Call Center Studio Global Privacy Program

Call Center Studio define rules to access to various systems, facilities, equipments and information according to business and security requirements. The basic principle is that access to all systems, networks, services and information is forbidden, unless expressly permitted to individual users or groups of users.  There should be a user registration procedure for each system and service.  Access to all physical areas in the organisation is allowed, except to areas for which privilege must be granted by the authorised person (item “Privilege management”). We define various user profiles with access rights using the terminology of “Name of system, network, service and corresponding user rights with job titles. 

We classify the privilege management based on the methodology underlying “who is authorised for accepting or declining access rights as well as form of authorization process. 

Regular review of access rights is implemented based on the name of system, network service, physical area for the intervals for regular reviews. As strongly stated in GDPR, each review has to be recorded. 

Change of status or cancellation of contract is one of the key elements in access control policy. Whenever any change in employment or cancellation of employment occurs, Responsible person must definitely inform the persons who approved privileges for the employee.

In case of termination on contract of an employment, contracts must immediately be removed or changed by the responsible person. 

Technical installation/implementation of the allocation or removal of access is carried out by assigned responsible persons. 

User Password monitoring and management is another important key element needs to be considered as rules: 

• by signing the Statement of Acceptance of the Documents, users also accept the obligation to keep passwords confidential, as prescribed by this document
• each user may use only his/her own uniquely allocated username
• each user must have the option to choose his/her own password, where applicable
• the temporary password used for first system log-on must be unique and strong, as described above
• temporary passwords must be communicated to the user in a secure manner, and user’s identity must be checked.
• the password management system must require the user to change the temporary password at first log-on to the system 
• the password management system must require the user to select strong passwords
• the password management system must require the users to change their passwords every three months
• if the user requests a new password, the password management system must determine the identity of the user.
• the user has to confirm the receipt of the password.
• the password must not be visible on the screen during log-on
• if a user enters an incorrect password three consecutive times, the system must block the user account in question
• passwords created by the software or hardware manufacturer must be changed during initial installation files containing passwords must be stored separately from the application’s system data 

GDPR Breach Notification Policy 

Breach notification policy is one of the Organisational measures where Call Center Studio met and implemented.

According to article 33: 

1.In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

2. The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
3. The notification referred to in paragraph 1 shall at least: 

(a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; 

(b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; 

(c) describe the likely consequences of the personal data breach; 

(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

4.Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.

5.The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.

According to article 34: 

1.When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. 

2.The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3).

3. The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:

(a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; 

(b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise; 

(c) it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

4.If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met.

The controller retains overall responsibility for the protection of personal data, but the processor has an important role to play to enable the controller to comply with its obligations; and this includes breach notification. Indeed, Article 28(3) GDPR specifies that the processing by a processor shall be governed by a contract or other legal act. Article 28(3)(f) states that the contract or other legal act shall stipulate that the processor “assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor”.

Article 33(2) GDPR makes it clear that if a processor is used by a controller and the processor becomes aware of a breach of the personal data it is processing on behalf of the controller, it must notify the controller “without undue delay”. It should be noted that the processor does not need to first assess the likelihood of risk arising from a breach before notifying the controller; it is the controller that must make this assessment on becoming aware of the breach. The processor just needs to establish whether a breach has occurred and then notify the controller. The controller uses the processor to achieve its purposes; therefore, in principle, the controller should be considered as “aware” once the processor has informed it of the breach. The obligation on the processor to notify its controller allows the controller to address the breach and to determine whether or not it is required to notify the supervisory authority in accordance with Article 33(1) and the affected individuals in accordance with Article 34(1). The controller might also want to investigate the breach, as the processor might not be in a position to know all the relevant facts relating to the matter, for example, if a copy or backup of personal data destroyed or lost by the processor is still held by the controller. This may affect whether the controller would then need to notify. 

The GDPR does not provide an explicit time limit within which the processor must alert the controller, except that it must do so “without undue delay”. Therefore, the EDPB recommends the processor promptly notifies the controller, with further information about the breach provided in phases as more details become available. This is important in order to help the controller to meet the requirement of notification to the supervisory authority within 72 hours. 

As is explained above, the contract between the controller and processor should specify how the requirements expressed in Article 33(2) should be met in addition to other provisions in the GDPR. This can include requirements for early notification by the processor that in turn support the controller’s obligations to report to the supervisory authority within 72 hours. 

Where the processor provides services to multiple controllers that are all affected by the same incident, the processor will have to report details of the incident to each controller. 

A processor could make a notification on behalf of the controller, if the controller has given the processor the proper authorisation and this is part of the contractual arrangements between controller and processor. Such notification must be made in accordance with Article 33 and 34 GDPR. However, it is important to note that the legal responsibility to notify remains with the controller. 

GDPR Records Retention and Protection Policy

Call Center Studio collects and stores records of many types and in a variety of different formats. 

It is important that these records are protected from loss, destruction, falsification, unauthorised access and unauthorised release and a range of controls are used to ensure this, including backups, access control and encryption.

Call Center Studio also has a responsibility to ensure that it complies with all relevant legal, regulatory and contractual requirements in the collection, storage, retrieval and destruction of records based on the European Union General Data Protection Regulation (GDPR) and its requirements concerning the storage and processing of personal data.

This control applies to all systems, people and processes that constitute the organisation’s information systems, including board members, directors, employees, suppliers and other third parties who have access to Call Center Studio systems. 

According to principles underlined below, we have adopted when taking into consideration of record retention and protection policy:

• Records must be held in compliance with all applicable legal, regulatory and contractual requirements
• Records must not be held for any longer than needed.
• The protection of records in terms of their confidentiality, integrity and availability must be in accordance with their security classification
• Records must remain retrievable in line with business requirements at all times

We categorised the record as underlined below:

• Accounting
• Budgeting and forecasting
• System Transaction logs
• Audit Logs
• Operational Procedures
• Customer
• Supplier
• Human Resources 

Each record category has the following information:

• Retention Period
• Why this period is defined?
• Allowable Storage media on servers and on cloud

Each Group of companies separately focus on the following key parameters in the policy:

• Cryptography
• Media
• Record Retrieval
• Record Destruction
• Record Review

GDPR Use of Encryption and Encryption Management Policy

Encryption and Encryption Management is one of the key organisational measures which a group of companies has implemented. 

We established the rules for acceptable use of encryption technologies. This policy applies to individuals responsible for the set up or maintenance of Call Center Studio. Those responsibilities in the GDPR  training program, have been given to all personnel of a group of companies by appointed Data Protection Officer.

According to agreed policy, below will summarise the key elements of it.   

•       All encryption technologies and techniques used by Call Center Studio must be approved by Call Center Studio IT Management.
•       Call Center Studio IT Management is responsible for the distribution and management of all encryption keys, other than those managed by Call Center Studio customers.
•       All use of encryption technology should be managed in a manner that permits properly designated Call Center Studio personnel to promptly access all data, including for purposes of investigation and business continuity.
•       Only encryption technologies that are approved, managed, and distributed by Call Center Studio IT may be used in connection with Call Center Studio Information Resources, other than those managed by Call Center Studio customers.
•       Call Center Studio IT Management will create and publish the Call Center Studio Encryption Standards, which must include, at a minimum:

o   The type, strength, and quality of the encryption algorithm required for various levels of protection.

o   Key lifecycle management, including generation, storing, archiving, retrieving, distributing, retiring, and destroying keys. 

•       All Call Center Studio information classified as confidential must be encrypted when:

o   Transferred electronically over public networks.

o   Stored on mobile storage devices.

o   Stored on laptops or other mobile computing devices.

o   At rest.

•       The use of proprietary encryption algorithms is not permitted, unless approved by Call Center Studio IT Management
•       The use of encryption for any data transferred outside of the United States must be formally approved by Call Center Studio IT Management prior to transfer

GDPR Subject Access Request Policy

According to GDPR, Data Subjects of Call Center Studio have an absolute right to receive confirmation that an we process their personal data and also right to access that data so that they may be aware of it and are able to verify the lawfulness of the processing. The process is called a subject access request.

Call Center Studio as the controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means. 

Call Center Studio as the controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject. 

Call Center Studio as the controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. 

If Call Center Studio as the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. 

Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: 

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. 

Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. 

The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically, they shall be machine-readable. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icon.

According to Article 15 (Right of Access by the Data Subject),

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: 

(a) the purposes of the processing; 

(b) the categories of personal data concerned; 

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; 

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; 

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; 

(f) the right to lodge a complaint with a supervisory authority; 

(g) where the personal data are not collected from the data subject, any available information as to their source; 

(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 

2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. 
3. Call Center Studio as the controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. 

Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. 

4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

In order to reply to a request for access and to ensure that none of its aspects might be disregarded, it is necessary first to understand the structure of Art. 15 and the constituent components of the right of access stipulated in this Article.

Art. 15 can be broken down into eight different elements as listed in the table below: 

GDPR Data Subject Rights Policy

Data Subject Rights  is one of the key organisational measures which a group of companies has implemented. Call Center Studio processes many types of data for HR purposes concerning job applicants, employees, former employees, workers and contractors for various reasons. It is fully aware of its obligations under the General Data Protection Regulation (GDPR) to process data lawfully and to ensure that the rights of data subjects, as set out in GDPR, are observed correctly. 

Under GDPR, you have the following rights in relation to your data:

•     the right to be informed
•     the right of access
•     the right for any inaccuracies to be corrected 
•     the right to have information deleted 
•     the right to restrict the processing of the data 
•     the right to portability
•     the right to object to the inclusion of any information 
•     the right to regulate any automated decision-making and profiling of personal data.

• The right to be informed

Data Subjects have the right to be informed how the Call Center Studio processes their data and the reasons for the processing. In order to provide this information to them, Call Center Studio has a privacy notice to explain what data we collect about them, how we collect and process it, what we process it for and the lawful basis which permits us to process it. 

Call Center Studio also has a separate privacy notice applicable to job applicants, available at no cost if requested.

If Call Center Studio intends to use data already collected from them for a different reason than that already communicated, they will be informed of the new reason in advance.

• The right of access

Data Subjects  have the right to access their personal data which is held by the Call Center Studio.

• The right for data to be corrected

One of the fundamental principles underpinning data protection is that the data Call Center Studio processes about them will be accurate and up to date. They have the right to have their data corrected if it is inaccurate or incomplete.

If they wish to have their data rectified, they should do so by completing the Data Rectification Form.

Call Center Studio will respond to a data rectification request within one month. Where the data rectification request is complex, Call Center Studio may extend the timescale for response from one month to three months. If this is the case, Call Center Studio will write to you within one month of receipt of the request explaining the reason for the extension.

If the response to your request is that Call Center Studio will take no action, they will be informed of the reasons for this and of their right to complain to the Information Commissioner and to a judicial remedy.

Where any data which has been rectified was disclosed to third parties in its unrectified form, Call Center Studio will inform the third party of the rectification where possible. Call Center Studio will also inform them of the third parties to whom the data was disclosed.

• The right to have information deleted

Data Subjects have the right to have their data deleted and removed from our systems where there is no compelling business reason for Call Center Studio to continue to process it. 

They have a right to have their data deleted in the following circumstances:

•     where the personal data is no longer necessary in relation to the purpose for which Call Center Studio originally collected or processed it
•     where they have withdrawn their consent to the continued processing of the data and there is no other lawful basis for Call Center Studio to continue processing the data
•     where they object to the processing and Call Center Studio has no overriding legitimate interest to continue the processing
•     the personal data has been unlawfully processed
•     the personal data has to be deleted due to a legal obligation.

If you wish to make a request for data deletion, you should complete the Data Deletion Request form. (Please request if needed)

Upon receipt of a request, Call Center Studio will delete the data unless it is processed for one of the following reasons:

•     to exercise the rights of freedom of expression and information
•     for Call Center Studio to comply with a legal requirement
•     the performance of a task carried out in the public interest or exercise of official authority
•     for public health purposes in the public interest
•     archiving purposes in the public interest, scientific historical research or statistical purposes or
•     the defence of legal claims.

Where their request is not complied with because of the one of the above reasons, they will be informed of the reason. Where their request is to be complied with, they will be informed when the data has been deleted.

Where the data which is to be deleted has been shared with third parties, Call Center Studio will inform those third parties where this is possible. However, where this notification will cause a disproportionate effect on the Company, this notification may not be carried out. 

• The right to restrict the processing of data

They have the right to restrict the processing of your data in certain circumstances. Restricting Call Center Studio from processing your data means that Call Center Studio will continue to hold the data but will stop processing it.

Call Center Studio will be required to restrict the processing of their personal data in the following circumstances:

•     where they tell Call Center Studio that the data it holds on them is not accurate. Where this is the case, Call Center Studio will stop processing the data until it has taken steps to ensure that the data is accurate
•     where the data is processed for the performance of a public interest task or because of the Company’s legitimate interests and they have objected to the processing of data. In these circumstances, the processing may be restricted whilst Call Center Studio considers whether its legitimate interests mean it is appropriate to continue to process it
•     when the data has been processed unlawfully
•     where Call Center Studio no longer needs to process the data but they need the data in relation to a legal claim.

If they wish to make a request for data restriction, they should complete the Data Restriction Request form.

Where data processing is restricted, Call Center Studio will continue to hold the data but will not process it unless:    

• they consent to the processing
• processing is required in relation to a legal claim.

Where the data to be restricted has been shared with third parties, Call Center Studio will inform those third parties where this is possible. However, where this notification will cause a disproportionate effect on the Company, this notification may not be carried out.

Where Call Center Studio is to lift any restriction on processing, they will be informed in advance.

• The right to data portability

Data Subjects have the right to obtain the data that Call Center Studio processes on them and use it for their own purposes. This means they have the right to receive the personal data that they have provided to Call Center Studio in a structured machine readable format and to transmit the data to a different data controller. 

This right applies in the following circumstances:

•     where they have provided the data to the Company
•     where the processing is carried out because they have given Call Center Studio their consent to do so
•     where the processing is carried out in order to perform the employment contract between them and the Company
•     where processing is carried out by automated means.

Where a request for data portability is received, Call Center Studio will respond without undue delay, and within one month at the latest. Where the request is complex or Call Center Studio receives a number of requests, Call Center Studio may extend the timescale for response from one month to three months. If this is the case, Call Center Studio will write to you within one month of receipt of the request explaining the reason for the extension. 

Where Call Center Studio is to comply with your request, they will receive the data in a structured and machine readable form. They will not be charged for the provision of this data. Upon request, Call Center Studio will transmit the data directly to another organisation. 

If the response to their request is that Call Center Studio will take no action, they will be informed of the reasons for this and of their right to complain to the Information Commissioner and to a judicial remedy.

The right to portability is different from the right to access. Although both involve a right to access your personal data, the personal data to be accessed is not the same. The right to access your data under the right to portability includes only personal data as described above. Access to data under the right of access includes all personal data relating to you, including that which has not been provided to Call Center Studio by you.

• The right to object to the inclusion of data 

Data Subjects have a right to object to the processing of your data in certain circumstances. This means that they have the right to require Call Center Studio to stop processing their data. In relation to their employment with the Company, they may object to processing where it is carried out:

•     in relation to the Company’s legitimate interests 
•     for the performance of a task in the public interest
•     in the exercise of official authority or
•     for profiling purposes.

Where they object to processing, Call Center Studio will stop the processing activity objected to unless:

Call Center Studio can demonstrate compelling legitimate reasons for the processing which are believed to be more important than your rights or the processing is required in relation to legal claims made by, or against, the Company.