Privacy Policy

The organization will always obtain explicit consent from a data subject in order to collect and process their data, unless consent is not required in accordance with the law.

In the case of children under the age of 16 (a lower age may be allowed in specific countries), the consent of a parent or a legal guardian must be obtained.

While requesting for consent, IBA informs the data subjects about the organization’s identity, the nature and purpose of the processing, the list of personal data categories for processing, and explains the rights of individuals with regard to their personal data, including the right to withdraw consent. This information is provided in an intelligible and easily accessible form, using clear and plain language.

IBA requests separate consent for different purposes and types of processing, and does not use pre-ticked boxes or any other type of default consent in the consent requests.

When the collected and processed personal data is required to fulfil a contract with the data subject, explicit consent is not required. This will often be the case when the contract cannot be completed without the personal data in question, e.g. a delivery cannot be made without an address to deliver to.

If the personal data is required to be collected and processed in order to comply with the law, then explicit consent is not required. This may be the case for some data related to employment and taxation for example, and for many areas addressed by the public sector.

In the case when the personal data is required to protect the vital interests of the data subject or another individual, then this necessity may be used as the legal basis of the processing. As an example, this case may be applied to the aspects of social care, particularly in the public sector.

When the organization needs to perform a task that is believed to be in the public interest or presents itself as a part of the organization’s official duty, then the data subject’s consent will not be requested.

If the result of data processing or specific personal data are a part of the legitimate interests of the organization and are judged not to affect the rights and freedoms of the data subject in a significant way, then this may be defined as the legal reason for the processing.

IBA performs a legitimate interest assessment (LIA) to ensure compliance with the principle of proportionality.

Performing its role as a controller, the organization processes a special category of personal data only if it has identified one of the following conditions for processing:

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where the law of the data subject location country does not provide the right of the data subject to cancel the prohibition on processing;

(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, provided that appropriate safeguards are ensured for the fundamental rights and interests of the data subject;

(c) processing is necessary to protect the vital interests of the data subject or of another individual if the data subject is physically or legally incapable of giving consent;

(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;

(e) processing relates to personal data which is explicitly made public by the data subject;

(f) processing is necessary for the establishment, exercise or defense of legal claims or whenever courts are acting in their judicial capacity;

(g) processing is necessary for reasons of substantial public interest, provided that suitable and specific safeguards are ensured for the fundamental rights and the interests of the data subject;

(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services;

(i) processing is necessary for the reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, provided that suitable and specific safeguards are ensured for the rights and freedoms of the data subject, in particular professional secrecy;

(j) processing is necessary for archiving purposes of the public interest, scientific or historical research purposes or statistical purposes, provided that suitable and specific safeguards are ensured for the fundamental rights and the interests of the data subject.

IBA processes personal data related to criminal convictions and offenses only under the control of an official authority, or when the law of the data subject location country permits processing, and only appropriate safeguards are provided for the rights and freedoms of data subjects.

The organization adopts the principle of “data protection by design and default” and carries out appropriate technical and organizational measures to implement the data protection principles and safeguard individual rights.

In essence, “data protection by design” means that IBA has integrated data protection into systems, services, products and business practices, from the design stage right through the lifecycle. The organization only uses data processors that provide sufficient guarantees of their technical and organizational measures for data protection by design. The organization takes into account the data protection by design when it purchases products for use in its processing activities.

In fact, “data protection by default” means that IBA, in respect of its activities as a controller:

• specifies the minimum set of personal data required to achieve specific processing purposes before the processing starts;
• appropriately informs the data subjects;
• only processes the data necessary for processing purposes;
• does not process additional personal data until the data subject authorizes to do so;
• ensures that personal data is not automatically available to others until the data subject allows it;
• ensures that personal data is automatically protected in any IT system, service, product and / or business practice, so that individuals should not have to take any specific actions to
• protect their privacy;
• offers strong privacy defaults, user-friendly options and controls, and respect user preferences.

The organization takes into account the use of techniques such as pseudonymisation where applicable and appropriate.

IBA ensures that all relationships it enters into that involve the personal data processing are regulated by documented contracts that include the specific information and conditions required by the law.

Contracts of the organization include the following compulsory information:

• the subject and duration of the processing;
• the nature and purpose of the processing;
• the types of personal data and categories of data subjects;
• the obligations and rights of the controller.

Contracts of the organization include the following compulsory terms:

• the processor must only act on the written instructions of the controller (unless required by law to act without such instructions);
• the processor must ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• the processor must take appropriate measures to ensure the security of processing;
• the processor must only engage a sub-processor with the prior consent of the data controller and a written contract;
• the processor must assist the data controller to ensure that data subjects exercise their rights in accordance with the law of the data subject location country;
• the processor must assist the data controller in meeting its obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments;
• the processor must delete or return all personal data to the controller as requested at the end of the contract;
• the processor should contribute to audits and inspections to provide the controller with whatever information necessary to confirm the processor’s compliance with his obligations, and notify the controller immediately if it is asked to do something infringing data protection legislation.

IBA as a controller only appoints processors who can provide “sufficient guarantees” that the requirements of the law of the data subjects’ location countries will be observed, and the rights of data subjects will be protected.

IBA transfers personal data to the third country or the international organization only if the requirements of the law of the data subjects’ location countries are fully observed, for example, if the transfer of personal data to that third country or international organization is authorized by the regulatory body without additional authorization by the supervisory authority, since there is an adequate level of protection that meets the requirements of the law, or if the organization receiving the personal data has provided appropriate safeguards that comply with the requirements of the law.

Before such transfer IBA makes sure, that, as a result, the level of protection of data subjects ensured by law will not be undermined, including the cases of onward transfers of personal data from the third country or an international organization to controllers, processors in the same or another third country or international organization.

Following such transfer, individuals’ rights must be enforceable and effective legal remedies for individuals must be available.

As a controller, IBA maintains records of the following categories to document its processing activities:

• records of processing activities;
• the legal basis for the processing,
• records of consent;
• Legitimate Interests Assessment reports,
• information provided to data subjects;
• controller-processor contracts;
• the location of personal data;
• Data Protection Impact Assessment reports;
• records of personal data breaches.

As a processor, IBA maintains records of the following categories to document its processing activities:

• records of processing activities;
• controller-processor contracts;
• the location of personal data;
• records of personal data breaches.

IBA’s undertakings employing fewer than 250 persons do not keep records of processing activities unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of personal data or personal data relating to criminal convictions and offenses.

The records are kept in writing. The records are kept up to date and reflect current processing activities.

The organization makes the records available to the supervisory authority upon request.

IBA has identified and regularly updates the security threats to personal data, performs risk analysis related to the personal data processing, documents findings and uses them to assess the appropriate level of security that needs to be put in place.

The security threat to personal data means a factor that creates the danger of unauthorized, including accidental, processing of personal data, as well as the accidental or intentional loss, destruction or damage to personal data.

IBA has allocated responsibility for information security to certain employees and teams and provided them with the appropriate resources and authority. Employees who are authorized by the organization to process personal data, before starting to work with personal data, undertake responsibility to comply with confidentiality and other requirements of the Policy.

IBA’s undertakings have an information security rules and take the necessary steps to implement it. Where required, IBA’s undertakings adopt additional regulatory documents and ensure that controls are in place to enforce them.

IBA regularly reviews its information security regulatory documents and, if necessary, improves them. IBA conducts regular testing and reviews of its information security measures to ensure they remain effective, and act on the results of those tests where they highlight areas for improvement.

IBA’s undertakings keep records of assets involved in the personal data processing (applications, systems, personnel, and media).

IBA uses encryption and/or pseudonymisation, where it is appropriate to do so.

IBA’s undertakings mandatory use cryptographic security means if personal data is transmitted through open communication channels.

IBA’s undertakings have proper backup processes so that they can restore integrity and access to personal data in the event of any incidents, as soon as reasonably possible.

IBA’s undertakings make sure that any data processor they are using also implements appropriate technical and organizational measures.

IBA’s undertakings provide the necessary physical security measures to protect premises, equipment and information from unauthorized access.

IBA has defined business continuity arrangements that protect and recover any personal data the organization holds.

IBA conducts appropriate initial and refresher training for personnel involved in data processing on data protection issues and, including, inter alia, personal data processing duties, employees responsibility for personal data protection, rules and restrictions for employees to use the systems and services (for example, to avoid virus infection or spam).

The organization has prepared a response plan for addressing any personal data breaches that may occur. IBA has allocated responsibility for managing breaches to certain employees and teams. The organization’s employees know how to escalate a security incident to the proper responsible person or team in IBA to determine whether a breach has occurred.

IBA adopted a process to notify the supervisory authority of a breach within 72 hours after becoming aware of it, even if there are still no details. The organization adopted a process to inform without undue delay the affected individuals about a breach, when it is likely to result in a high risk to their rights and freedoms. The organization’s Data Protection Officers supervise the process of notifying the data subjects and supervisory authorities of the personal data breaches.

IBA documents all breaches, even if not all of them are in need to be reported.

As a controller, IBA does a DPIA when personal data processing is likely to result in a high risk to individuals.

The organization considers expediency of fulfillment of a DPIA in any major project involving the personal data processing carried out as the controller. If IBA decides not to carry out a DPIA, it will document the reasons.

DPIA must:

• describe the nature, scope, context and purposes of the processing;
• assess the need for processing and proportionality to the purposes;
• identify and assess risks to individuals;
• identify any measures to mitigate those risks and to confirm compliance with legislation.

If the organization identifies a high risk that it cannot mitigate, it should consult the supervisory authority before starting the processing.

IBA is not required to appoint a DPO, since it is not a public authority or body, does not perform large-scale monitoring, and does not process special categories of personal data on a large scale, but it has decided to do so voluntarily. The organization understands that the same duties and responsibilities apply as with the mandatory appointment of DPO. IBA appoints the DPO at the head office and, if necessary, at some undertakings of the organization.

IBA tasked its DPOs to monitor compliance with data protection laws and organization’s data protection regulatory documents, awareness raising, employees training and the related audits. IBA timely involves its DPOs on all issues relating to the personal data protection.

The organization’s DPOs inform and advise the employees of the organization who carry out the personal data processing on their obligations under the data protection legislation.

The DPO of the head office reports directly to the top management of the organization. The DPOs of other IBA’s undertakings cooperate with the DPO of the head office and report to the management of their enterprises and the top management of the organization. All organization’s DPOs are given the required independence to perform their tasks.

The organization’s DPOs are easily accessible as the contact points for our employees, individuals and supervisory authorities. IBA published the contact details of its DPOs and communicated them to the supervisory authority.

If you have any questions about IBA Group’s Privacy Policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

Email us at: dpo@ibagroup.eu

Call us: +420 251 116 211

Or write to us at: 2583/13 Petrzilkova St., Prague 5, 158 00, Czech Republic

Professional associations and representative bodies may prepare codes of conduct covering topics such as fair and transparent processing, the legitimate interests pursued by controllers, pseudonymisation and the exercise of human rights, etc.

In addition, supervisory authorities or accredited certification bodies may issue certificates of compliance with the legislative requirements of data processing activities.

Compliance with the code of conduct and obtaining a certificate are voluntary, but the organization sees them as an excellent way to monitor and demonstrate compliance with the requirements for the personal data protection.