SHIORI TRADING LIMITED (“the Company”)

GDPR Data Protection Policy (“the Policy”)

  1. Introduction
    • The Company aims to ensure that all personal data collected about clients, employees, visitors and other individuals is collected, stored and processed in accordance with the EU General Data Protection Regulation 679/2016 (“the GDPR”) and the Law Providing for the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data (Law 125(I)/2018).
    • This Policy is in place to ensure everyone is aware of their responsibilities and outlines how the Company complies with the core principles of It applies to anyone who handles or has access to people’s personal information, regardless of the way it is used or whether it is in paper or electronic format.

2.        Legislative Framework

  • This Policy has due regard to legislation including, but not limited to, the following:
    • The GDPR
    • Law 125(I)/2018
    • Any related official guidance and regulation published

3.        Processing of Personal Data

  • The Company obtains and processes data fairly and lawfully informing individuals of the reason for data collection, the purposes for which data is held, the likely recipients of the data and the individual’s right of The Company will:
  • Hold the minimum personal data necessary to enable it to carry out its functions and will not hold it for any longer than necessary for the purposes for which it was collected.
  • Make every effort to ensure that data held is accurate, up to date and that inaccuracies are corrected as soon as possible.
  • Only share personal information with others in ways the individual has been informed about or where it is necessary or where they are required to share and before doing so they will ensure adequate security is in place to protect it and the data recipient has been outlined in a privacy notice or appropriate consent has been
  • Ensure that information disposal is done appropriately and, where necessary, securely.

Personal Data

Personal data refers to any information that relates to an identified, or identifiable individual such as name, date of birth, ID and location.

In the Company’s field of business personal data also refers to an individual’s purchase history, history of modes of payment and browsing history.

Sensitive Data

Sensitive personal data is personal data which is more sensitive and includes, but is not limited to, information about an individual such as their race or ethnicity, religious beliefs or health.

  • Where data is processed on any other person than those included above the individual will be informed of the lawful reason for collecting the information, how it will be used and their rights in connection with the Company holding their data.
  • Where data is obtained directly from an individual, information on whether the provision of personal data is part of a statutory or contractual requirement, as well as any possible consequences of failing to provide the personal data, will be For data obtained directly from an individual, this information will be supplied at the time the data is obtained.
  • Where data is not obtained directly from an individual, information on the categories of personal data that the Company holds, the source that the personal data originates from and whether it came from publicly accessible sources, will be provided:
    • Within one month of having obtained the
    • If disclosure to another recipient is envisaged, at the latest, before the data is
    • If the data is used to communicate with the individual, at the latest, when the first communication takes place.
  • The Company does not collect or use biometric
  • How the Company uses employee information is set out in Appendix A.
  • How the Company uses client information is set out in Appendix B.
  • The Company only collects personal data for specified, explicit and legitimate reasons and these reasons will be explained to the individuals when the data is first collected.
  • If the Company wants to use personal data for reasons other than those given when the data was first obtained it will inform the individuals concerned before the data is used and seek consent where necessary.
  • Staff must only process personal data where it is necessary in order to do their
  • When staff no longer needs the personal data they hold, they must ensure it is deleted or anonymised in line with the Company’s Records Management & Information Security Policy (see Appendix C).

4.        Data Protection Officer (DPO)

  • The Company has an appointed DPO (Mr. /Mrs ……………………) who informs and advises the Company and its officers and employees about their obligations to comply with the GDPR and the relevant Law.

5.        Staff Responsibilities

  • All employees, are responsible for collecting, storing and processing personal data in accordance with this
  • They are also responsible for informing the Company of any change to their own personal
  • They must contact the DPO for guidance where they:
    • Have any questions about the operation of this Policy, data protection law, retaining personal data or keeping personal data secure.
    • Have any concerns that policy is not being
    • Are unsure if they have a legal basis for using personal data in a particular way.
    • Need to rely on or obtain consent for the use of
    • Need to transfer data to another EU country.
    • Need to transfer data outside the EU.
    • Are engaging in a new activity, collecting new data types, using data for a different purpose or introducing new processing or software, so that the impact of these can be assessed and, where appropriate, consent obtained or privacy notices adapted to ensure compliance.
  • They are responsible for reporting to the DPO any data breaches which have happened through their own actions or where they become aware of one arising from the actions, accidental or otherwise, of
  • They are responsible for referring all requests for data access, including freedom of information requests, subject access requests and other relevant requests to the DPO.
  • Staff will undertake data handling awareness and data protection training and be made aware of their responsibilities as part of their induction and keep their training up to date in order to comply with

6.        Lawful Processing

  • The legal basis for processing data should be identified and documented prior to data being
  • The Company will only process personal data where it has one of 6 legal reasons to do so under data protection regulation and these reasons are where:
    • The consent of the individual, or their parent/guardian where appropriate, has been freely given; or
    • Processing is necessary for:
      • The Company to perform a contract with the individual, or the individual has asked the Company to take specific steps before entering into a
      • The Company to comply with a legal
      • Protecting the vital interests of the individual or another person g. to protect someone’s life.
  • The Company to perform a task in the public interest and carry out its official
  • The legitimate interests of the Company or a third party provided the individual’s rights and freedoms are not overridden.
  • For special categories of personal data, the Company will also meet one of the special category conditions for processing which are set out in the

7.        Data Sharing

  • We will not normally share personal data with anyone else, but may do so where:
    • There is an issue with a client that puts the safety of our staff at risk
    • We need to liaise with other agencies and where necessary the Company will seek consent before doing this
    • Suppliers or contractors need data to enable them to provide services to our staff and clients. When doing this, we will:
      • Only appoint suppliers or contractors who can provide sufficient guarantees that they comply with data protection regulation and law
      • Establish a data sharing agreement with the supplier or contractor, either in the contract or as a standalone agreement, to ensure the fair and lawful processing of any personal data we share
      • Only share data that the supplier or contractor needs to carry out their service, and information necessary to keep them safe while working with us

7.2.   The Company is also legally required to routinely share certain data with relevant authorities and for purpose which can include:

  • The prevention or detection of crime and/or fraud or the apprehension or prosecution of offenders
  • The assessment or collection of tax
  • In connection with the enquiries of investigating and prosecuting authorities for the sole purpose of investigations and/or proceedings
  • Where disclosure is required to satisfy our safeguarding obligations
  • Research and statistical purposes, as long as personal data is sufficiently anonymised or consent has been provided
  • It may also be shared:
    • Where required in order to enter, or perform under, any contract the Company has with the individual
    • With the Company’s professional advisors for the sole purpose of the professional advisors’ providing the Company with a professional service and on condition that the professional advisors themselves agree not to divulge, publish or use the information:
    • If required by law or by order of a court of law
    • With emergency services and local authorities to help them to respond to an emergency

situation that affects any of our clients or staff

  • The Company uses a number of computer applications which are Personal data is not publicly shared with these providers but their software uses personal data to enable the Company’s systems to run and they have system access in some cases for program maintenance. The Company will carry out assessments to ensure these providers are GDPR compliant.
  • Data will otherwise only be shared where the individual has been informed and consent given.
  • Data will not be made available to third parties for
  • Data will not be transferred to, or used in, other countries except where it is necessary to do so, for example, because:
    • The individual is not resident in Cyprus
    • The individual requests information to be sent to another country
    • It is necessary in support of a Company activity going to, or in, another country

8        Consent

  • When the Company seeks consent the response must be freely given, specific, informed and an unambiguous indication of the individual’s wishes. It must be a positive indication and cannot be inferred from silence, inactivity or pre-ticked
  • Where consent is given, a record will be kept documenting how and when consent was given.
  • Consent can be withdrawn by the individual at any
  • Where a child is under the age of 14, the consent of parents or guardian will be sought prior to processing, where appropriate.
  • There may be circumstances where it is considered necessary to process personal data or special category personal data in order to protect the vital interests of a data subject. This may include medical emergencies where it is not possible for the data subject to give consent to the In such circumstances, the DPO will be consulted if possible or advised if an immediate on the spot decision was needed.

9        Data Security

The Company will protect personal data and keep it safe from unauthorised access, alteration or disclosure and against accidental or unlawful destruction or damage. Data is managed in line with the Company’s Records Management & Information Security Policy (see Appendix C).

10    Access to Information

10.1   Individuals can request confirmation that their data is being processed and may submit a form to gain access to their personal data in order to verify the lawfulness of the processing.

10.2   Information on how to do this is set out in the Company’s Records Management & Information Security Policy (see Appendix C).

  • Other data protection rights of individuals

In addition to the right to make a subject access request as outlined above and to receive information when their data is collected about how it will be used and processed, data protection law gives individuals rights to, for example:

  • Ask for the rectification of any inaccurate or incomplete personal
  • Challenge processing which has been justified on the basis of legitimate interests or the performance of a task in the public
  • Object to decisions based solely on automated decision making or
  • Have their data erased where there is no compelling reason for its continued
  • Restrict the processing of their data in certain circumstances such as where the data is inaccurate for example.
  • Be informed of a data breach in certain
  • Ask for their personal data to be transferred to a third party so that the individual can obtain and reuse their personal data for their own purposes across different services.

They may also:

  • Withdraw their consent to processing at any
  • Make a Individuals can submit a request to exercise these rights and information on how to do this is set out in the Company’s Records Management & Information Security Policy (see Appendix C).

11    CCTV and Photography

  • The Company understands that recording images of identifiable individuals constitutes processing personal information, so it is done in line with data protection Signs are in place to notify individuals that CCTV is installed.
  • As part of our Company activities photographs/video footage of individuals or groups of individuals may be We may also do this for the purposes of staff training/performance appraisal reviews. These images may be shared internally for the purpose or purposes they were taken however the Company will always indicate its intentions to do so.
  • We will obtain written consent from clients or parents/carers, or children aged 14 and over, for photographs and videos to be taken of clients or children for communication, marketing and promotional Uses may include:
    • Within Company on notice boards and in Company magazines, brochures, newsletters, etc.
    • Outside of Company by external agencies such as the Company photographer, newspapers, campaigns, marketing
    • Online on our Company website or social media pages
    • On vehicles and events/marketing posters and distribution materials
  • Where we need parental consent we will clearly explain how the photograph and/or video will be used to both the parent/carer and child. Where we don’t need parental consent, we will clearly explain to the individual how the photograph and/or video will be
  • Consent can be refused or withdrawn at any If consent is withdrawn, we will delete the photograph or video and not distribute it further.
  • When using photographs and videos in this way we will not accompany them with any other personal information about the child to ensure they cannot be
  • Images captured by individuals for recreational/personal purposes, and videos made by parents for family use, are exempt from GDPR.

12    Data Retention

  • The Company has a responsibility to ensure that records are only kept for as long as is necessary to fulfil the purpose or purposes for which they were intended. Data will not be kept for longer than is necessary and any unrequired data will be deleted/securely disposed of as soon as
  • In determining retention periods the Company will have regard to legislation and regulation for each of its records and in certain circumstances there may be reason why even these time scales

may need to be exceeded.

  • Disposal will be managed in accordance with the Company’s Records Management & Information Security Policy (see Appendix C).
  • If an individual requests erasure of information the Company will make every effort to comply however where there is reason not to comply individuals will be advised of this and the reason for

13    Complaints

  • If an employee believes that the Company has not complied with this Policy or acted otherwise than in accordance with GDPR, they should inform the DPO.
  • If a client or other individual who is not an employee believes that the Company has not complied with this Policy or acted otherwise than in accordance with GDPR, they should inform the DPO.

14    Policy Revision

This Policy is generally reviewed annually but may be reviewed at other times to ensure compliance with current legislation and is therefore subject to change without prior notice.

Appendix A

Privacy Notice

The categories of Company employee information that we process include:

  • Personal information such as name, address, national insurance number, gender, ethnicity and date of birth
  • Contract information such as start dates, hours worked, position and salary information
  • Bank details
  • Identifying documents such as passport numbers, utility bills
  • Professional references
  • Details of qualifications relevant to your job/role or employment
  • Contact details such as telephone numbers and email addresses
  • Any relevant medical/disability information and any accident reports
  • Records of sickness, appraisal, capability, grievances and disciplinary matters
  • Work absence information such as number of absences and reasons
  • Data about your use of the Company’s information and communications system
  • Vehicle details for those who use the Company’s car parking facilities
  • Photographs & other visual imagery
  • Site/building access information
  • CCTV images

We use this data to:

  • Establish contractual information
  • Establish the right to work in Cyprus
  • Enable individuals to be paid
  • Enable the provision of pensions
  • Establish identity where a person has to do so relevant to their position e.g. to enable the Company’s Bank to conform with AML regulations
  • Inform and help make provision for ‘reasonable’ adjustment where medical conditions, or disabilities, and other reasons make it necessary for these to be considered
  • Comply with security and safeguarding requirements
  • Comply with insurance disclosure requirements
  • Support site and personal security
  • Communicate with you

The lawful basis on which we collect and process

In order to carry out its duties to staff, to comply with its obligations and duties to meet the purposes of a Company and to safeguard its employees, the Company may process a range of personal data about individuals.

Information is required in the first instance for the purposes of recruitment and employment and the Company will therefore have a legitimate interest for processing basic personal data and sensitive personal data.

Thereafter the information it collects and processes will be in order to fulfil its legal rights, duties or obligations including those:

  • Under a contract with its staff (lawful basis: contract)
  • That ensure and sustain the wellbeing and safeguarding of, and promote the development of, the workforce (lawful basis; legitimate interest)
  • That ensure the statutory needs of the workforce are met (lawful basis: legal obligation)
  • That meet statutory requirements to provide information to authorities and insurers (lawful basis: legal obligation)

Other uses of personal data may be made in accordance with the Company’s legitimate interests, or the legitimate interest of another, provided that these are not outweighed by the impact on individuals and provided it does not involve special or sensitive types of data.

Collecting information

Most of the information we collect comes from the application and appointment process. Work related information will be added during the time you are working at the Company.

The personal data collected is essential for the Company’s operational use and whilst the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with GDPR, we will inform you whether you are required to provide certain information to us or if you have a choice in this and we will tell you what you need to do if you do not want to share this information with us.

Storing this information

We hold workforce and role related information whilst you are working for the Company and then a minimum of seven years from the date of leaving. It may however be necessary to hold this information longer than this where we may be obliged to do so by regulation prevailing at that time.

Records generated whilst you are working for the Company, such as accident records for example, will be kept for the time required under the relevant regulation we have collected it for.

Records generated solely for legitimate reasons whilst you are working for the Company will be disposed of when you leave unless we assess, at that time, that they are required for longer by law or regulation or for other reasons. Where this is for other reasons you will be notified. In respect of any matters of safeguarding information will be kept as long as we require.

Sharing with Authorities

We do not share information about workforce with anyone without consent unless the law and our policies allow us to do so. Where we share information we do so only to the extent that it is required for that purpose.

We are required to share elements of employees information collectively and/or individually with authorities such as the Tax Department and Social Insurance.

Sharing with others

We also share some of this information with insurers and other service providers such as banks, but only to the extent that it is required to provide cover for the Company in respect of its business, activities or its workforce or to the extent that it is required to facilitate the business of the Company and for the performance of your duties or to provide an agreed benefit to you.

We will share information where we are required to do so by law or by order of the court or to prosecuting authorities for the sole purpose of investigations and/or proceedings. All staff are reminded that the Company is under duties imposed by law and statutory guidance to record and report incidents and concerns that arise or are reported to it, in some cases regardless of whether they are proven, where they meet a certain threshold of seriousness in their nature or regularity. This may include file notes on personnel or safeguarding files, and in some cases referrals to relevant authorities or police.

Requesting access to your personal data

Under GDPR, you have the right to request access to information about you that we hold. To make a request for your personal information, contact the DPO.

Depending on the lawful basis for collection and holding data you may also have the right to:

  • Object to processing of personal data that is likely to cause, or is causing, damage or distress
  • Prevent processing for the purpose of direct marketing
  • Object to decisions being taken by automated means
  • In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
  • Seek redress, either through the Commissioner or through the courts

Withdrawal of consent and the right to lodge a compliant

Where we are processing your personal data on the basis of consent, you have the right to withdraw that consent. If you change your mind, or are unhappy with the use of your personal data, please let us know by contacting the DPO.

Contact

If you would like to discuss anything in this privacy notice, please contact the DPO.

Appendix B

Privacy Notice

The categories of client information that we process include

Client data

  • Personal information such as name, address and date of birth
  • Characteristics such as gender, ethnicity, country of birth and mother language
  • Identification such as passport details
  • Contact details such as telephone numbers and email addresses
  • Purchase history
  • History of modes of payment
  • Browsing history
  • Vehicle details for those who use the Company’s car parking facilities
  • Site/building access information
  • CCTV images

We collect and use this data to:

  • Respond to requests for information about the Company
  • Process payments
  • Understand your preferences
  • Provide you with recommendations
  • Inform you of seasonal trends
  • Design loyalty programs
  • Customise offers
  • To keep you informed about the Company community and let you know of events
  • Support site and personal security
  • Communicate with you

The lawful basis on which we collect and process this information

In order to meet legal requirement or carry out its duties and its functions the Company may process a range of personal data about individuals.

Collecting information

We collect information via the registration process and via the purchases

Storing information

We hold data securely for the set amount of time required by law or regulation.

Sharing

We may share client information with suppliers, service providers and professional advisors to enable them to provide the service we have contracted them for.

Where we share information we do so only to the extent that it is required for that purpose.

Why we share this information

We do not share information with anyone without consent unless the law and our policies allow us to do so.

We will share information where we are required to do so by law or by order of the court or to prosecuting authorities for the sole purpose of investigations and/or proceedings.

Your right to request access to your personal data

Clients have the right to request access to information about them that we hold. To make a request for your personal information, contact the DPO at the Company’s address.

Depending on the lawful basis for collection and holding data, you may also have the right to:

  • Object to processing of personal data that is likely to cause, or is causing, damage or distress
  • Prevent processing for the purpose of direct marketing
  • Object to decisions being taken by automated means
  • In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
  • Seek redress, either through the Commissioner or through the courts

Withdrawal of consent and the right to file a compliant

Where we are processing your personal data on the basis of consent, you have the right to withdraw that consent. If you change your mind, or are unhappy with the use of your personal data, please let us know by contacting the DPO.

You also have the right to file a complain with the Commissioner.

Contact

If you would like to discuss anything in this privacy notice, please contact the DPO.

Appendix C

Records Management & Information Security Policy

  1. Introduction
    • The Company recognises that by efficiently managing its records, it will be better able to comply with its legal and regulatory obligations and contribute to the effective overall management of the Records provide evidence for protecting the legal rights and interests of the Company and provide evidence for demonstrating performance and accountability.
    • The Company is also committed to maintaining the confidentiality of its information and ensuring that records are only accessible by the appropriate persons.
    • This Policy provides the framework through which effective and proper management can be
    • It has been drawn up within the context of the GDPR and the Law.

2.   Scope of the Policy

  • The Policy applies to all records created, received or maintained by employees or other staff of the Company in the course of carrying out its
  • Records are defined as all those documents which facilitate the business carried out by the Company and which are thereafter retained, or retained for a set period, to provide evidence of its transactions or activities. These records may be created, received or maintained in hard copy or

3.   Responsibilities

  • The Company has a responsibility to maintain its records and record keeping systems in accordance with the regulatory environment. The person with overall responsibility for this Policy, and its implementation is the Headmaster however data security is a whole Company matter and everyone’s
  • The DPO is responsible for records management in the Company and for promoting and monitoring compliance with The DPO is responsible for ensuring that all records are securely stored and appropriately disposed of at the end of the relevant period.
  • Individual staff are responsible for ensuring that records for which they are responsible are accurate, maintained securely and disposed of correctly, in line with the provisions of this Policy.

4.   Retention

  • There is no sector wide retention policy that prescribes how long all categories of data should be retained The Company therefore looks to best practice together with considering the needs of the Company and the context in which the information might be required.
  • Retention depends upon the purpose data was collected for and any subsequent events or incidences that may impact upon the retention period, for example, safeguarding matters The focus should be on the time period that is ‘necessary and proportionate’.
  • A small percentage of the Company’s records may be selected for permanent preservation as part of the Company’s archives and for historical

5.   Storing and Protecting Information

General
  • It is the Company’s aim that:
    • Information is protected against unauthorized access
    • Confidentiality of information is assured
    • Integrity of information is maintained
    • Regulatory and legislative requirements are met.
  • It aims to do this through applying standards and procedures which will include:
    • Acceptable use policies
    • Data storage and backup procedures
    • Asset identification and control
    • Physical and environmental security
    • Developing and maintaining secure processing systems
  • It is the responsibility of each member of staff to adhere to policy, standards and
  • All confidential records will have restricted access and appropriate safe storage.
  • All staff members will implement a ‘clear desk policy’ to avoid unauthorised access to physical

records containing sensitive or personal information.

  • Under no circumstances are visitors allowed access to confidential or personal Visitors to areas of the Company containing sensitive information should be supervised at all times.
  • Where personal information that could be considered private or confidential is taken off the premises, to fulfil the purpose of the data in line with GDPR, either in an electronic or paper form, staff must take extra care to follow the same procedures for security, e.g. keeping devices secure and ensuring that no information is copied to or left accessible on any computer which has general use or cannot be adequately The person taking the information from the Company premises has full responsibility for the security of the data.
  • Before sharing data, staff will ensure that:
    • They have consent from individuals to share it
    • Adequate security is in place to protect it
    • The data recipient has been outlined in a privacy notice
Paper based information
  • Confidential paper records will be kept in a locked storage with restricted
  • They must not be left unattended or in clear view when held in a location with general access or in the presence of unauthorised
Digital based information
  • Devices holding personal data or data applications must have appropriate security programmes

running to protect them from virus’s and potential hacking.

  • Terminals and applications will have appropriate access restrictions and must not be left in accessible mode or visually displaying confidential information in a location with general access or in the presence of unauthorised Company and/or personal laptops and similar devises must not be used to hold any Company personal and/or sensitive data
  • Staff are provided with their own secure login and password for systems relevant to their role and, or, positon. There are protocols for safe use of electronic devices and for construction and managing
  • Digital personal data should be coded, encrypted or password-protected, both on a local hard drive and on a network drive that is regularly backed up and where personal data is saved on removable storage or a portable device, the device will be encrypted and kept in appropriate safe storage when not in

6.   Accessing Information

  • All members of staff, clients and other users of the Company and its facilities have the right to access certain personal data being held about them or their child. This includes:
    • Confirmation that their personal data is being processed
    • Access to a copy of the data
    • The purposes of the data processing
    • The categories of personal data concerned
    • Who the data has been, or will be, shared with
    • How long the data will be stored for, or if this isn’t possible, the criteria used to determine this period
    • The source of the data, if not the individual
    • Whether any automated decision-making is being applied to their data, and what the significance and consequences of this might be for the individual
  • Personal information can be shared with children once they are considered to be at an appropriate age and responsible for their own affairs; although, this information can still be shared with
  • Children aged 14 and above are generally regarded to be mature enough to understand their rights and the implications of a subject access request. A child’s ability to understand their rights will always be judged on a case-by-case basis.

7.   How to Request Information

  • To help us process your request please clearly mark any request or correspondence SUBJECT ACCESS REQUEST. You can send this to the DPO who’s details are set out at the end of this
  • In exceptional circumstances some information may be available only by viewing in Where this is the case an appointment to view the information can be arranged through the contact details already set out above.
  • Your request must state the name of the applicant, email and telephone contact details and an address for correspondence and it must clearly describe the information you are asking
  • When responding to requests, we:
    • May ask the individual to provide 2 forms of identification
    • May contact the individual via phone to confirm the request was made
    • Will respond without delay and within 1 month of receipt of the request
    • Will provide the information free of charge
  • We will not disclose information if it:
    • Might cause serious harm to the physical or mental health of the client or another individual
    • Would reveal that the client is at risk of abuse, where the disclosure of that information would

not be in the client’s best interests

  • If such an application is made the Company will verify the identity of the person making the request before any information is When this has been confirmed a copy of the information will be supplied to the individual free of charge.
  • All requests will be responded to without delay and within one month of
  • In the event that a large quantity of information is being processed about an individual, the Company will ask the individual to specify the information the request is in relation
  • In the event of numerous or complex requests, the period of compliance will be extended by a further two The individual will be informed of this extension, and will receive an explanation of why the extension is necessary, within one month of the receipt of the request.
  • Where a request is manifestly unfounded or excessive, the Company holds the right to refuse to respond to the request. When a request is refused, the Company will tell the individual why, and tell them they have the right to complain to the Commissioner.

8.   Exercising Other Data Protection Rights of the Individual

  • In addition to the right to make a subject access request as outlined above and to receive information when their data is collected about how it will be used and processed, data protection law gives individuals rights to, for example:
    • Ask for the rectification of any inaccurate or incomplete personal
    • Object and prevent their personal data being used for direct marketing.
    • Challenge processing which has been justified on the basis of legitimate interests or the performance of a task in the public
    • Object to decisions based solely on automated decision making or
    • Have their data erased where there is no compelling reason for its continued
    • Restrict the processing of their data in certain circumstances such as where the data is inaccurate for example.
  • Ask for their personal data to be transferred to a third party so that the individual can obtain and reuse their personal data for their own purposes across different services.
  • Withdraw their consent to processing at any
  • To help us process your request please clearly mark any request or correspondence DATA PROTECTION RIGHTS. You can send this to the DPO who’s details are set out at the end of this
  • Where the request is for rectification and the personal data in question has been disclosed to third parties, the Company will inform them of the rectification where possible, and inform the individual about the third parties that the data has been disclosed
  • The Company will also inform relevant third parties with whom data has been shared in the event of erasure or restrictions on processing, subject to this being possible and not involving disproportionate effort to do
  • Requests will generally be responded to within one month; this will be extended by two months where the request is complex or a number of requests have been received and in this case the individual will be notified of this and the reason for the
  • There may be circumstances in which the individuals request cannot be carried out, for example, where the Company has a right to refuse in certain circumstances or where the personal data concerns more than one individual and providing the information would prejudice the rights of any other Where a request is refused the Company will tell the individual why, and tell them they have the right to complain to the Commissioner.

9.   Information Audit

  • The DPO will, from time to time, conduct information audits to evaluate the information the Company is holding, receiving and using, and to ensure that this is correctly managed in accordance with This may take the form of interviews with staff members and or questionnaires as well as general visits around site.
  • The DPO will assess from these audits the Company’s ongoing data needs, the information needed to meet those needs, appropriateness of storage formats, retention periods and protective marking.
  • Audits will include ensuring that surveillance and CCTV footage is handled and processed in accordance with the CCTV Code of Practice and data protection

10. Marking and Disposal of Information

  • Information needs to be appropriately marked to identify its degree of confidentiality however all personal data has some degree of It will therefore be the protocol in this Company to assume data will not be routinely marked unless it is either restricted or confidential.
  • .‘Restricted’ will be used to identify data or information that can identify an individual person or child and places that person or child at risk of It also applies to information which is sensitive data or when for example group summaries are prepared on a personal characteristic. Restricted by definition implies restricted circulation i.e. on a needs to know basis only.
  • .‘Confidential’ applies to highly sensitive information or data, including commercially sensitive information, where unauthorised disclosure, even within the Company, is not permitted or may put someone’s personal safety at high
  • Where data or information should be ‘reviewed prior to disposal’ it should be marked as such so as to ensure it is retained as the circumstances at that time then
  • Non-sensitive information can be disposed of in ordinary rubbish or recycling It is unlikely that any document containing personal data will fall into this category.
  • Any information which contains personal data or is specifically categorised either restricted or confidential should be disposed of in the containers designated for such waste and which are emptied under agreed Where we use a third party to safely dispose of records on the Company’s behalf they will be required to provide sufficient guarantees that they comply with data protection law.
  • Personal data should only be kept in a form which permits the identification of individuals for no longer than is necessary for the purposes for which the personal data are processed. The DPO will ensure that data (both in paper and digital form) is reviewed
  • Where files or data are marked as ‘to be reviewed before disposal’ the relevant member of staff will do this in liaison with the
  • Where information must be kept permanently it is exempt from the normal review procedures

11. Policy Revision

This Policy is generally reviewed annually but may be reviewed at other times to ensure compliance with current legislation and is therefore subject to change without prior notice.

Contact Details for the DPO for enquiries referred to in the Policy Email:                            ……………………….

Telephone:           ……………………

Contact address: The DPO ………………………….

………………………………

………………………………

Website Terms and Conditions

 
This website belongs to SHIORI TRADING LIMITED (“SHIORI”). By accessing www………………….. (the “Website”), you automatically acknowledge and agree to be bound in full by the provisions contained in these Terms and Conditions and any amendments that may be effected without notice and all applicable laws.

Qualifications

To shop with us, you need to:

  • be at least 18 years old;
  • have a credit or debit card that we accept; and
  • be authorised to use that credit or debit card (eg. it is in your name or you have permission to use it).

If you do not agree with these Terms and Conditions or do not satisfy the above you should exit this Website.

Use of Materials

The materials contained in this Website may be downloaded for personal viewing only. You may not modify, publish, transmit, participate in the transfer or sale, create derivative works, or in any way exploit any of the content, in whole or in part. You may download, print, and save copyrighted material for your personal use only.

Copyright
All information and material posted on this Website are subject to copyrights owned by SHIORI and/or ……………. and/or ……………… and/or and other individuals or entities as defined by law. Any reproduction, retransmission, republication, or other use of all or part of any document found on this Website, including but not limited to, posting, linking, deep linking, or otherwise modifying its contents is expressly prohibited, unless prior written permission has been granted by SHIORI or the appropriate copyright owner. All other rights reserved.

The names, logos, trademarks, and service marks of SHIORI and/or ………………. and/or …………………. that appear on this site may not be used in any advertising, publicity, promotion, or in any other manner implying SHIORI’s endorsement, sponsorship of, or affiliation with any product or service, without SHIORI’s prior express written permission.

Disclaimer
The materials contained in this Website are provided for information purposes only and SHIORI makes no representations, claims, promises warranties or undertakings about the accuracy, completeness or adequacy of the information on this Website.

Except as required by law, SHIORI does not accept any responsibility and shall not be liable for any damages (direct, indirect, incidental, special, consequential or exemplary), resulting from use of this Website. This includes but is not limited to damages (for loss of profits, goodwill, use, data or other intangible losses) resulting from the use or the inability to use the Website or its contents or from any interruption or delay in access to the Website for whatever reason.

Security
The internet is not a secure medium. SHIORI is committed to ensuring that any information you provide through this Website is as secure as possible. To prevent unauthorised access or disclosure SHIORI has in place suitable physical, electronic and managerial procedures to safeguard and secure the information collected online through this Website.

Cookies 
The Website uses cookies to monitor browsing preferences. A cookie is a small file of letters and numbers that is sent to your browser and stored on the hard drive of your computer (or internet enabled device) when you visit a website. Cookies can be used to recognize repeat users, facilitate the users’ ongoing access to and use of the website and allow a website to track usage behavior and compile aggregate data that will allow content improvements and targeted advertising. If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to deny or accept the cookie feature.

Representations

By using the Website and/or placing any order through the Website, you represent and warrant that:

  • You are at least 18 years old; and
  • You have the legal right to use any credit or debit card or other payment method in connection with any purchase; and
  • that the information supplied to us is true, correct and complete in all respects.

Changes/Modifications

We may change/modify or update these terms from time to time so please check this page regularly and remember to check the Terms and Conditions before you shop with us.

Governing law

These Terms and Conditions are governed by the laws of the Republic of Cyprus, the courts of which shall have exclusive jurisdiction over any disputes arising hereunder or from use of the Website.

Enquiries
If you have any enquiries about our terms or suggestions on how we can improve our Website or if you have any problems accessing the Website, you may contact us at: SHIORI …………………………

………………………………….

………………………………….

SHIORI TRADING LTD (“SHIORI”)

PRIVACY POLICY

SHIORI its officers and employees are committed to the maintenance of your privacy and the proper handling of your personal data. Hence, our privacy policy complies with GDPR regulations and guidelines.

This Private Policy Notice aims at informing you in a nutshell of the personal information we collect, how we collect it and how we process it.

The personal information we collect relates to an identified or identifiable natural person and includes name, address, birth date, place of birth, identification number.

The personal information shall be collected directly from you and it may be hard copy or electronic. We may also collect and process personal data from publicly available sources, such as governmental agencies, the internet, or the press.

At the time or prior to collecting personal information, we inform you of the reason and purposes of collection.

We acknowledge that safeguarding the privacy of children/minors is of particular importance and confirm that any personal data concerning children will be collected only to the extent necessary and provided that we obtained the consent of the parents/guardians of such children or otherwise permitted by applicable law.

Therefore the processing of the personal information that is collection, recording, organization, storage, disclosure, transmission, erasure or destruction is made only with the objective of fulfilling the purposes of the business of SHIORI.

For any other purpose, we obtain the consent of the individual concerned or guardian or act as required by law for example for the safeguard of legitimate interests.

We may transmit your personal data in the context of us providing the agreed services to you or in accordance with statutory obligations imposed on ourselves and/or the third-party recipients.

We protect personal information by reasonable security safeguards against loss or theft, as well as unauthorized access, disclosure, copying, use or modification.

You have the right to request access to, rectification or erasure of your personal data held by us, to obtain restriction of processing or to object to their processing, to receive a copy of your personal data held by us and the right to lodge a complaint.

We will publish online any updates or amendments to this Notice as may be necessary.

Any enquiries, requests or concerns regarding this Notice or relating to the processing of your personal data should be addressed to ………………… (DPO).