Privacy policy

Administrator: Deluxe Trade LLC

UIC: 204332703

Responsible officer for the protection of personal data: Dimitar Tsonev

Contacts:

Е: support@toilight.net

Т: +359886313847

Link to Personal Data Protection Information

1. General Regulation on the protection of personal data

The privacy policy of Deluxe Trade LLC has been used in accordance with Regulation (EU) 2016/679 (General Consumer Protection Regulation). The purpose of the regulation is to protect the “rights and freedoms” of individuals and to remain, the data of Deluxe Trade LLC customers who are processed with these safe and confident of their rights should be registered.

2. General concepts

“Personal data” – any information relating to an identified or identifiable natural person (“data subject”); identifiable natural person is an identifiable person, directly or indirectly, in particular by identifier such as name, identification number, location data, online identifier, or by one or more physical-specific attributes, the physiological, genetic, psychological, mental, economic, cultural or social identity of that individual;

“Special categories of personal data” – personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs, or membership of trade unions and the processing of genetic data, biometric data for the unique identification of an individual, data relating to health or data on the sexual life of an individual or sexual orientation.

“Processing” – means any operation or set of operations performed with personal data or a set of personal data by automatic or other means such as collection, recording, organizing, structuring, storing, adapting or modifying, extracting, consulting, using, disclosing by transmission , disseminating or otherwise making the data accessible, arranging or combining, limiting, deleting or destroying them;

“Administrator” means any natural or legal person, public authority, agency or other entity that alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by EU or Member State law, the controller or the specific criteria for determining it may be laid down in Union or Member State law;

“Data subject” – any living natural person who is the subject of personal data stored by the Administrator.

“Data subject’s consent” – any freely expressed, specific, informed and unambiguous indication of the data subject’s will, by means of a statement or clearly affirmative action expressing his / her consent to the processing of personal data related to him / her;

“Personal data breach” – a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data that is transmitted, stored or processed in another way;

“Recipient” – a natural or legal person, public authority, agency or other entity to whom personal data are disclosed, whether third party or not. At the same time, public authorities which may receive personal data in the context of a specific investigation in accordance with Union or Member State law are not considered as ‘recipients’; the processing of such data by the designated public authorities complies with the applicable data protection rules for the purposes of processing;

“Third Party” – any natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons who, under the direct control of the controller or the processor, have the right to process the personal data ;

II. Basics

1. The policy applies to all personal data processing functions, including those performed on personal data of customers, employees, suppliers and partners, and any other personal data processed by the organization from various sources.

2. This policy applies to all employees of Deluxe Trade LLC. Any breach of the General Regulation will be considered a breach of labor discipline and, if a crime is suspected, the matter will be referred for consideration to the relevant public authorities as soon as possible.

3. Partners and third parties who work with or forDeluxe Trade LLC and who have, or may have access to, personal data will be expected to become familiar with, understand and comply with this policy. No third party may have access to personal data held by Deluxe Trade LLC without having previously concluded a data confidentiality agreement, which imposes on a third party obligations no less burdensome than those Deluxe Trade LLC has undertaken, and which entitles (Deluxe Trade LLC) to verify compliance with the obligations imposed by the agreement.

III. Obligations and roles under Regulation (EU) 2016/679

1.Deluxe Trade LLC is a data controller in accordance with Regulation (EU) 2016/679.

3. There is a function at Deluxe Trade LLC – Personal Data Protection Officer, which performs activities on:

developing and implementing the requirements of Regulation (EU) 2016/679 as required by this policy;
security and risk management with respect to policy compliance.

2. Compliance with data protection laws is the responsibility of all Deluxe Trade LLC employees who process personal data.

3. Deluxe Trade LLC conducts regular personal data protection training for the proper application of the General Data Protection Regulation.

IV. Data protection principles

All processing of personal data shall be carried out in accordance with the data protection principles set out in Regulation (EU) 2016/679. The policies and procedures of Deluxe Trade LLC are intended to ensure compliance with these principles:

Legality – Identifies a legitimate basis before it can process personal data. They are often referred to as “grounds for processing”, such as “consent”.

Good faith – In order for the processing to be conscientious, the data controller provides certain information to the data subjects as far as practicable.

Legality – Identifies a legitimate basis before it can process personal data. They are often referred to as “grounds for processing”, such as “consent”.

Good faith – In order for the processing to be conscientious, the data controller provides certain information to the data subjects as far as practicable.

Transparency – The general regulation includes rules on the disclosure of confidential information to data subjects in Articles 12, 13 and 14 of the CPD. They are detailed and specific, emphasizing that privacy notices are comprehensible and accessible. The information must be communicated to the data subject in an intelligible form using clear and comprehensible language.

The specific information to be provided to the data subject shall include:

data identifying the administrator and contact details of the administrator and, if any, of the administrator’s representative;
the contacts of the Data Protection Officer;
the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
the period for which the personal data will be stored;
the existence of the following rights – request access to the data, rectification, deletion (right to be forgotten), limitation of processing, as well as the right to object to the conditions (or lack thereof) in connection with the exercise of these rights;
the categories of personal data;
the recipients or categories of recipients of personal data, where applicable;
where applicable, whether the controller intends to transfer personal data to a recipient in a third country and the level of data protection;
any additional information necessary to ensure fair processing.

Data received for specific purposes is not used for a purpose other than that formally announced in the Deluxe Trade LLC Client Privacy Notice.

Additional:

The Data Protection Officer is responsible for ensuring that Deluxe Trade LLC does not collect information that is not strictly necessary for the purpose for which it was obtained.
The Data Protection Officer ensures that, on an (annual) basis, all data collection methods are reviewed by to ensure that the data collected remains relevant, relevant, and not excessive.
Data stored by the administrator of the administrator is reviewed and updated as necessary. No data is stored where it is likely to be inaccurate.
The Data Protection Officer ensures that all staff are trained in the importance of collecting accurate data and maintaining it.
It is also the responsibility of the data subject to declare that the data they transmit for storage by Deluxe Trade LLC are accurate and up-to-date.
At least once a year, the Data Protection Officer reviews the retention periods of all personal data processed by Deluxe Trade LLC and, when identifying data that is no longer required in the context of the registered purpose, should be destroyed.
The Data Protection Officer processes requests for data correction within one month. This period may be extended by another two months for complex applications. If Deluxe Trade LLC decides not to comply with the request, the Data Protection Officer prepares a reasoned refusal and informs him or her of his right to file a complaint with the supervisory authority and seek legal protection.
When personal data are retained after the date of processing, they will be appropriately stored to protect the identity of the data subject in the event of a data breach.

The Data Protection Officer shall carry out an impact assessment (where applicable), taking into account all circumstances relating to the management or processing of data by Deluxe Trade LLC.

In determining whether processing is appropriate, the Data Protection Officer should also consider the extent of any harm or loss that may be caused to individuals (eg personnel or customers) if a security breach occurs, and any possible damage to the reputation of the administrator, including any loss of customer trust.

When assessing appropriate technical measures, the Data Protection Officer shall consider the following:

Password protection;
Automatic locking of idle workstations on the network;
Removing access rights for USB and other removable storage media;
Anti-virus software and firewalls;
Role-based access rights, including those of temporary staff
Protecting devices leaving the organization’s premises, such as laptops or the like;
Security of local and wide area networks;
Privacy-enhancing technologies such as pseudonymization and anonymization;

When assessing appropriate organizational measures, the Data Protection Officer has considered the following:

The levels of appropriate training at Deluxe Trade LLC;
Measures that take into account the reliability of employees (eg attestations, recommendations, etc.);
Identification of disciplinary measures for data processing violations;
Regular inspection of personnel to comply with relevant security standards;
Control of physical access to electronic and paper based records;
Keeping a clean workplace (no personal data from clients).
Storage of database paper in lockable cabinets;
Restricting the use of portable electronic devices outside the workplace;
Restricting the use by employees of personal devices in the workplace;
Adopting clear rules for creating and using passwords;
Regular backup of personal data and physical storage of copy media outside the office;
Imposition of contractual obligations on counterparties to take appropriate security measures when transferring data outside the EU.

These controls are selected on the basis of the identified risks to personal data, as well as the potential for harm to the data subjects.

Deluxe Trade LLC demonstrates compliance with data protection principles by implementing data protection policies, implementing appropriate technical and organizational measures, as well as adopting data protection techniques at the design and data protection stage by default, evaluation the impact on the protection of personal data, the procedure for notification of personal data breach, etc.

V. Rights of data subjects

1. Data subjects shall have the following rights in respect of the processing of data and of the data recorded for them:

To request confirmation that personal data relating to it are being processed and, if so, to have access to the data as well as information about who is the recipient of that data.
Request a copy of his personal information from the administrator;
Ask the controller to correct personal data when it is inaccurate and when it is no longer up to date;
Require the administrator to delete personal data (right to be “forgotten”);
Ask the controller to restrict the processing of personal data, in which case the data will only be stored but not processed;
To object to the processing of his personal data;
To object to the processing of personal data relating to him / her for direct marketing purposes.
Appeal to a supervisory authority if it considers that any provision of the General Data Protection Regulation has been breached;
Require and provide personal data in a structured, widely used and machine-readable format;
To withdraw consent to the processing of personal data at any time with a separate request made to the controller;
It should not be subject to automated decision-making that would significantly affect it without the possibility of human intervention;
To oppose automated profiling that happens without his or her consent;

2. Deluxe Trade LLC shall provide conditions to guarantee the exercise of these rights by the data subject:

Data subjects may make claims for the exercise of their rights.

Data subjects have the right to complain to Deluxe Trade LLC.

VI. Consent

1. By “consent” Deluxe Trade LLC means any freely expressed, specific, informed and unambiguous indication of the data subject’s will, by means of a statement or clearly affirmative action, expressing his / her consent to the processing of personal data related to him / her. The data subject may withdraw his / her consent at any time.

2. Deluxe Trade LLC shall only mean “consent” where the data subject has been fully informed of the intended processing and has expressed his / her consent without exerting pressure on him / her. Consent obtained under pressure or on the basis of misleading information will not be a valid basis for the processing of personal data.

3. Consent cannot be drawn from the lack of response to a data subject. There must be active communication between the administrator and the subject in order for consent to be obtained. The administrator must be able to demonstrate that consent has been obtained for processing activities.

VII. Data security

1. All employees are responsible for ensuring the security of the storage of the data for which they are responsible and which Deluxe Trade LLC holds, and that the data is stored securely and is not disclosed in any circumstances to third parties, unless Deluxe Trade LLC did not grant such rights to this third party by entering into a contract / confidentiality clause.

2. All personal data should be accessible only to those who need it, and access can only be made available in accordance with established access control rules. All personal data must be treated with the utmost security and must be kept:

VII. Data security

in a private room with controlled access; and / or in a locked cabinet or file cabinet; and / or
if it is computerized, password protected in accordance with the internal requirements set out in the organizational and technical measures to control access to information; and / or
stored on portable computer media that are protected in accordance with organizational and technical measures to control access to information.

3. An organization has been set up to ensure that computer screens and terminals cannot be viewed by anyone other than the authorized employees of Deluxe Trade LLC. All employees are required to be trained in compliance with organizational and technical access measures as well as workstation lock rules before being granted access to information of any kind.

4. Paper records shall not be left where they can be accessed by unauthorized persons and cannot be removed from designated office premises without express permission. As soon as paper documents are no longer needed for ongoing customer support work, they are destroyed.

VIII. Disclosure of data

1. Deluxe Trade LLC provides conditions under which personal data are not disclosed to unauthorized third parties, which includes family members, friends, government bodies, even investigating authorities, if there is reasonable doubt that they are not required in the established manner. All employees should be cautious when asked to disclose stored personal information to another third party.

Employees receive specific training and recurrent briefings to avoid the risk of such a breach.

2. All requests from third parties for the provision of data must be supported by appropriate documentation and all such disclosures must be specifically authorized by the Data Protection Officer.

IX. Storage and destruction of data

1. Deluxe Trade LLC does not store personal data in a way that permits the identification of entities for a longer period than necessary for the purposes for which the data were collected.

2. Deluxe Trade LLC may only retain data for extended periods if personal data will be processed for archiving purposes, for public, scientific or historical purposes and for statistical purposes, and only when performing appropriate technical and organizational measures to safeguard the data subject’s rights and freedoms.

X. Register of data processing (data inventory)

1. Deluxe Trade LLC has established a data inventory process as part of its approach to addressing risks and opportunities in the compliance process with Regulation (EU) 2016/679. In the inventory of data in Deluxe Trade LLC and in the workflow of data, it is established:

business processes that use personal data;
sources of personal data;
the number of data subjects;
a description of the categories of personal data and the elements of each category;
processing activities;
the purposes of the processing for which the personal data are intended;
the legal basis for the processing;
the recipients or categories of recipients of the personal data;
major systems and storage sites;
all personal data subject to transfers outside the EU;
storage and deletion deadlines.

2. Deluxe Trade LLC is aware of the risks associated with the processing of certain types of personal data.

3. Deluxe Trade LLC assesses the level of risk to individuals involved in the processing of their personal data (where applicable).

4. Deluxe Trade LLC manages all risks identified by the impact assessment in order to reduce the likelihood of non-compliance with the Regulation.

When a type of processing may pose a high risk to the rights and freedoms of individuals, in particular by using new technologies and taking into account the nature, scope, context and purposes of processing, before proceeding to processing, Deluxe Trade LLC shall carry out an assessment the impact of the intended processing operations on the protection of personal data.

5. Where, as a result of the Impact Assessment, it is clear that Deluxe Trade LLC will begin processing personal data which, due to the high risk, could cause harm to the data subjects, the decision whether or not to continue processing should be communicated to review by the Data Protection Officer.

This policy has been in force since 21.05.2018.

To submit a claim for the exercise of your personal data rights, please send an email to support@toilight.net