The protection of personal data is a key concern of the Municipality of Paralimni. In the framework of the General Data Protection Regulation (EU) 2016/679 which entered into force on the 25th of March 2018, this policy provides useful information regarding the processing of personal data and the rights of data subjects pursuant to Article 13 of the Regulation.
According to Article 4 of the Regulation:
- ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
The protection concerns all personal data which have come or will come to the knowledge of the services of the Municipality of Paralimni, in the context of its legal operation and its cooperation with citizens and bodies of the public or private sector. The EU Regulation 2016/679 does not abolish obligations arising form provision of other laws. The services of the Municipality of Paralimni continue to operate and provide services to citizens within the framework of their legally documented responsibilities.
In order to operate in compliance with the current legal framework, the Municipality of Paralimni has taken a series of actions required. This includes applying the appropriate technical and organizational measures to ensure the legal maintenance, processing and secure storage of personal data files and also protect the processing of personal data from loss, leakage, alteration, transmission or in any other way the improper processing of this data.
THE MUNICIPALITY
Paralimni is the largest Municipality of the free Famagusta District which, after the 1974 and the occupation of Famagusta is the center of the District’s social, cultural and financial life.
It became a Municipality in 1986 and the Council consists of the Mayor and 12 Council Members who are elected every 5 years.
Protaras, the tourist area of Paralimni is a very popular tourist and holiday resort for locals and foreign visitors. It is ideal for holidays and has about 20.000 hotel beds.
In an effort to harmonize its procedures, the Municipality decided that the contribution of experts in the specific area was required. Therefore the Municipal Council has allocated the necessary resources and has entered into a contract with such experts through a procurement competition procedure.
For any questions regarding the processing of personal data, interested parties can contact the Data Protection Officer below:
Postal Address: Antoni Papadopoulou 6, Paralimni 5282, Cyprus
Contact number: 23819322
Email Address:
LEGALITY OF PROCESSING
The Municipality, as the person in charge of processing (“the controller”), within the meaning of article 4 par. 7 of the GDPR Regulation, collects personal data for the purposes of exercising its responsibilities. The legal basis for this processing is article 6. Par. 1 ( c) and ( e) of the Regulation and also for the processing of special category data the basis is article 9 par. 2 (b), (g) and (j) of the Regulation.
Regarding the installation of cookies for personalized browsing on the Municipality’s website, the legal basis is your consent according to Article 6. Par. 1 (a) of the Regulation.
WHAT DATA IS COLLECTED – PROCESSING PRINCIPLES
The Personal Data collected by the services of the Municipality are limited to the data necessary for the purposes for which it is processed and is absolutely necessary for the compliance with any of the Municipality’s legal obligations or for the fulfillment of the Municipality’s duties, performed in the public’s interest or in its capacity as a public authority.
The processing of personal data (simple and special categories of “sensitive” data) by the Municipality is governed by the principles clearly described in Article 5. of the Regulation.
The services of the Municipality process the data in accordance with the current legislation and with transparency. In the context of transparency the aim is to inform the data subject in a concise, understandable way, with clear and simple wording (“lawfulness, fairness and transparency”).
The Personal Data provided to the Municipality does not undergo further processing in a manner that is incompatible for the purposes for which it is collected. These purposes are legally and explicitly defined in the context of the Municipality’s operation and the provision of services to citizens (“limitation of purpose”).
The Municipality only collects data that is appropriate, relevant and limited to what is necessary for the purposes for which they are processed (“data minimization”).
The services of the Municipality aim for the data that is collected to be accurate and where necessary kept up to date, taking all reasonable measures for the immediate correction or deletion of wrong data, while taking into consideration the purposes of the processing (“accuracy”).
The data is kept in physical or digital form for the period necessary for the purposes for which the date is processed. This period is specified by legislation (“storage limitation”).
The Municipal services take the appropriate technical and organizational measures to ensure that the data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing against accidental loss, destruction or damage (“integrity and confidentiality”).
The Municipality is responsible for the processing of the data and is able to demonstrate compliance with the GDPR Regulation.
SPECIAL CATEGORY PERSONAL DATA
Special categories of sensitive personal data, such as information regarding political opinions, religion, data concerning health, racial or ethnic origin, sexual orientation, trade union membership, philosophical beliefs, genetic data, biometric data require greater levels of protection.
The Municipality, is required to have further justification for the collection, storage and use of this type of personal data.
The Municipality may process special category data in the following individual cases:
1. In limited situations, with the explicit written consent of the subjects.
2. During the exercise of legal obligations of the Municipality or during the exercise of the Municipality’s rights regarding employment.
3. When necessary for the public interest, regarding scientific or historical research or statistical purposes.
Less often, the Municipality may process this type of information where necessary in relation to legal claims or where necessary to protect the interests of the subjects (or the interests of someone else) where the subject is unable to give consent or where the relevant data has already been published by the subject himself.
PERSONAL DATA OF MINORS
The Municipality understands the importance of protecting the privacy of children . As such it collects personal data in relation to children only with the consent of the parents or legal guardians or unless otherwise permitted by law. For the purposes of this privacy statement, “children” are persons under the age of eighteen years old.
WHERE WE DISCLOSE THE DATA
The processing of personal data is carried out exclusively for the purposes for which it is submitted. The Municipality of Paralimni, in no case sells, leases or in any other way grants or transmits to third parties personal data which are submitted to its services. An exception is the case where the disclosure of the data is required by an explicit provision of law and exclusively to the competent authorities.
In the event where, on the conclusion of a public contract, a contractor appears who during the execution of the contract has access to personal data processed by the Municipality, then a confidentiality agreement is signed or such terms are incorporated into the main contract. Furthermore, the Municipality takes all reasonable measures so that the relevant processing by the contractor is done following recorded orders of the controller.
The aim of the above action is to ensure sufficient assurances for the implementation by the contractors of appropriate technical and organizational measures, so that the processing meets the requirements of the GDPR Regulation and to ensure the rights of the data subject.
HOW DATA IS PROTECTED
The processing of personal data is subject to the terms of this data protection policy, as well as relevant provisions of Cypriot legislation and EU Law on the protection of the individual and the protection of personal data.
The Municipality takes all reasonable physical, technical and organizational security measures to ensure that the personal data is processed in a secure manner, protecting the data from unauthorized or illegal processing and loss, destruction, disclosure or damage.
RESTRICTION ON OBLIGATIONS AND RIGHTS
The Municipality may limit the scope of application of the obligations and rights to ensure:
1. State security,
2. National defense,
3. Public safety,
4. The prevention, investigation, detection or prosecution of criminal offense or the execution of criminal sanctions, including protection against and prevention of threats to public security,
5. other important objectives of general public interest including taxation, public health and social security,
6. the protection of the independence of justice and judicial proceedings,
7. the prevention, investigation, detection and prosecution of breaches of ethics in regulated professions,
8. monitoring, inspection or regulatory operation associated, at least occasionally, with the exercise of official authority in the cases referred to in points (1) to (7),
9. the protection of the data subject or the rights and freedoms of third parties,
10. the enforcement of civil claims.
NOTIFICATION OF CHANGE OF PROCESSING PURPOSE
The Municipality processes personal data only for the purposes for which it has been collected, unless it reasonably considers that it must use the relevant data for another reason and that this reason is compatible with the original purpose. If there is a need for any processing of the personal data for a purpose that is incompatible with the original purpose of processing, the Municipality will inform and explain the legal basis that allows it to do so with or without the consent of the subject.
The Municipality may process personal data without the knowledge or consent of the subject, according to the rules above, where this is allowed by law.
DURATION OF DATA RETENTION
The Municipality retains the personal data, only for the period required for the purposes of their processing, as defined in the current legislation, in the context of the fulfillment of its duties and the exercise of public authority assigned to it and also for as long as is necessary for the establishment, exercise or support of legal claims.
SOURCES AND/OR RECIPIENTS OF PERSONAL DATA DURING THE EXECUTION OF THE CONTRACTUAL AND INSTITUTIONAL OBLIGATIONS OF THE MUNICIPALITY¨
- Police
- Hospitals
- Land Registry Office
- Traffic Police
- Town Planning Department
- Welfare Department
- Banking Organizations
- Government Organizations / Bodies
- Health Department
- Municipal Kindergarten «ΓΙΩΡΓΚΕΙΟ»
TRANSFERS OF PERSONAL DATA TO A THIRD COUNTRY OR TO INTERNATIONAL ORGANIZATIONS
The Municipality does not transmit personal data to a third country or an international organization except in specific cases that are necessary for the fulfillment of its purposes (such as in the case of weddings, Embassies abroad or the Ministry of Foreign Affairs of third countries etc.
Further transmission of personal data takes places in cases where the transmission is necessary for reasons of public interest or provided by law.
The primary condition of the Municipality when considering the possibility of transferring personal data to third countries or international organizations is that the transfer is necessary. The transfer of personal data to a third country of international organization may take place if the European Commission has decided that an adequate level of protection is ensured by the third country or the international organization.
In the absence of such a decision by the European Commission, transmission may be effected provided that effective guarantees are given that the data subject will continue to enjoy fundamental rights and guarantees to which they are entitled to regarding the processing of their data once transmitted.
The Municipality ensures that the data subject has given explicit consent specifically for the transmission of respective data and that they have been fully informed about potential dangers arising from such transmission.
RIGHTS OF DATA SUBJECTS
Each data subject reserves all the rights deriving from the applicable Cypriot and E.U. provisions, in particular the right to update, access, correct, supplement, delete, restrict the processing of their personal data, taking into account that the GDPR Regulation does not abolish obligations arising from provisions of other laws.
Particularly, in accordance with the legal framework for the protection of personal data, as in force from time to time, each data subject has the right to:
- Information and access to data: Clearer information about the subject’s personal data collected and processed by the Municipality services and the right of access to them.
- Rectification: Rectification or completion of any incomplete or inaccurate data concerning each data subject.
- Restriction of processing and objection to processing: under certain conditions, when provided by applicable legislation.
- Right to erasure “right to be forgotten”: Deletion of data, provided that the data is not kept for a specific legal and declared purpose, as defined in the current legislation, under the responsibility of the relevant department.
- Data portability: Data transfer, in machine readable form, from one controlled to another under specific conditions.
When the exercise of the above rights depends exclusively on the actions of the services of the Municipality of Paralimni, after verifying the legality of the request, the response of the Municipality to the request takes places within the period of one month as provided by the Regulation. In any case, the person making the request is informed of any justified need to extend this period.
The data subject has the right to their consent at any time. Withdrawal of consent shall not affect the lawfulness of the proceedings on which the consent was based prior to its withdrawal. The data subject is informed prior to giving consent. Revocation of consent is as easy as the provision of consent.
NOTIFICATION OF CHANGES
The Municipality reserves the right to change the above terms in accordance with the applicable legal framework. In case the above terms undergo any change, an update will be made through the Municipality website.
It is clearly equally important that the personal data kept by the Municipality be accurate and current. Therefore, the data subject must inform the Municipality of any changes to their personal data.
FEES
Regarding the subject’s access to personal data or the exercise of the subject’s rights, there is no requirement for payment of any fee.
However, a reasonable fee may be required if the subject’s request for access is, after consideration, clearly unfounded or excessive. Alternatively, the Municipality may refuse to comply with this request in such cases.
HOW TO EXERCISE YOUR RIGHTS
Any request regarding the personal data and the exercise of the rights of each data subject must be addressed in writing to the Municipality of Paralimni and the Data Protection Officer (DPO).
Data Protection Officer for Paralimni Municipality:
Contact Information:
Postal Address: Antoni Papadopoulou 6, Paralimni 5282, Cyprus
Contact number: 23819322
Email Address:
RIGHT OF APPEAL TO THE AUTHORITY
The data subject has the right to appeal to the Office of the Personal Data Protection Commissioner for issues relating to the processing of personal data. For more information on the Commissioner and the process of submitting a complaint you can visit the official website (www.dataprotection.gov.cy).
FINAL PROVISIONS
The above terms as well as any modification thereof, are governed and supplemented by the Cypriot law, the law of the European Union and the relevant international treaties. Should any provision of this present Policy be found contrary to the law, such provision automatically ceases to be valid and is removed from the present without in any way affecting the validity of the remaining terms.
