Privacy policy

2. GENERAL TERMS OF PRIVACY POLICY

2.1. This Privacy Policy (hereinafter – Policy):

Describes how GD SPHERE UG (hereinafter – GD SPHERE UG), collects, obtains (receives), stores, protects, uses, destroys (erase), retrieves and otherwise legally processes Your Personal Data, types and categories of such Personal Data, and purposes and legal grounds of the processing, and informs You about Your rights regarding the processing of Your Personal Data by GD SPHERE UG.

2.2. GD SPHERE UG collects and processes Your Personal Data in accordance with: Public Information Act, Personal Data Protection Act, Electronic Communications Act (hereinafter referred to as -Acts) and the Data Protection Ordinance (hereinafter referred to as DPO), Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (hereinafter referred to as GDPR), other regulatory enactments, and only:

for the legitimate aims and purposes and on the legitimate grounds, which are expressly and clearly defined in this Policy, and strictly to the extent and in amounts and strictly for the time frames necessary to achieve the purposes, for which the Personal Data is collected and processed, and subject to implementation of the appropriate technical and organisational measures in order to safeguard the rights and freedoms of the Data Subject (You), including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage of Personal Data.

2.3. In addition to the definitions, set forth in other sections of this Policy, such definitions are used herein:

2.3.1. “Personal Data” means any information relating to You, as an identified or identifiable natural person (‘data subject’);

2.3.2. “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

2.3.3. “Controller” means- GD SPHERE UG , email: [email protected];

2.3.4. “You” and/or “Your” means any natural person (Data subject), whose Personal Data is processed by GD SPHERE UG , when:

You use GD SPHERE UG Services or register as or enquire about becoming a GD SPHERE UG customer, subscriber or user; You apply for a job, and/or establish, amend, terminate employment relations with GD SPHERE UG and You submit Your Personal Data or GD SPHERE UG acquires Your Personal Data from public databases on/or governmental/municipal/local authorities during employment relations with You in accordance with the law; You register, enter, post, share, modify Your Personal Data in, or close Your user account; You offer or provide goods or services to GD SPHERE UG; You use, visit, surf or browse the or navigate through the Website www.gd-sphere.com (hereinafter- Website); You communicate with GD SPHERE UG in any way, including, but not limited to orally, in written, by phone, via e-mail, via communication forms on the Website, via GD SPHERE UG profile in social networks etc.; You submit or post any and all Your information, content, including photographs or comments to the Website, Your user profile, or GD SPHERE UG profiles in the social networks; GD SPHERE UG receives Your Personal Data from law enforcement authorities or courts and/or other competent authorities; GD SPHERE UG receives Your Personal Data from the Group Account holder; GD SPHERE UG receives Your Personal Data from its’ agents with Your consent, given to this agent; GD SPHERE UG receives Your Personal Data from You or the third party with Your consent, given to this third party; GD SPHERE UG acquires the information and Your Personal Data from credit reference and fraud prevention agencies (only if required by law); 2.3.5. “Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the controller;

2.3.6. “Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her;

2.3.7. “Personal Data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;

2.4. GD SPHERE UG ensures the confidentiality, privacy and security of Your Personal Data, as well as the legality of the data processing in accordance with the Acts and GDPR, and other related regulatory enactments.

3. SPECIAL TERMS ON DATA PROCESSING WHILE USING GD SPHERE UG SERVICES

3.1. By using GD SPHERE UG Services, You confirm, acknowledge and understand that GD SPHERE UG cooperates with partners, some of whom are not located in Estonia or EEA. By accepting this Policy and using GD SPHERE UG Services You acknowledge and agree that some of Your Personal Data will be processed by our partners.

3.2. GD SPHERE UG warrants, that GD SPHERE UG cooperates only with partners, who are providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that any Your Personal Data processing will meet the requirements of the Acts and GDPR, and other.

3.3. GD SPHERE UG can share or provide Your identification data, as name, surname, ID document data, correspondence/contact data, payment requisites etc. with or to the partners in the purpose to provide to You GD SPHERE UG services or services which You ordered from a partner of GD SPHERE UG (GD SPHERE UG is subcontractor).

3.4. If provided by law, including international treaties between Estonia and the residence state of our partners, GD SPHERE UG may disclose Your identity and contact information to governmental institutions, law enforcement body, court or other authorized institution or organization of the residence state of our partners, on the basis of the legal, grounded and valid request of such authority, institution or law enforcement body, court or other authorized institution or organization.

4. THE PERSONAL DATA GD SPHERE UG PROCESSES, LEGITIMATE PURPOSES AND GROUNDS AND PERSONAL DATA

4.1. You are solely responsible for the validity, accuracy, correctness, reliability, quality, stability, completeness or up-to-dateness of Your Personal Data, You personally provide to GD SPHERE UG and/or its Agents.

4.2. GD SPHERE UG does not knowingly collect personal information from or on behalf of someone under 18. If You are under 18 do not register on the Website or provide any information about Yourself to GD SPHERE UG without consent, which must be given or GD SPHERE UG must be authorised by the holder of parental responsibility over You. GD SPHERE UG shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over You, taking into consideration available technology. If GD SPHERE UG learns to have collected or received Personal Data from or on behalf of someone under 18 without consent of the holder of parental responsibility GD SPHERE UG will remove/erase such information and/or user account and not make future process Your Personal Data.

4.3. GD SPHERE UG does not process Your sensitive and other Personal Data, which processing is forbidden or restricted by law. You should not provide sensitive or special data, that is, data concerning racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, genetic and biometric data, data concerning health, or data concerning your sexual life or sexual orientation, in any material You submit to GD SPHERE UG in any way.

4.4. No automated individual decision making or profiling is performed in the course of the data processing of GD SPHERE UG.

4.5. When You are using GD SPHERE UG Services, GD SPHERE UG offers You choices (privacy preferences) regarding how GD SPHERE UG contacts You for marketing related communications (Promotional Data) and whether GD SPHERE UG uses information regarding Your online activities on the Website for marketing purposes. To learn about ways to register Your privacy preferences with GD SPHERE UG please contact GD SPHERE UG . You may also register a do-not-contact requests by sending an email to [email protected]. If You register a do-not-contact request, GD SPHERE UG may still contact You for non-promotional purposes, such as emails about Your accounts or our ongoing business relations.

4.6. You may refuse to accept browser cookies through Your browser settings. However, if You select this setting, You may be unable to access certain parts of GD SPHERE UG Services and the Website. Unless You set your browser to refuse cookies, GD SPHERE UG system may issue cookies when you direct your browser to GD SPHERE UG Services. If You disable cookies on Your Internet browser, GD SPHERE UG also may stop some processing of Your Personal Data when You visit the Website. For more details on how GD SPHERE UG uses cookies see Cookies Policy.

5. THE LEGITIMATE INTERESTS OF THE GD SPHERE UG

5.1. Legitimate interests of GD SPHERE UG are:

5.1.1. To enter into and to perform the Agreement between You and GD SPHERE UG or between You and general contractor, who transferred part of contractual obligations to GD SPHERE UG;

5.1.2. To ensure and protect the interests and rights of GD SPHERE UG (for example, to file an objection, claim or pretension, and/or to bring an action to a court or arbitrage)

5.1.3. To provide GD SPHERE UG Services;

5.1.4. To ensure the cyber, network and information security of GD SPHERE UG systems;

5.1.5. To develop and to enchase the GD SPHERE UG Services and business activities;

5.1.6. To support and analyse the performance of the Webpage;

5.1.7. To detect and prevent fraud, including the violations against GD SPHERE UG and its rights;

5.1.8. To maintain the personnel and employment management;

5.1.9. To maintain the accountancy management;

5.1.10. To comply with local and foreign law, law enforcement, court and regulatory bodies’ (governmental and municipal /local authorities) requirements;

5.1.11. To operate the day-to-day running of the business and plan for strategic growth, including managing of customer, client, user, vendor, contractor, supplier and other relationships, sharing intelligence with stakeholders, implementing safety procedures, and planning and allocate resources and budget (General Corporate Operations and Due Diligence);

5.1.12. To protect the rights or property of GD SPHERE UG , its agents, members, customers, and others including to enforce GD SPHERE UG agreements, policies and terms of use of its Services.

5.1.13. To respond to emergencies;

5.1.14. To communicate with the users, clients, customers, suppliers etc business partners of GD SPHERE UG (send and receive Your correspondence, and provide the correspondent with an accurate, timely and apropos reply to You);

5.1.15. To initiate, render, bill, and collect payments for GD SPHERE UG Services;

5.1.16. To facilitate or verify the appropriate calculation of taxes, fees, or other obligations due to a local, state, or federal government requirement; or determine eligibility for government benefits.

5.1.17. To comply with legal or regulatory obligations to which GD SPHERE UG is subjected.

6. YOUR CONSENT

6.1. When and where the processing of Your Personal Data is a subject to Your Consent, You may give Your Consent and GD SPHERE UG shall consider that Your Consent is received, if:

6.1.1. You have provided GD SPHERE UG with Your freely given, specific, deliberate, informed and unambiguous reference, or statement of Your consent on the processing of Your Personal Data, or

6.1.2. You have performed a clear affirmative activity confirming Your consent to the processing of the Personal Data, or

6.1.3. You have in any way (in writing, orally or electronically)- accepted this Policy, including, but not limited to:

When browsing, using, surfing or visiting the Website – You have read and accepted this Privacy policy by clicking “I have read and accept” button. When coming into agreement with GD SPHERE UG – You have read and accepted this Privacy policy and acknowledged it in the agreement. When submitting any Personal Data to GD SPHERE UG within any correspondence (including, claims, orders, letters, questions, job applications, posts on the Website or social networks)-You have submitted the information and Personal Data, voluntarily,and to the extents and in amounts that You independently and at Your sole discretion considered to be necessary for the GD SPHERE UG to process. 6.2. You are entitled to withdraw Your consent in any time.

6.3. In case if, upon receipt of Your withdrawal, GD SPHERE UG has reasonable doubts concerning Your identity, GD SPHERE UG may request the provision of additional information necessary to confirm Your identity.

6.4. Upon receipt of Your withdrawal, GD SPHERE UG shall ascertain Your identity and will stop processingYour Personal Data, based on Your prior consent given for this processing purpose. If the processing is based on the legitimate interests of GD SPHERE UG , You have a right to object to processing rather than withdrawal of consent.

6.5. The withdrawal of Your consent will not affect the lawfulness of Your Personal Data processing based on Your consent, performed before GD SPHERE UG has received Your withdrawal.

6.6. If and when after withdrawal of the consent, You perform any of the confirmative actions set forth in this Clause, GD SPHERE UG will consider that the consent is given again.

7. THE RECIPIENTS OF YOUR PERSONAL DATA/DISCLOSURE OF YOUR PERSONAL DATA

7.1. GD SPHERE UG may disclose Your Personal Data to third parties, as follows, who provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of GPDR , Acts and DPO and ensure the protection of the rights of the data subject (You):

7.1.1. GD SPHERE UG business partners, suppliers and contractors, who help GD SPHERE UG to provide GD SPHERE UG Services, including, but not limited to the banks, payment service providers, information system consultants and analytical and research service providers;

7.1.2. GD SPHERE UG professional advisers (including accountants and lawyers) that assist GD SPHERE UG in carrying out its business and legal activities;

7.1.3. Law enforcement agencies and other authorized persons in connection with the prevention,investigation and detection of crime or any suspected criminal, administrative or civil wrongdoing;

7.1.4. to the courts, law enforcement, court and regulatory bodies’ (governmental and municipal /local authorities)third parties, if GD SPHERE UG is under a duty to disclose or share Your Personal Data in order to comply with any legal obligation or instructions of a regulatory body (including in connection with a court order), or in order to enforce or apply the terms of any agreements GD SPHERE UG has with or otherwise concerning You (including agreements between You and us) or to protect rights, property or safety of customers, employees of GD SPHERE UG or other third parties of the GD SPHERE UG;

7.1.5. To third parties and in cases, defined in Clause 2 of this Policy;

7.1.6. GD SPHERE UG may also disclose Your Personal Data to other third parties, for example:

in the event that GD SPHERE UG sells or buys any business or assets GD SPHERE UG will disclose Your Personal Data to the prospective seller or buyer of such business or assets; if GD SPHERE UG or substantially all of GD SPHERE UG assets are acquired by a third party, Personal Data held by GD SPHERE UG will be one of the transferred assets; Other Third Parties with Your Consent. GD SPHERE UG may share information with other third parties with your previous consent.

7.2. Third Party Application and Service Providers: You may choose to use services offered by third parties through GD SPHERE UG services. In each case, the procession of Your Personal Data you give a third party will be subject to its terms, conditions, and policies—not this policy. You should review a third party’s privacy policy and terms of service before providing your information or using the service. You may also choose to give personal information directly to third parties when using GD SPHERE UG Services or when cooperating with GD SPHERE UG in other ways (employment, business cooperation etc.). In each case, Personal Data you give a third party will be subject to its terms, conditions, and policies—not this policy. You should review a third party’s privacy policy and terms of service before providing your information or using the service.

8. DURATION OF THE STORAGE

8.1. GD SPHERE UG will process Your Personal Data as long as there is at least one of the following conditions:

8.1.1. While is valid /not withdrawn Your consent to the processing of Your Personal Data, provided that there is no other legal basis or legitimate purpose of Your Personal Data processing.

8.1.2. While is valid Your Agreement with GD SPHERE UG .

8.1.3. While Your Personal Data is necessary for the legal grounds, the legitimate purpose and / or aims for which they were received/collected or other way processed.

8.1.4. While in accordance with the procedures prescribed by regulatory enactments, GD SPHERE UG or You may exercise their rights and legitimate interests (for example, to submit objections or claims, or to bring any action or claim before a court or arbitrage).

8.1.5. While GD SPHERE UG has a legal obligation to keep Your Personal Data (for example, in accordance with the Accounting regulatory enactments, etc.).

8.1.6. After termination of the conditions indicated in this Clause, Your Personal Data will be deleted /erased or, in cases specified in regulatory enactments, transferred to the state archive (in state storage).

8.1.7. Job application and Your CV Personal Data shall be stored within 1 (one) month upon GD SPHERE UG has received, excluding if You expressly defined other processing terms in Your application form, for recruitment purposes.

8.1.8. Cookies Data shall be stored within time, set forth in Cookies Policy.

9. YOUR RIGHTS CONCERNING THE PROCESSING OF YOUR PERSONAL DATA

9.1. You have the following rights concerning the processing of Your Personal Data:

9.1.1. Right to withdraw Your consent – You have the right to withdraw Your consent as set in Clause 6.2 of this Policy.

9.1.2. Right of access to Your Personal Data – You have the right to receive a copy of Your Personal Data that GD SPHERE UG processes about You, subject to certain exemptions provided by regulatory enactments.

9.1.3. Right to rectify Your Personal Data – You have the right to ask GD SPHERE UG to correct Your Personal Data that GD SPHERE UG processes where it is incorrect or incomplete.

9.2. Right to erasure of Your Personal Data -You have the right to ask that Your Personal Data be deleted/erased in case if:

9.2.1. Your Personal Data is no longer necessary in relation to the purposes for which they were processed, collected or otherwise used by GD SPHERE UG .

9.2.2. You withdraw Your consent and there is no other legal ground or legitimate purpose for which GD SPHERE UG may process Your Personal Data;

9.2.3. You object to the processing of Your Personal Data (as set out below);

9.2.4. GD SPHERE UG has used Your Personal Data unlawfully;

9.2.5. Your Personal Data needs to be erased to comply with a legal obligation.

9.3. Right to restrict the use of Your Personal Data- You have the right to suspend processing of Your Personal Data, in case if:

9.3.1. You believe that Your Personal Data is inaccurate and only for such period to enable GD SPHERE UG to verify the accuracy of Your Personal Data;

9.3.2. the processing of Your Personal Data is unlawful and You oppose the erasure of Your Personal Data and request that it is suspended instead;

9.3.3. GD SPHERE UG no longer needs Your Personal Data, but Your Personal Data is required by You for the establishment, exercise or defence of legal claims; or

9.3.4. You have objected to the processing of Your Personal Data and GD SPHERE UG is verifying whether its grounds for the processing of Your Personal Data are of the highest importance than Your objection.

9.3.5. Right to data portability- You have the right to obtain Your Personal Data in a structured, commonly used and machine-readable format and for it to be transferred to another organisation, where it is technically feasible. The right only applies where the processing of Your Personal Data is based on Your consent or for the performance of Your Agreement with GD SPHERE UG , and when the processing of Your Personal Data is carried out by automated (i.e. electronic) means.

9.4. Right to object to the processing of Your Personal Data -You have the right to object to the processing of Your Personal Data in certain circumstances, where

9.4.1. You have grounds relating to Your particular situation and GD SPHERE UG processes Your Personal Data for legitimate interests (or those of a third party) of the GD SPHERE UG including for profiling; and

9.4.2. You object to the processing of Your Personal Data for direct marketing purposes, including profiling (to the extent it relates to direct marketing).

9.4.3. Right to object to decision which is based solely on automated processing – You have the rights to object to being subject to a decision which is based solely on automated processing without human intervention.

9.4.4. Right to complain to the relevant data protection authority- see Clause 10.6.You may submit a request for the exercise of Your rights in writing to GD SPHERE UG.

9.4.5. If upon receipt of Your request GD SPHERE UG has reasonable doubts concerning Your identity GD SPHERE UG may request the provision of additional information necessary to confirm Your identity.

9.4.6. Upon receipt of Your request, GD SPHERE UG shall ascertain Your identity, examine and review Your request and execute / or reasonably reject in accordance with the GDPR and other related Data protection regulatory enactments.

9.4.7. GD SPHERE UG well send a reply to Your request to a mailing (contact) address provided by You in Your request, by registered mail or other way, as You asked in Your request if technically feasible, within 30 (thirty) days from the date of receipt of the request. Please note, that if You haven’t provided Your contact address and / or other way of receiving the reply, GD SPHERE UG will not be able to send it to You and You should contact GD SPHERE UG personally to arrange the way and time You can receive it.

9.5. Information provided and any communication and any actions taken under this Clause shall be provided free of charge. Where requests from You are manifestly unfounded or excessive, in particular because of their repetitive character, GD SPHERE UG may either:

9.5.1. Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

9.5.2. Refuse to act on the request.

10. COMPLAINTS

10.1. If you have any concerns or complaints regarding the privacy of Your Personal Data GD SPHERE UG processes You may submit a request for the exercise of Your rights in writing to GD SPHERE UG.

10.2. If upon receipt of Your request GD SPHERE UG has reasonable doubts concerning Your identity GD SPHERE UG may request the provision of additional information necessary to confirm Your identity.

10.3. Upon receipt of Your request, GD SPHERE UG shall ascertain Your identity, examine and review Your request and provide a reply in accordance with the GDPR and other related Data protection regulatory enactments.

10.4. GD SPHERE UG well send a reply to Your request to a mailing (contact) address provided by You in Your request, by registered mail or other way, as You asked in Your request, if technically feasible, within 30 (thirty) days from the date of receipt of the request. Please note, that if You haven’t provided Your contact address and / or other way of receiving the reply, GD SPHERE UG will not be able to send it to You and You should contact GD SPHERE UG personally to arrange the way and time You can receive it.

10.5. The reply provided and any communication and any actions taken under this Clause shall be provided free of charge. Where requests from You are manifestly unfounded or excessive, in particular because of their repetitive character, GD SPHERE UG may either:

10.5.1. Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

10.5.2. Refuse to act on the request.

10.6. You have the right to address any Your claim concerning Your Personal Data processing by GD SPHERE UG to the competent personal data protection supervisory authority which, in case of GD SPHERE UG.

11. PERSONAL DATA SECURITY

11.1. As soon as GD SPHERE UG collected Your Personal Data, GD SPHERE UG uses various security features and procedures, taking into account industry standards, to protect Your Personal Data and to prevent unauthorized access to that information. GD SPHERE UG maintains a variety of appropriate technical and organisational physical, electronic, and procedural safeguards and measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage of Personal Data. These safeguards help protect Your personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction. These safeguards include:

11.1.1. ensuring the pseudonymisation and encryption of Personal Data;

11.1.2. ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

11.1.3. ensuring the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;

11.1.4. ensuring the process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing of Personal Data.

11.2. GD SPHERE UG will do all the best to protect Your information and Personal Data, for use of GD SPHERE UG Services, You have to keep Your User Account, User Profile data as well as all the information and data You issue, send, post, publish share etc on/or via the Website and or Social networks and/or other way, safe by using a strong password and by complying with obligations, set forth in Your agreement with GD SPHERE UG.

12. COMPLAINTS

12.1. If You have any questions about, or complaints that concern this Policy, please call or email GD SPHERE UG.

12.2. GD SPHERE UG may change this Policy at any time. When GD SPHERE UG changes the Policy, GD SPHERE UG shall post that changes on the Website. In case of material changes to how GD SPHERE UG process Your Personal Data, GD SPHERE UG shall notify You by email to the email address specified by You. You are responsible for ensuring GD SPHERE UG has an up-to-date, active and deliverable email address for You. You are also responsible for reviewing this Policy from time to time to check for any changes. All changes are effective immediately when GD SPHERE UG posted them.

12.3. This Policy is effective from 01.09.2019.

12.4. The date Policy was last revised is identified at the top of the page.