Privacy policy

PERSONAL DATA PROCESSING RULES

1. GENERAL PROVISIONS

  1. 1.1 The personal data processing rules described below apply to the personal data whose processing is entrusted to Omni Tech by the Service Recipient for the purpose of the provision of the Services by Omni Tech described in the General Terms and Conditions of Service Provision1.
  2. 1.2 The processing of personal data in connection with the performance of the Services is subject to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the „GDPR”).
  3. 1.3 For the purpose of performing the Agreement, the Service Recipient entrusts to Omni Tech the following personal data for processing:
Categories of data subjectsType of personal data
Users, employees, and associates of the Service Recipientfirst name, surname, e-mail address
clients and contractors of the Service Recipientfirst name, surname, e-mail address
Service Recipients (if natural persons)First name, surname, address, e-mail address
  1. 1.4 Data are processed within the territory of the European Economic Area. Omni Tech will not transfer personal data outside the territory of the European Economic Area, unless it obtains a separate authorization from the Service Recipient in this regard, which the Service Recipient shall not refuse without justified reasons, and such transfer is carried out in accordance with the provisions of the GDPR. In each case, the transfer shall be made solely for the purpose of performing the Services.
  2. 1.5 Omni Tech processes personal data solely for the purpose of performing the Services and to the extent necessary for their performance, and only for the duration of the Agreement.

2. OBLIGATIONS OF THE PARTIES

  1. 2.1 Omni Tech is obliged to:
    1. 2.1.1 apply all technical and organizational measures adequate to the level of risk to secure personal data, on the terms set out in Article 32 of the GDPR;
    2. 2.1.2 assist the Service Recipient in fulfilling the obligations set out in Articles 32–36 of the GDPR, taking into account the nature of the processing and the information available to Omni Tech;
    3. 2.1.3 process personal data solely on the documented instructions of the Service Recipient, unless required to do so by applicable national or EU law; in such case, before commencing the processing, Omni Tech shall inform the Service Recipient of that legal obligation, unless such law prohibits the provision of such information on important public interest grounds;
    4. 2.1.4 assist the Service Recipient, insofar as possible, by appropriate technical and organizational measures, in fulfilling the obligation to respond to requests from data subjects exercising their rights set out in Chapter III of the GDPR;
    5. 2.1.5 ensure that persons authorized to process personal data undertake to maintain confidentiality, unless they are already bound by a statutory duty of confidentiality;
    6. 2.1.6 after the completion of the provision of the Services, at the Service Recipient’s request, delete or return the personal data and delete any copies thereof, unless mandatorily applicable law provides otherwise.
  2. 2.2 Omni Tech is entitled to further sub-entrust the processing of personal data to sub-processors providing services to it, including, in particular, providers of hosting, cloud, and other digital services, such as Hetzner Online GmbH (Ansbach Registration Office: HRB 6089) and Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland).
  3. 2.3 Omni Tech shall inform the Service Recipient of any intended change to the list of sub-processors in the manner adopted for communication under the General Terms and Conditions of Service Provision. The Service Recipient may object to such a change within the following 7 days.
  4. 2.4 Omni Tech ensures that it will use only sub-processors that provide sufficient guarantees to implement appropriate technical and organizational measures so that the processing meets the requirements of the GDPR and protects the rights of data subjects. Omni Tech is obliged to ensure that the sub-processors are subject to at least the same obligations as those imposed on Omni Tech. The Service Recipient acknowledges that failure to consent to a change to the list of sub-processors may result in the inability of Omni Tech to continue providing the Services, of which Omni Tech shall inform the Service Recipient without delay.
  5. 2.5 Omni Tech shall provide the Service Recipient with the information necessary to perform its obligations related to the entrustment of personal data processing. Omni Tech shall enable the Service Recipient to carry out audits, including inspections, relating to the entrustment of personal data processing, and shall provide cooperation in this regard. Each party shall bear its own audit costs, regardless of the outcome.
  6. 2.6 Omni Tech is entitled to authorize persons acting on its behalf, including sub-processors, to process personal data on behalf of the Service Recipient, including to issue instructions to such entities, on behalf of the Service Recipient, regarding the processing of personal data.

3. ORGANIZATIONAL AND TECHNICAL MEASURES

  1. 3.1 Omni Tech implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk of infringement of the rights or freedoms of natural persons whose personal data are processed in connection with the provision of the Services.
  2. 3.2 In assessing whether the level of security referred to in point 3.1 is adequate, Omni Tech takes into account the risks associated with the processing, in particular those arising from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data transmitted, stored, or otherwise processed.
  3. 3.3 In implementing the organizational and technical measures referred to above, Omni Tech:
    1. 3.3.1 shall comply with the Service Recipient’s guidelines regarding the manner of securing personal data processing operations in accordance with applicable law, provided that such guidelines may not extend the obligations of Omni Tech set out in the General Terms and Conditions of Service Provision;
    2. 3.3.2 shall take into account the state of the art, the cost of implementation, and the nature, scope, context, and purposes of the processing, as well as the risk of infringement of the rights or freedoms of natural persons whose personal data it will process, taking into account the likelihood and severity of that risk.
  4. 3.4 If it is determined that the measures applied may be inadequate to the identified risks, Omni Tech shall inform the Service Recipient thereof and, in agreement with the Service Recipient, shall adjust the personal data processing safeguards accordingly, after the parties have agreed on the scope, manner, and timing of such actions and the allocation of the related costs.
  5. 3.5 If the Service Recipient determines that additional security measures are necessary, the parties shall agree on the scope, manner, and timing of their implementation, as well as the allocation of implementation costs.

4. REPORTING OF BREACHES

  1. 4.1 Omni Tech applies procedures for detecting personal data breaches and implementing appropriate remedial measures.
  2. 4.2 Upon determining a personal data breach, Omni Tech shall, without undue delay and no later than within 48 hours, report it to the Service Recipient, informing it of the circumstances of the breach and the potential risks to the protection of personal data.
  3. 4.3 Omni Tech shall, without undue delay, take all reasonable steps to limit and remedy the negative effects of the breach.
  4. 4.4 Omni Tech is neither entitled nor obliged to notify the breach to:
    1. 4.4.1 data subjects,
    2. 4.4.2 the supervisory authority.

5. OTHER PROVISIONS

  1. 5.1 The personal data processing rules described in this document apply throughout the entire period of the provision of the Services.
  2. 5.2 The Service Recipient may demand the immediate cessation of the processing of personal data by Omni Tech, with immediate effect, in the event of a gross or repeated breach of these personal data processing rules, the GDPR, or other applicable laws by Omni Tech, provided that Omni Tech has first been called upon to remedy the breaches, an additional deadline of no less than 7 days has been set for that purpose, and that deadline has expired without effect.
  3. 5.3 Omni Tech reserves the right to amend the personal data processing rules at any time.
  4. 5.4 The Service Recipient shall be informed of any change to the personal data processing rules with appropriate advance notice (no less than 14 (fourteen) days) by publication of the new personal data processing rules on the website and, if possible, by e-mail. Unless a longer period is indicated in the notice of the change to the personal data processing rules, the amended rules shall become binding on the Service Recipient upon the expiry of 14 (fourteen) days from the notification of the change.
  5. 5.5 A Service Recipient who does not accept the changes to the personal data processing rules has the right to terminate the agreement for the provision of Services, in documentary form, before the effective date of the changes. Failure to terminate the agreement shall constitute acceptance of the new personal data processing rules.
  6. 5.6 All disputes related to the Agreement shall be resolved by the court having jurisdiction in accordance with the General Terms and Conditions of Service Provision.
  7. 5.7 All correspondence in matters related to the provision of the Services shall be conducted by the persons and in the manner described in the General Terms and Conditions of Service Provision.