The Organisation complies with the basic principles of personal data processing, respects the rights of natural persons and ensures that the personal data in its possession:

  • are collected for specified, explicit and legitimate purposes, as recorded in the Record of Processing Activities it maintains, and are collected with the consent of the natural person where required,
  • are processed only for the purposes for which they were collected and/or for legal and regulatory reasons and/or for the protection of the public interest of the Organisation,
  • are not further processed beyond the specified purpose,
  • are adequate, relevant and limited to what is necessary for the purposes of processing,
  • are lawfully processed in accordance with the rights of natural persons, and are accurate and kept up to date where necessary, especially before critical decisions are taken concerning natural persons,
  • are not kept for longer than is necessary for the purpose of processing and/or for the Organisation’s compliance with legal and regulatory obligations,
  • are kept secure from unauthorised access, loss or destruction,
  • are transferred to third parties only provided that an adequate level of protection is ensured.

The above are complied with by all employees of the Organisation, as well as by third parties processing personal data of natural persons on its behalf.

To ensure the above, the Organisation:

  • implements a Quality, Information Security and Privacy Management System covering all its activities, for monitoring and checking the implementation of this policy and assessing its effectiveness in terms of compliance with the regulatory framework and best practices for the protection of personal data,
  • implements procedures for fully satisfying the rights of natural persons, responding to their requests within one month of submission, or within 3 months where there are justified reasons for delay that have been communicated to the Data Subject within the first month of the submission of their request.
  • clearly informs natural persons about the processing of their data,
  • integrates personal data management requirements into all operations and processes related to their processing,
  • has identified all internal and external stakeholders and their requirements regarding the protection of personal data,
  • has defined roles and responsibilities related to data management,
  • provides clear instructions to staff and to third parties acting on its behalf on the secure use and transfer of data in accordance with the Management System,
  • ensures that the transfer of data to third parties and their processing on its behalf are carried out in compliance with the regulatory framework for data protection and with this policy,
  • designs, adopts and monitors the implementation of a system of indicators and targets for the secure and lawful management of data,
  • invests in the continuous training and awareness of its employees on personal data protection, as well as in the continuous improvement of know-how and its dissemination to all staff,
  • provides all the resources required for the effective implementation of the Quality, Information Security and Privacy Management System,
  • has appointed a Data Protection Officer (DPO),
  • communicates this policy to all staff and ensures that it is continuously updated, in order to achieve full compliance with the regulatory framework in force.

The Administration of KEDIVIM is committed to implementing this Privacy Policy and reviewing it regularly, in order to comply with all legislative and regulatory requirements, while also supporting the active participation of staff in safeguarding the quality of the training programmes delivered. The commitment of the Administration and of all staff to the continuous improvement of the services provided is a strategic choice of management and responsibility.