Data Protection Policy

CONTENTS

1. Introduction

This Data Protection Policy (a) applies to the Processing of Personal Data by electronic means and in paper-based filing systems, (b) excludes any processing of Personal Data of employees, candidates of the Company, and (c) does not address obligations yourdiet.guru may be subject to under local laws and other applicable regulatory laws.

This Data Protection Policy enters into force on 25 May 2018. Until then, all yourdiet.guru personnel will make all necessary actions to abide by it.

THE OBSERVANCE AND CORRECT APPLICATION IN PRACTICE OF THIS DATA PRIVACY COMPLIANCE POLICY WILL BE STRICTLY MONITORED BY THE COMPANY. INTENTIONAL, NEGLIGENT OR ACCIDENTAL NON-OBSERVANCE OF THIS DATA PRIVACY COMPLIANCE POLICY MAY RESULT IN SIGNIFICANT FINANCIAL AND REPUTATIONAL LOSSES FOR yourdiet.guru AND, POSSIBLY, DISCIPLINARY CONSEQUENCES FOR THE RESPONSIBLE yourdiet.guru EMPLOYEES.

1. EU Data Protection Laws impose the Company the full observance of the following principles:

2. Data Protection Compliance starts with every person making the personnel of yourdiet.guru. (“yourdiet.guru ” and/or the “Company”).

3. yourdiet.guru personnel is expected to handle Personal Data with care. In this Data Protection Compliance Policy, it is explained how the protection of Personal Data must be achieved throughout the Company. The following main directions are mandatory and explained in this document:

• I only process Personal Data for specific Purpose(s) of Processing. I know that the Purpose of Processing has a valid lawful basis,

• I am transparent with Data Subjects. I am always informing natural persons in what the Company does with Personal Data (regardless of the natural person being a client, a supplier or any other business partner). The fact that I obtain Personal Data of a natural person representing a legal person or which is acting as an employee of a legal person does not make that Personal Data less important or outside data protection area,

• I only use Sensitive Personal Data if necessary and where expressly allowed,

• I make sure that Personal Data are up-to-date, complete and accurate,

• I treat seriously any request regarding Personal Data. I allow Data Subjects to correct, delete or block their Personal Data,

• I protect the Personal Data from unauthorized loss, alteration, disclosure or access.

4. This Data Protection Policy was drafted based on the letter of GDPR as at the time of its drafting no local law was enacted. Any regulatory development (either at EU or national level) may trigger the need to amend or supplement this policy.

2. TERMINOLOGY

5. Throughout this Data Protection Policy, the following terms will have the following meaning:

3. yourdiet.guru’S PURPOSES OF PROCESSING

• yourdiet.guru has an inventory of the Purposes of Processing currently applicable to the Company,

• The Purposes of Processing are exhaustively mentioned in the yourdiet.guru Records of Processing (kept by the Data Protection Officer),

• Each Purpose of Processing has a legal valid basis and is directly linked with the business activities of the Company,

• The Purposes of Processing constitute the starting point for each activity of Processing and any deviation or amendment to them will be immediately notified to the Data Protection Officer,

• Processing of Personal Data (collection, use, storage etc.) is to be done in strict compliance with the Purpose of Processing.

1. yourdiet.guru has identified specific Purposes of Processing

6. Generally, the Company collects, uses, stores or otherwise Processes Personal Data in the following ways:

1. when Data Subject submits any form or document, enters into a formal agreement or provides other documentation or information in respect of its interactions and commercial relationship with yourdiet.guru;

2. when Data Subject interacts with yourdiet.guru personnel, including customer service officers, relationship personnel and other representatives, for example, via telephone calls, letters, fax, face-to-face meetings and email;

3. when Data Subject’s images are captured by yourdiet.guru via CCTV cameras while Data Subject is within the Company’s premises;

4. when Data Subject uses yourdiet.guru services provided through online and other technology platforms;

5. when Data Subject requests that yourdiet.guru contact him, be included in an email or other mailing list; or when Data Subject responds to yourdiet.guru’s request for additional Personal Data;

6. when Data Subject uses the Company’s electronic services, or interact with yourdiet.guru via our websites;

7. when yourdiet.guru carries out checks, due diligence or other screening activities (including background checks) in accordance with legal or regulatory obligations or the Company’s risk management procedures that may be required by law or that may have been put in place by yourdiet.guru;

8. when yourdiet.guru acts on preventing or investigating any fraud, unlawful activity or omission or misconduct relating to Data Subject’s relationship with yourdiet.guru or any other matter arising from Data Subject’s relationship with yourdiet.guru,

9. yourdiet.guru will collect your e-mail address to send you “transactional emails” with the product if you decide to buy it. If you agree to subscribe to the service newsletter, we will, from time to time, send free commercial marketing, content and promotional materials to your email address;

10. when yourdiet.guru is complying with or as required by any request or direction of any public authority; or responding to requests for information from regulatory agencies, ministries, statutory boards or other similar authorities,

11. when yourdiet.guru performs financial reporting, regulatory reporting, management reporting, risk management reporting (including monitoring risk exposure) audit reporting,

12. when yourdiet.guru seeks information about Data Subject and receive Data Subject’s Personal Data in connection with its relationship with yourdiet.guru, from business partners, public agencies, current - employer and the relevant authorities; and/or

13. when Data Subject submits its Personal Data or the Personal Data of a third party (e.g. information on spouse, children, parents, and/or employees etc.) to yourdiet.guru for any other reason.

7. All the above activities are labelled as Purposes of Processing and are listed in the yourdiet.guru Records of Processing.

2. yourdiet.guru’s Purpose of Processing have a lawful and valid basis

8. yourdiet.guru’s Purposes of Processing are grounded on one of the following basis:

9. The basis for each yourdiet.guru’s Purpose of Processing is mentioned in yourdiet.guru Records of Processing.

3. The Processing is limited to only what is necessary for achieving the yourdiet.guru’s Purpose of Processing

1. yourdiet.guru’s Purposes of Processing are limited to certain categories of Data Subjects and to certain categories of Personal Data (data minimization)

10. Internal Regulations list the documents and thus the exact Personal Data that is to be requested from Data Subject and to be processed in respect of that Data Subject. On one hand, the appendices to the Internal Regulations enlist the template forms and the template contracts that have to be filled in and/or signed by the Data Subject. On the other hand, the Internal Regulations allow the Personal Data to be collected by word of mouth directly from the Data Subject and introduced directly in the IT system of yourdiet.guru.

11. The Purposes of Processing refer to Personal Data which is not included in the category of „Special Categories of Personal Data” nor in the category of „Personal Data relating to criminal convictions and offences“, as these terms are defined in Section 2 of this policy.

12. Processing that entails „Special Categories of Personal Data” and/or „Personal Data relating to criminal convictions and offences“ is to be treated as an exception and is to be avoided for as much as possible (except if expressly required by an Internal Regulation or the provisions of a law).

13. Any supplementary Personal Data, outside the Personal Data specifically mentioned in the yourdiet.guru Records of Processing and outside the Personal Data mentioned in the Internal Regulations, cannot be requested from Data Subjects unless with prior authorization from the supervisory manager and/or the Data Protection Officer.

14. Any supplementary Personal Data, outside the Personal Data specifically mentioned in the yourdiet.guru Records of Processing and outside the Personal Data mentioned in the Internal Regulations, which reaches the Company (either intentional or accidentally), from other source than Data Subject, is to be treated as a data privacy incident and brought to the attention of the Data Protection Officer.

2. Personal Data collected by yourdiet.guru is accurate, integral and confidential (accuracy and confidentiality)

15. All Personal Data collected by yourdiet.guru in relation to any Purpose of Processing must be accurate. Internal Regulations require that yourdiet.guru personnel makes sure that the Personal Data obtained directly from Data Subjects or indirectly is verified against relevant documentation.

16. The integrity and the confidentiality of all Personal Data collected by yourdiet.guru in relation to any Purpose of Processing is mandatory at all times. Internal Regulations require that yourdiet.guru personnel makes sure that the Personal Data obtained directly from Data Subjects or indirectly is safely stored and accessed only on a need to know basis.

3. Processing of Personal Data within yourdiet.guru is performed for the period needed to fulfil the Purpose of Processing (storage limitation)

17. Depending on the Purpose of Processing, Personal Data collected by yourdiet.guru is kept in either hard-copy or electronic form (or both):

    1. for the time needed to accomplish the Purpose of Processing, or

    2. to the extent necessary to comply with an applicable legal requirement for the time mentioned by a law provision, or

    3. as advisable in light of an applicable statute of limitations.

18. yourdiet.guru sets and implements retention period of documents (regardless of their form and title which may contain or not Personal Data).

19. All personnel needs to analyze the Personal Data stored by them against the decided retention periods and decide to maintain or erase Personal Data accordingly.

4. Processing outside the yourdiet.guru’s Purposes of Processing is generally forbidden (change of purpose)

20. Generally, Personal Data will be used only for the Purpose(s) of Processing for which it was originally collected (original purpose). Personal Data may be Processed for legitimate purposes of yourdiet.guru different from the original purpose (secondary purpose) only if the original purpose and secondary purpose are closely related.

21. It is generally permissible to use Personal Data for the following secondary purposes:

1. establishing the risk profile of the Data Subject or the company which the Data Subject represents, or

2. internal audits or investigations; or

3. dispute resolution or litigation; or

4. regulatory reporting purposes.

22. Any Processing of Personal Data outside the Purposes of Processing specifically established in the yourdiet.guru Records of Processing will be immediately suspended and the situation will be brought to the attention of the Data Protection Officer as soon as possible.

23. Any change in the original Purpose of Processing will be assessed carefully and in case of doubt, yourdiet.guru’s personnel will bring the matter to the attention of Data Protection Officer, before executing any further processing.

5. Transfer of Personal Data

24. While rendering its services, the Company can transfer data to other country or international/foreign organizations but only if in that country or international/foreign organizations data security is guaranteed appropriately.

25. When transferring Personal Data to a state outside European Economic Area, the Company provides adequate guarantees of data protection on the basis of a contract concluded with that legal or physical person or international organization.

6. Profiling and Automated Data Decision Making

26. Processing in yourdiet.guru may involve profiling, automated decision making or both in case of:

1. risk management purpose analyses with the view to ensure the security and reliability of the debt recovery process or to prevent and filter out fraud,

2. periodic automatic review of the Data Subject’s payments.

27. In all such cases, yourdiet.guru will observe the rights of Data Subjects, as mentioned under the following section.

4. yourdiet.guru ENABLES THE DATA SUBJECTS’ RIGHTS

Under Data Protection Laws. Data Subjects have strict rights:

• the right to be informed,

• the right of access,

• the right to rectification,

• the right to erase (right to be forgotten),

• the right to restrict processing,

• the right to data portability,

• the right to object,

• rights in relation to automated decision making and profiling.

All yourdiet.guru personnel is aware and know how to react to any exercise of the Data Subjects’ rights.

1. yourdiet.guru informs the Data Subjects of the Processing activity

28. As a rule, documents that are given to Data Subject (either forms or contracts) contain all the required information for yourdiet.guru to observe the Company’s obligations to duly inform the Data Subjects of the Processing Activity.

29. Notwithstanding the letter of the documents given to Data Subjects, upon request, yourdiet.guru personnel will explain thoroughly to what business activity is the Processing related to, what type of Personal Data is requested from the Data Subject, and that Company has set-up appropriate organizational and technical measures to ensure that Personal Data is kept safe and confidential.

30. In case the Data Subjects are not required to fill in independently forms as Data Subjects are only required to submit certain documentation or to give their Personal Data verbally, yourdiet.guru personnel will have the obligation to inform the Data Subject of all the coordinates of the Processing activity. The checklist of the aspects that need to be brought to the attention of the Data Subject are the following:

31. In case of profiling and/or automated decision making, yourdiet.guru will ensure the observance of the Data Subject’s rights:

1. duty to inform – Data Subject shall be informed, upon the commencement of data processing, of the fact of profiling/automated decision-making, the range of his/her Personal Data involved in profiling, the logic involved in the method applied and the possible consequences of automated decision-making on the Data Subject.

Where a decision can be delivered in a process either entirely as a result of an automated sub-process or also with human intervention, the Data Subject must then be informed of the cases where the Company can make decision entirely by automated means (as a result of a sub-process).

When informing about the logic the automated decision-making is based on, it is not necessary to disclose in detail the algorithm, formula or business rationale applied (this information need not to be so in-depth as to compromise the Company’s business secrets). It is suggested to present the operation of automated decision-making by using examples.

2. revision of automated decisions: The Data Subject subjected to an automated decision-making is entitled to request human intervention from the yourdiet.guru, to make his/her position known and submit an objection against that decision. This right to challenge does not entitle the Data Subject to force the conclusion of the contract, but to dispute the decision based on automated data processing leading to the rejection of concluding the contract.

The Data Subject must be granted the opportunity in any case to avail of his/her right to make an objection.

3. the right to object: if the legal basis for Processing is a legitimate interest of yourdiet.guru, the Data Subject is entitled to the right to object. It follows from the right to object that the Company must examine whether this objection is justified (i.e. whether the Data Subject’s interests override the Company’s interests) and decide on the objection.

2. yourdiet.guru personnel recognises and knows how to deal with a request from Data Subjects

32. EU Data Protection Laws impose that any Data Subject request is responded as soon as possible but no later than 30 days from receipt.

33. yourdiet.guru employees will treat with the utmost importance all enquiries from Data Subjects about the Processing activity.

34. In all cases, yourdiet.guru employees will inform Data Subjects that they may submit a formal request and/or a complaint to the designated address, representing the contact details of the DPO appointed by the Company.

5. FOSTERING DATA PROTECTION COMPLIANCE IN yourdiet.guru

1. Data Protection Officer appointed by yourdiet.guru

35. The Company appoints a Data Protection Officer that fulfils the required skills profile as defined in the EU Data Protection Laws:

1. Data Protection Officer function is established as a position directly subordinated and in direct reporting line to Top Management;

2. Data Protection Officer function is not subject to conflicting interests;

3. yourdiet.guru involves Data Protection Officer properly and in a timely manner in all issues which relate to the protection of Personal Data;

36. Company shall:

1. publish the contact details of the Data Protection Officer to Data Subjects and also internally on Company’s intranet, internal telephone directory, and organizational charts to ensure that his or her existence and function is known within the organization;

2. communicate the contact details to the competent supervisory authority;

3. make sure that Data Protection Officer is invited to participate regularly in meetings of senior management;

4. always give a due weight to Data Protection Officer´s opinion. In case of disagreement it is important to document the reasons for not following the Data protection Officer’s advice;

5. promptly and without undue delay consult the Data Protection Officer once a data breach or other incident has occurred;

6. support Data Protection Officer by ‘providing resources necessary to carry out his/her tasks and access to Personal Data and processing operations, and to maintain his or her expert knowledge’.

7. provide the Data Protection Officer with regular training. Data Protection Officer will be given the opportunity to stay up to date with regard to developments within data protection. The aim should be to constantly increase the level of expertise of Data Protection Officer, he/she should be encouraged to participate in training courses on data protection and other forms of professional development, such as participation in privacy fora, workshops, etc.;

8. ensure that the Data Protection Officer ‘does not receive any instructions regarding the exercise of his or her tasks’.

37. Data Protection Officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks.

2. Internal roles dedicated to Data Protection Compliance at business departments’ level

38. Data protection compliance is a continuous independent responsibility for each and every employee of the Company and failure to observe this policy may lead to professional liability.

3. Internal Regulations

39. As a general statement, this Data Protection Policy supplements all existing policies. In case of any discrepancies within this Data Protection Policy and EU Data Protection Laws, the latter shall prevail.