THE OPERATOR'S POLICY ON THE PROCESSING OF PERSONAL DATA

1. GENERAL PROVISIONS

1.1. This Operator's policy on the processing of personal data (hereinafter — the Policy) has been drawn up in accordance with the Constitution of the Republic of Azerbaijan, with Law of the Republic of Azerbaijan No. 998-IIIQ of 11 May 2010 “On Personal Data” (hereinafter — the Law) and with other regulatory legal acts.

1.2. This Policy sets out the procedure for the collection, processing, accumulation, storage, transfer and protection of personal data at the company “GPS Solutions” MMC (hereinafter — the Operator) when users make use of the gps.az web resource.

1.3. The purpose of the Policy is to secure the protection of the rights and freedoms of the individual and the citizen in the processing of their personal data, including the protection of the rights to the inviolability of private life and to personal and family secrets, and also to establish the liability of officials who have access to personal data for failure to meet the requirements of the rules governing the processing and protection of personal data.

1.4. Requests from Personal data subjects concerning the processing of their personal data are received by the Operator at the following details:
Address: Azerbaijan, Baku, AZ1069, 5A Agasadykh Geraybeyli street
Telephone: +994 (12) 404-12-02
E-mail: info@gps.az

1.5. The period for considering written applications and requests from personal data subjects does not exceed 30 (thirty) calendar days from the day the Operator registers the application.

2. KEY CONCEPTS AND TERMS

The following key concepts, which correspond to Article 2 of the Law, are used in this Policy:

• Personal data (PD) — any information relating to a directly or indirectly identified or identifiable natural person (the personal data subject), recorded on an electronic, paper and (or) other material medium.
• Operator — “GPS Solutions” MMC, which alone or jointly with other parties organises and (or) carries out the processing of PD, and which also determines the purposes of the processing of PD, the composition of the PD and the actions performed with them.
• Personal data subject (User) — a natural person who is directly or indirectly identified or identifiable by means of personal data.
• Processing of PD — any action (operation) or set of actions performed on PD with or without the use of automated means, including the collection, recording, systematisation, accumulation, storage, refinement (updating, alteration), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of PD.
• Automated processing of PD — the processing of PD by means of computing equipment.
• Cross-border transfer of PD — the transfer of PD to the territory of a foreign state, to an authority of a foreign state, or to a foreign natural person or a foreign legal entity.
• Confidentiality of PD — a requirement, binding on the Operator or on any other party that has obtained access to PD, not to allow the PD to be disseminated without the consent of the PD subject or another lawful basis.
• Cookie files — a fragment of data sent by a web server and stored on the user's computer, used to keep settings and to gather statistics.

3. PRINCIPLES AND LEGAL GROUNDS FOR PROCESSING

3.1. The Operator processes PD on the basis of the following principles (Article 4 of the Law):

• Lawfulness and fairness of the purposes and methods of processing PD;
• Correspondence of the purposes of processing PD to the purposes determined and declared in advance when the PD were collected;
• Correspondence of the volume and nature of the PD processed, and of the methods of processing PD, to the purposes of processing PD;
• Accuracy of the PD and their sufficiency for the purposes of processing, and the inadmissibility of processing PD that are excessive in relation to the purposes declared when the PD were collected;
• Inadmissibility of combining databases containing PD that were created for purposes incompatible with one another.

3.2. The Operator processes PD where at least one of the following conditions is met:

• The PD are processed with the consent of the PD subject to the processing of their PD;
• The processing of PD is necessary for the performance of a contract to which the PD subject is a party, beneficiary or guarantor, and also for the conclusion of a contract at the initiative of the PD subject;
• The processing of PD is necessary for the exercise of the rights and legitimate interests of the Operator (in particular, for conducting commercial activity in the B2B field), provided that the rights and freedoms of the PD subject are not thereby infringed.

4. CATEGORIES OF SUBJECTS AND PURPOSES OF PROCESSING

4.1. The Operator processes personal data for specific, predetermined and lawful purposes.

4.2. Categories of data processed:

• Surname, first name, patronymic;
• Contact telephone numbers;
• Email addresses (e-mail);
• Place of work and position held (for representatives of corporate clients);
• Technical data (IP address, cookie files, browser information).

4.3. Purposes of processing:

• Providing consultancy services in the field of GPS monitoring and telematics;
• Handling incoming enquiries and requests from the gps.az website;
• Preparing and sending commercial proposals, invoices and contracts;
• Establishing feedback with the User, including sending notifications and requests;
• Informational and news mailings (where separate consent has been given);
• Gathering statistics about site visitors in order to improve the quality of the resource and for marketing analysis.

5. PROCEDURE FOR COLLECTING, STORING AND TRANSFERRING DATA

5.1. Collection: PD are collected when the User enters the data themselves into the feedback forms on the Site, and also automatically (technical data).

5.2. Storage: PD are stored in a form that permits the PD subject to be identified for no longer than the purposes of processing the PD require, unless a storage period for the PD is laid down by law or by contract. The PD processed are to be destroyed or depersonalised once the purposes of the processing have been achieved, or if the need to achieve those purposes falls away.

5.3. Transfer to third parties: The Operator has the right to entrust the processing of PD to a third party with the consent of the PD subject, unless the Law provides otherwise, on the basis of a contract concluded with that party. Such parties may include hosting providers, site developers and technical support services. Parties that process PD on the Operator's instructions undertake to observe the principles and rules for the processing and protection of PD.

5.4. Cross-border transfer: The Operator is obliged to satisfy itself that the foreign state to whose territory the PD are to be transferred (for example, when foreign Google analytics services are used) provides adequate protection of the rights of PD subjects. Cross-border transfer to the territory of countries that do not provide adequate protection may be carried out only where the subject has given written consent.

6. RIGHTS OF THE PERSONAL DATA SUBJECT

In accordance with Chapter III of the Law, the Personal data subject has the right:

• 6.1. To receive full information concerning the processing of their PD (confirmation that processing is taking place, the legal grounds, the purposes, the methods, the periods and so on).
• 6.2. To require the Operator to refine their PD, or to block or destroy them, where the PD are incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the declared purpose of the processing.
• 6.3. To withdraw consent to the processing of PD.
• 6.4. To require that unlawful actions by the Operator in relation to their PD be brought to an end.
• 6.5. To appeal against the actions or the inaction of the Operator to the relevant executive authority or through the courts.

7. MEASURES TO ENSURE SECURITY

To prevent unauthorised access to personal data, the Operator applies the necessary legal, organisational and technical measures (in accordance with Articles 25-27 of the Law):

• 7.1. Appointing the officials responsible for organising the processing and protection of PD.
• 7.2. Limiting the group of people who have access to PD; familiarising staff with the requirements of the legislation and with the Operator's internal documents.
• 7.3. Applying technical information protection measures (antivirus software, firewalling, use of the HTTPS/SSL protocol to encrypt traffic).
• 7.4. Logging and recording the actions of users of the information systems; regularly creating database backups.
• 7.5. Organising a security regime for the premises where the information systems are located.

8. AMENDMENT AND DELETION OF DATA. TERMINATION OF PROCESSING

8.1. The processing of PD is terminated in the following cases:

• The purposes of processing the PD have been achieved;
• The subject's consent has expired, or the PD subject has withdrawn consent;
• Unlawful processing of PD has been discovered;
• The Operator is wound up.

8.2. Where the subject withdraws consent to the processing of PD, the Operator has the right to continue processing the PD without the subject's consent where the grounds set out in the Law are present (for example, in order to perform a contract or to meet the requirements of the legislation).

9. FINAL PROVISIONS

9.1. This Policy is a publicly available document and is to be published on the Operator's official website.

9.2. The Operator has the right to make amendments to this Policy. Where amendments are made, the current version states the date of the last update.

9.3. Compliance with the requirements of this Policy is monitored by the person responsible for organising the processing of personal data at the Operator.