of service before providing your information or using the service.

8. DURATION OF THE STORAGE

8.1. GD SPHERE will process Your Personal Data as long as there is at least one of the following conditions:

8.1.1. While is valid /not withdrawn Your consent to the processing of Your Personal Data, provided that there is no other legal basis or legitimate purpose of Your Personal Data processing.

8.1.2. While is valid Your Agreement with GD SPHERE .

8.1.3. While Your Personal Data is necessary for the legal grounds, the legitimate purpose and / or aims for which they were received/collected or other way processed.

8.1.4. While in accordance with the procedures prescribed by regulatory enactments, GD SPHERE or You may exercise their rights and legitimate interests (for example, to submit objections or claims, or to bring any action or claim before a court or arbitrage).

8.1.5. While GD SPHERE has a legal obligation to keep Your Personal Data (for example, in accordance with the Accounting regulatory enactments, etc.).

8.1.6. After termination of the conditions indicated in this Clause, Your Personal Data will be deleted /erased or, in cases specified in regulatory enactments, transferred to the state archive (in state storage).

8.1.7. Job application and Your CV Personal Data shall be stored within 1 (one) month upon GD SPHERE has received, excluding if You expressly defined other processing terms in Your application form, for recruitment purposes.

8.1.8. Cookies Data shall be stored within time, set forth in Cookies Policy.

9. YOUR RIGHTS CONCERNING THE PROCESSING OF YOUR PERSONAL DATA

9.1. You have the following rights concerning the processing of Your Personal Data:

9.1.1. Right to withdraw Your consent – You have the right to withdraw Your consent as set in Clause 6.2 of this Policy.

9.1.2. Right of access to Your Personal Data – You have the right to receive a copy of Your Personal Data that GD SPHERE processes about You, subject to certain exemptions provided by regulatory enactments.

9.1.3. Right to rectify Your Personal Data – You have the right to ask GD SPHERE to correct Your Personal Data that GD SPHERE processes where it is incorrect or incomplete.

9.2. Right to erasure of Your Personal Data -You have the right to ask that Your Personal Data be deleted/erased in case if:

9.2.1. Your Personal Data is no longer necessary in relation to the purposes for which they were processed, collected or otherwise used by GD SPHERE .

9.2.2. You withdraw Your consent and there is no other legal ground or legitimate purpose for which GD SPHERE may process Your Personal Data;

9.2.3. You object to the processing of Your Personal Data (as set out below);

9.2.4. GD SPHERE has used Your Personal Data unlawfully;

9.2.5. Your Personal Data needs to be erased to comply with a legal obligation.

9.3. Right to restrict the use of Your Personal Data- You have the right to suspend processing of Your Personal Data, in case if:

9.3.1. You believe that Your Personal Data is inaccurate and only for such period to enable GD SPHERE to verify the accuracy of Your Personal Data;

9.3.2. the processing of Your Personal Data is unlawful and You oppose the erasure of Your Personal Data and request that it is suspended instead;

9.3.3. GD SPHERE no longer needs Your Personal Data, but Your Personal Data is required by You for the establishment, exercise or defence of legal claims; or

9.3.4. You have objected to the processing of Your Personal Data and GD SPHERE is verifying whether its grounds for the processing of Your Personal Data are of the highest importance than Your objection.

9.3.5. Right to data portability- You have the right to obtain Your Personal Data in a structured, commonly used and machine-readable format and for it to be transferred to another organisation, where it is technically feasible. The right only applies where the processing of Your Personal Data is based on Your consent or for the performance of Your Agreement with GD SPHERE , and when the processing of Your Personal Data is carried out by automated (i.e. electronic) means.

9.4. Right to object to the processing of Your Personal Data -You have the right to object to the processing of Your Personal Data in certain circumstances, where

9.4.1. You have grounds relating to Your particular situation and GD SPHERE processes Your Personal Data for legitimate interests (or those of a third party) of the GD SPHERE including for profiling; and

9.4.2. You object to the processing of Your Personal Data for direct marketing purposes, including profiling (to the extent it relates to direct marketing).

9.4.3. Right to object to decision which is based solely on automated processing – You have the rights to object to being subject to a decision which is based solely on automated processing without human intervention.

9.4.4. Right to complain to the relevant data protection authority- see Clause 10.6.You may submit a request for the exercise of Your rights in writing to GD SPHERE.

9.4.5. If upon receipt of Your request GD SPHERE has reasonable doubts concerning Your identity GD SPHERE may request the provision of additional information necessary to confirm Your identity.

9.4.6. Upon receipt of Your request, GD SPHERE shall ascertain Your identity, examine and review Your request and execute / or reasonably reject in accordance with the GDPR and other related Data protection regulatory enactments.

9.4.7. GD SPHERE well send a reply to Your request to a mailing (contact) address provided by You in Your request, by registered mail or other way, as You asked in Your request if technically feasible, within 30 (thirty) days from the date of receipt of the request. Please note, that if You haven’t provided Your contact address and / or other way of receiving the reply, GD SPHERE will not be able to send it to You and You should contact GD SPHERE personally to arrange the way and time You can receive it.

9.5. Information provided and any communication and any actions taken under this Clause shall be provided free of charge. Where requests from You are manifestly unfounded or excessive, in particular because of their repetitive character, GD SPHERE may either:

9.5.1. Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

9.5.2. Refuse to act on the request.

10. COMPLAINTS

10.1. If you have any concerns or complaints regarding the privacy of Your Personal Data GD SPHERE processes You may submit a request for the exercise of Your rights in writing to GD SPHERE.

10.2. If upon receipt of Your request GD SPHERE has reasonable doubts concerning Your identity GD SPHERE may request the provision of additional information necessary to confirm Your identity.

10.3. Upon receipt of Your request, GD SPHERE shall ascertain Your identity, examine and review Your request and provide a reply in accordance with the GDPR and other related Data protection regulatory enactments.

10.4. GD SPHERE well send a reply to Your request to a mailing (contact) address provided by You in Your request, by registered mail or other way, as You asked in Your request, if technically feasible, within 30 (thirty) days from the date of receipt of the request. Please note, that if You haven’t provided Your contact address and / or other way of receiving the reply, GD SPHERE will not be able to send it to You and You should contact GD SPHERE personally to arrange the way and time You can receive it.

10.5. The reply provided and any communication and any actions taken under this Clause shall be provided free of charge. Where requests from You are manifestly unfounded or excessive, in particular because of their repetitive character, GD SPHERE may either:

10.5.1. Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

10.5.2. Refuse to act on the request.

10.6. You have the right to address any Your claim concerning Your Personal Data processing by GD SPHERE to the competent personal data protection supervisory authority which, in case of GD SPHERE.

11. PERSONAL DATA SECURITY

11.1. As soon as GD SPHERE collected Your Personal Data, GD SPHERE uses various security features and procedures, taking into account industry standards, to protect Your Personal Data and to prevent unauthorized access to that information. GD SPHERE maintains a variety of appropriate technical and organisational physical, electronic, and procedural safeguards and measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage of Personal Data. These safeguards help protect Your personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction. These safeguards include:

11.1.1. ensuring the pseudonymisation and encryption of Personal Data;

11.1.2. ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

11.1.3. ensuring the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;

11.1.4. ensuring the process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing of Personal Data.

11.2. GD SPHERE will do all the best to protect Your information and Personal Data, for use of GD SPHERE Services, You have to keep Your User Account, User Profile data as well as all the information and data You issue, send, post, publish share etc on/or via the Website and or Social networks and/or other way, safe by using a strong password and by complying with obligations, set forth in Your agreement with GD SPHERE.

12. COMPLAINTS

12.1. If You have any questions about, or complaints that concern this Policy, please call or email GD SPHERE.

12.2. GD SPHERE may change this Policy at any time. When GD SPHERE changes the Policy, GD SPHERE shall post that changes on the Website. In case of material changes to how GD SPHERE process Your Personal Data, GD SPHERE shall notify You by email to the email address specified by You. You are responsible for ensuring GD SPHERE has an up-to-date, active and deliverable email address for You. You are also responsible for reviewing this Policy from time to time to check for any changes. All changes are effective immediately when GD SPHERE posted them.

12.3. This Policy is effective from 01.09.2019.

12.4. The date Policy was last revised is identified at the top of the page.