Data Subject Request Management Procedure

PROCEDURE FOR THE MANAGEMENT OF DATA SUBJECT REQUESTS I Purpose of the Procedure All personal data processed by Broker Ins Ltd. falls within the scope of this procedure. Through this document, Broker Ins fulfills its obligation as a personal data controller to provide assistance and to ensure the exercise of the rights of data subjects. In defense of their rights, a data subject may submit the following requests to the Controller: • Request for access (Article 15 GDPR); • Request for rectification (Article 16 GDPR); • Request for erasure ("right to be forgotten") (Article 17 GDPR); • Request for restriction of processing (Article 18 GDPR); • Request for data portability (Article 20 GDPR); • Objection to processing (Article 21 GDPR). A request to exercise the right to data portability is addressed in a separate Data Portability Procedure. II Legal Framework • Articles 12, 15, 16, 17, 18, 20 and 21 of the General Data Protection Regulation (GDPR) III Duties and Roles The Data Protection Officer is responsible for the implementation and effective enforcement of this procedure and for notifying the information owner of data subject requests. The Data Protection Officer is responsible for handling all data subject requests covered by this procedure. This procedure is mandatory for all employees of Broker Ins Ltd. who may receive requests for the exercise of rights from a data subject for review. IV Course of the Procedure The methods for submitting requests to Broker Ins Ltd. are described in the Procedure for Methods of Communication for Complaints and Data Subject Requests. Broker Ins Ltd. also accepts data subject requests made by any other method, while complying with the conditions of this procedure. 1 Submission of a Request by the Data Subject Requests are made using the Data Subject Request Form Template. When submitting a request, the following rules apply: • The data subject specifies the particular type of request in the request template provided by the Controller; • A data subject's request may concern all of their personal data held by Broker Ins Ltd., not only a specific type; • The data subject provides the Controller with identity data enabling reliable and unambiguous identification (data from identity documents, client number, electronic identity card, etc.); • Broker Ins Ltd. is obliged to verify the identification data to ensure that the request has been submitted by the subject whom the data identifies, or by a person expressly authorized to do so; • Broker Ins Ltd. documents the date of receipt of the request; • Once received, the request is immediately forwarded to the Data Protection Officer, who initiates the process of handling the request and sending a response to the data subject. 2 Processing of the Request The request is processed as follows: • The Data Protection Officer maintains a Register of Data Subject Requests; • The Data Protection Officer records in the Register of Data Subject Requests the date, identifying information, and all other data relevant to the review of the request; • If the standing of the requesting subject, or the scope or nature of the request, is unclear or raises doubts, the DPO should contact the applicant as quickly as possible – by telephone, letter, or e-mail – to request the information necessary to clarify the request. • The identification (search) of the personal data is carried out across all data repositories and all relevant archiving systems, including all archived files (automatic or manual archives) and all e-mail folders and their archives; paper media – alphabetical registers, filing systems, etc. • Where the request is for access to information, when transmitting a copy of the information, the Data Protection Officer processes the data in order to permanently remove any identifying information about third parties whose consent to disclosure has not been obtained and cannot be obtained (e.g., due to inability to identify them or inability to establish contact). Third-party data may be disclosed without seeking their consent if disclosure is fair within the reasonable expectations of the other data subject and is unlikely to harm their fundamental rights, the assessment of which is made by the DPO. • Broker Ins Ltd. provides the requested information and responds to data subject requests no later than one month from the date of receipt of the access request. Where necessary, taking into account the complexity and number of requests, Broker Ins Ltd. may extend that period by a further two months at most. In that case, however, the data subject must be informed of the extension within one month of receipt of the request. • The applicant may receive the response in person or have it sent to the address they have indicated. • The Data Protection Officer records in the Register of Requests information about the response sent to the subject regarding the access request. • Broker Ins Ltd. is entitled to refuse requests that are manifestly unfounded. A request is classified as manifestly unfounded when the subject matter of the request is not covered by the rights of the data subject, or when it is incorrectly formulated. A request is classified as excessive only when it is repetitive – e.g., the applicant submits a third access request within a 6-month period. In assessing excessiveness, account is taken of whether the subject's data has been changed since the previous disclosures; a request is not considered excessive within this meaning if the data has been changed. • Where a request is found to be unfounded, the Data Protection Officer may: • propose to the Controller's management that a reasonable fee be charged, taking into account the administrative costs of providing the information or communication or of taking the requested action; • refuse to act on the request and prepare a reasoned refusal. 3 Additional Information Sent for an Access Request In the case of a data subject's request for access to their data, in addition to providing access to the data (for example, by providing a copy thereof), Broker Ins Ltd. sends the subject the following information: • the purposes of the processing; • the relevant categories of personal data; • the recipients or categories of recipients of the personal data, where applicable; • information regarding the Controller's intention to transfer the data to a third country or an international organization, as well as the existence of data protection safeguards; • the period for which Broker Ins Ltd. will store the personal data, or, if that is not possible, the criteria used to determine that period; • their rights to request rectification or erasure of their personal data from Broker Ins Ltd., as well as their rights to restriction of processing, to object to processing, and to data portability; • the right to lodge a complaint with a supervisory authority; • where the personal data are not collected from the data subject, any available information as to their source; • the existence of automated decision-making, including profiling, and the envisaged consequences of such processing for the data subject. 4 Actions on Requests for Rectification, Erasure, or Restriction, and on Objections to Processing Upon a data subject's request for rectification, erasure, restriction, or an objection with respect to the personal data processed, the Data Protection Officer is responsible for assessing each such request (other than a request for access to data) with regard to the merits of the subject's right and the existence of other statutory requirements for its satisfaction. Following receipt of the relevant request: • Broker Ins Ltd. removes the personal data from its systems and terminates processing operations concerning it, without undue delay, if the erasure request has been submitted by the data subject; • Broker Ins Ltd. notifies each recipient to whom the personal data have been disclosed of any rectification, erasure, or restriction of processing carried out; • Broker Ins Ltd. informs the data subject of those recipients, if the data subject requests this, and documents that communication; • Broker Ins Ltd. takes appropriate measures, without undue delay, in the event that: • the data subject has submitted a request objecting to the processing of personal data, in whole or in part; • the legal basis for processing arising from a statutory obligation has ceased to apply; • the data has been processed unlawfully. • Broker Ins Ltd. uses the following electronic format to respond to data subject requests: – e-mail. 5 Restrictions EU law or national legislation may provide for restrictions on the exercise of data subjects' rights in the implementation of this procedure in order to safeguard: • national security and defense; • public security; • the prevention, investigation, detection, or prosecution of criminal offenses or the execution of criminal penalties, including safeguarding against and preventing threats to public security; • important objectives of general public interest; • an important economic or financial interest of the Union or of a Member State, monetary, budgetary, and taxation matters; • public health and social security; • the protection of judicial independence and judicial proceedings; • the prevention, investigation, detection, and prosecution of breaches of ethics for regulated professions; • a monitoring, inspection, or regulatory function connected, even occasionally, with the exercise of official authority in such cases; • the protection of the data subject or the rights and freedoms of others; • the enforcement of civil-law claims. V Annex: • Data Subject Request Form Template. Contact with the Personal Data Controller: Website: www.brokerins.bg E-mail: gdpr@brokerins.bg Phone: 024224244