Privacy Policy and Cookie Disclaimer — BGS Group
General Provisions
1. This Policy is published as part of the Company’s commitment to complying with applicable data protection legislation and ensuring transparency. Its purpose is to inform the Company’s counterparties, suppliers and partners, as well as their representatives, about the categories of personal data processed and the purposes of such processing.
2. The terms used in this policy are to be understood in accordance with their meanings as defined by applicable legislation. Where the law does not provide a specific definition, the generally accepted interpretation of the term shall apply.
3. This Policy applies to all Personal Data Processed by «BGS Group LLC», a company registered in the Sharjah Media City (Shams) Free Zone (the “Company” or the “Controller”).
4. This Policy applies to relationships involving the Processing of Personal Data that arose with the Company both before and after the approval of this Policy.
5. The Company’s rights and obligations as a Controller. In its capacity as a Controller, the Company exercises the following key rights and fulfils the following key obligations:5.1. to determine the purposes and means (methods and criteria) of Processing;
5.2. to process Personal Data without Consent in cases expressly provided for by applicable legislation;
5.3. to carry out Cross-Border Transfers of Personal Data in the cases and in accordance with the procedures provided for by applicable legislation;
5.4. to process Personal Data in accordance with the requirements and control mechanisms provided for by applicable legislation; b) to appoint a Processor and require the Processor to provide sufficient guarantees regarding the implementation of technical and organizational measures;
5.5. to maintain a special record of Personal Data;
5.6. to provide Data Subjects with clear and appropriate means of contacting the Controller and respond to their requests aimed at exercising their rights;
5.7. to take appropriate technical and organizational measures to ensure the security of Personal Data.
6. The main rights of the Data Subject:
6.1. Right to Receive Information. The Data Subject has the right to obtain clear information regarding the types of Personal Data being processed, the purposes of Processing, the recipients or sectors with whom the data is shared, the storage periods, and any Cross-Border Transfers.
6.2. Right to Correct, Erase, Restrict, or Object to Processing. The Data Subject has the right to request the correction of inaccurate Personal Data or the completion of incomplete data.
6.3. Rights Regarding Automated Processing and Profiling.The Data Subject has the right to object to any decisions resulting from Automated Processing, including Profiling, particularly those decisions that have a legal impact on or significantly affect the Data Subject.
6.4. Right to Contact and Submit Complaints.The controller is obliged to provide clear means of communication, and the data subject has the right to lodge a complaint with the competent authorities in the event of a breach of their rights.
Purposes of Personal Data Collection
7. The Processing of Personal Data is limited to the achievement of specific, explicit, and legitimate purposes. Processing of Personal Data that is incompatible with the purposes of collecting Personal Data is not permitted.Personal Data is processed only to the extent necessary for the respective purpose and is not further processed in a manner incompatible with that purpose.
8. The purposes of Processing Personal Data arise from the purposes of the Company’s actual activities, as well as from the purposes of activities provided for by the Company’s constituent documents and specific business processes of the Company. These include:
8.1. activities related to the organization of fairs, exhibitions, conferences, congresses, including the preparation, conduct and ensuring the participation of Data Subjects in fairs, exhibitions, conferences, congresses and other business events organized by the Company;
8.2. promotion of goods, works and services, including direct marketing activities, carried out for specific products or services and through specified communication channels;
8.3. preparation, conclusion and performance of civil law contracts;
8.4. maintenance of HR and payroll records and recruitment of personnel (applicants) for vacant positions, limited to what is necessary for the employment relationship and related legal obligations;
8.5. ensuring the completion of introductory, industrial or pre-graduation internships based on agreements with educational institutions;
8.6. formation of reference materials for the internal information support of the Company’s activities;
8.7. ensuring access control to the Company’s territory.
Legal Grounds for Processing Personal Data
9. The legal basis for Processing Personal Data is the set of legal acts and circumstances in accordance with and pursuant to which the Company Processes Personal Data. The Company processes Personal Data only where one of the following legal grounds applies:
9.1. Consent. It means the authorisation by the Data Subject of a third party to process his/her Personal Data, provided that it indicates, in a specific, clear and unambiguous manner, that he/she accepts such Processing through a clear positive statement or action. The Company recognises
9.2. Consent where it is given in writing or electronically, or through another clear affirmative statement or action, provided that it is clear, simple, unambiguous and easily accessible. Silence, inactivity or pre-ticked boxes do not constitute Consent. Before obtaining Consent, the Company informs the Data Subject of the identity of the Controller, the purposes of Processing, the categories of Personal Data concerned, the recipients or categories of recipients (if any), and the right to withdraw Consent at any time. Consent is obtained for specific purposes. The Data Subject may withdraw Consent at any time, without affecting the lawfulness of Processing based on Consent before its withdrawal; the Company provides a simple and accessible withdrawal mechanism.
9.3. Without Consent, the Company processes Personal Data only where one of the following grounds applies:
9.3.1. Performance of a contract. The Processing is necessary to perform a contract to which the Data Subject is a party, or to take measures at the request of the Data Subject with the aim of concluding, amending or terminating a contract.
9.3.2. Compliance with legal obligations. The Processing is necessary to fulfil specific obligations stipulated in other laws in force in the State for the Controller (e.g., tax, accounting, or anti-money laundering requirements).
9.3.3. Employment, social security or social protection. The Processing is necessary for the purposes of the Controller or Data Subject carrying out their obligations and exercising their legally established rights in the field of employment, social security or laws concerned with social protection, to the extent permitted by such Laws.
9.3.4. Publicly available data. The Processing is related to Personal Data which has become available and known to all by an act of the Data Subject (e.g., contact details published by the Data Subject on their own website for the purpose of being contacted).
Scope and Categories of Processed Personal Data, Categories of Data Subjects
10. The content and scope of Personal Data Processed by the Company correspond strictly to the purposes of Processing stated in this Policy. The Company does not Process Personal Data that is excessive or incompatible with the stated purposes. Depending on the purpose, the Company Processes the categories of Personal Data set out in the table below in relation to the respective Data Subjects.
|
Purpose of Processing |
Categories of Personal Data |
Categories of Data Subjects |
|
Organizing fairs, exhibitions, conferences, congresses and other business events (including preparation, conduct, and ensuring participation) |
Full name; contact details (e-mail, phone number); job title; profession; organization name; education details (where provided for the programme); identity document data (where required for accreditation or visa support); photo/video image (for badge issuance or event coverage); data collected through event registration or metric programs |
Participants; speakers; exhibitors; sponsor representatives; clients; counterparties; legal representatives; beneficiaries under contracts; website visitors |
|
Promoting goods, works and services, including direct marketing activities |
Full name; contact details (e-mail, phone number); job title; profession; gender; education details; data collected through metric programs; photo/video image (where used in promotional materials with Consent) |
Clients; counterparties; representatives of counterparties; legal representatives; beneficiaries under contracts; website visitors |
|
Preparing, concluding and performing civil law contracts |
Full name; contact details; identity document data; date of birth; citizenship; residential/registration address; Tax Identification Number (TIN); bank account details; job title; profession; photo/video image; |
Clients; counterparties; legal representatives; beneficiaries under contracts; representatives of counterparties |
|
Maintaining HR and payroll records and recruitment of personnel |
Full name; date of birth; citizenship; identity document data; contact details; residential/registration address; Tax Identification Number (TIN); Social Insurance Number; bank account details; education details; employment details (work experience, current employment data); marital status; data contained in the birth certificate; photo/video image; data necessary for related legal obligations |
Employees; applicants; former employees; relatives of employees (limited to data necessary for emergency contacts or benefits); website visitors |
|
Ensuring the completion of internships based on agreements with educational institutions |
Full name; date of birth; contact details; identity document data; education details; profession; employment details |
Trainees; students; applicants |
|
Forming reference materials for internal information support of the Company’s activities |
Full name; job title; profession; organization name; education details; professional contact details (e-mail, phone number) |
Employees; clients; counterparties; representatives of counterparties; legal representatives |
|
Ensuring access control to the Company’s territory |
Full name; job title; organization name; photo/video image (for badges) |
Employees; applicants; trainees; students; clients; counterparties; representatives of counterparties; legal representatives; beneficiaries under contracts; relatives of employees |
11. Special Categories of Data. The Company does not intentionally Process Sensitive Personal Data or Biometric Data.
12. The Company does not carry out Automated Processing, including Profiling, and does not make decisions based solely on Automated Processing that produce legal effects concerning the Data Subject or similarly significantly affect the Data Subject.
Procedure and Conditions for Processing Personal Data
13. General Principles. The Company Processes Personal Data in a fair, transparent and lawful manner, strictly for specific, explicit and legitimate purposes, and does not Process data in a way that is incompatible with those purposes. The Company ensures that Personal Data is adequate, relevant and limited to what is necessary for the respective purpose. The Company takes all reasonable steps to ensure that inaccurate Personal Data is erased or corrected without undue delay.
14. Storage Limitation. The Company does not keep Personal Data for longer than is necessary for the purpose for which it was collected. Once the purpose of Processing is exhausted, the Company erases the Personal Data or anonymises it in accordance with applicable legislation.
15. Security Measures. The Company implements appropriate technical and organizational measures to protect Personal Data, including, where appropriate, encryption, pseudonymisation, ensuring the ongoing confidentiality, integrity and availability of systems and services, and regularly testing and evaluating the effectiveness of such measures.
16. Notification of a personal data breach. In the event of a personal data breach, the Company shall, without undue delay, notify the competent authority and the data subjects concerned, providing a description of the nature of the breach, its potential consequences, and the measures taken or proposed to remedy the situation.
17. Processors. The Company appoints Processors only where they provide sufficient guarantees to implement appropriate technical and organizational measures. Processors act strictly on the Company’s instructions and in accordance with a written contract that defines the scope, purpose, nature and duration of Processing, as well as the obligations of both parties.
18. Data Protection Impact Assessment. Where the Company intends to carry out Processing that is likely to result in a high risk to the privacy and confidentiality of Personal Data (including large-scale Processing of Sensitive Personal Data or systematic Profiling), it conducts a Data Protection Impact Assessment before commencing such Processing.
19. Data Protection Officer. The Company appoints a Data Protection Officer where required by applicable legislation.
20. Cross-Border Transfer. The Company carries out Cross-Border Transfers of Personal Data only where a legal ground applies and in accordance with applicable legislation. In particular, the Company transfers Personal Data outside the State only where:
20.1. the recipient country or territory ensures an adequate level of protection for Personal Data, as recognised under applicable legislation; or
20.2. appropriate safeguards are in place, including contractual clauses or other legally binding instruments; or
20.3. another legal ground applies, such as the Data Subject’s explicit Consent, necessity for the performance of a contract, or protection of public interest.
21. Personal Data may be disclosed only where a lawful basis exists, to the following categories of recipients, including but not limited to: authorised employees and contractors/processors; competent government authorities upon lawful request; banks and financial institutions for contract performance; IT service providers and marketing agencies acting as processors under written contract; and any other categories identified in the Company’s internal records.
Updating, rectifying, erasing and destroying personal data; responding to data subjects’ requests for access to data
22. Scope of application and procedure for submitting requests. Requests must be sent by email to the address specified in the ‘Contact Information’ section on the Company’s official website. The Company reserves the right to request additional information to verify the data subject’s identity before considering the request.
23. Response times. The Company shall respond to the request within forty-five (45) working days of receipt.
24. Action taken in response to a request. The Company shall rectify, supplement, erase or restrict the processing of Personal Data in accordance with clauses 13 and 14 of this Policy and applicable legislation, and shall confirm the actions taken to the Data Subject. Where the Company is unable to delete the data (for example, because it must be retained to fulfil a legal obligation), it shall restrict the processing.
25. Refusal. The Company may refuse to comply with a request only on grounds permitted by applicable law, and shall inform the data subject of the reasons for the refusal.