Data Protection Policy

ClinBAY (“we”/“us”/“our” etc) is committed to protecting the privacy of your personal data collected in the course of our business, including via the website www.clinbay.com (the “Site”). This Data Processing Policy forms part of our Terms and Conditions of trade as well as part of the terms and conditions for use of and access to the Site.

ClinBAY are based at 182 Agias Fylaxeos Street,Office 101, Kofteros Business Center,3083 Limassol, Cyprus and can be contacted on +32 67 70 00 00 or at info@clinbay.com.

We will always comply (and be able to demonstrate our compliance) with relevant data protection legislation, including the Data Protection Act 1998 (“DPA”) and General Data Protection Regulation (“GDPR”) as applicable, when processing your personal data. Further details on the DPA and GDPR can be found at the Information Commissioner’s Office website (www.ico.gov.uk). For the purposes of data protection legislation, we will be the “controller” or “data controller” of all personal data held in respect of this Policy.

In this Policy we use certain terms from the relevant data protection legislation:

“data subject” i.e. anyone who can be identified from personal data;

“controller/data controller” i.e. a business which holds personal data and decides how it should be processed;

“processor/data processor” i.e. a business which holds personal data on behalf of a controller and processes it in accordance with the controller’s instructions;

“personal data” i.e. recorded information we hold about you from which you can be identified. It may include contact details, other personal information, photographs, expressions of opinion about you or indications as to our intentions about you;

“special categories of personal data” i.e. personal data relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health, sex life or sexual orientation;

“processing” i.e. doing anything with personal data including collecting, using, storing, accessing, disclosing and destroying it.

We will process your personal data in accordance with the following principles:

all personal data must be processed lawfully, fairly and in a transparent manner;

all personal data must be collected for one or more specified, explicit and legitimate purposes and not processed in a manner incompatible with those purposes;

all personal data shall be restricted to what is adequate, relevant and limited for those purposes;

all personal data shall be kept accurate and up to date (and reasonable steps must be taken to erase or rectify inaccurate personal data);

all personal data must be kept for no longer than is necessary for those purposes;

all personal data must be protected by appropriate technical and organisational security measures to prevent unauthorised or unlawful processing and accidental loss, destruction or damage.

We may collect, use and store your personal data, as described in this Policy, where necessary in order to:

perform any contract to which you are party or in order to take steps at your request prior to entering into a contract;

exercise our legitimate business interests;

carry out other functions with your specific consent.

We will use your personal data in order to provide you with the best possible customer service, and to keep you updated about our other services and products. You may amend your subscription settings at any time by contacting us or by clicking on the “unsubscribe” link on any email you receive from us.

We will only process your personal data to the extent that it is necessary for the purposes specified in this Policy and we will keep the personal data we store about you accurate and up to date. Where it is inaccurate or out of date, it will be destroyed - please let us know if your personal details change or if you become aware of any inaccuracies in the personal data we hold about you.

We will not keep your personal data for longer than is necessary for the purposes specified in this Policy. Where it is no longer required, it will be pseudonymised, anonymised, destroyed or erased as appropriate.

We will never sell your personal data or make it available to any third parties without your prior consent (which you are free to withhold) except where:

we use a processor, in which case we will ensure that the processor complies with this Policy and all relevant data protection legislation;

we are required to do so by law;

we sell any part of our business or assets (in which case we may disclose your personal data confidentially to the prospective buyer as appropriate in accordance with our legitimate interests).

We have implemented generally accepted standards of technology and operational security in order to protect personal data from loss, misuse, or unauthorised alteration or destruction. We will notify you promptly in the event of any breach of your personal data which might expose you to serious risk.

We reserve the right to amend this Policy from time to time without prior notice. You are advised to check the Site regularly for any amendments (but NB amendments will not be made retrospectively).

Some of our data processors and third party service providers are located outside of the European Union, such as in the US. We will only transfer personal data outside the EU subject to appropriate safeguards. These safeguards will usually consist of standard data protection clauses which we will adopt and implement with the relevant data processor or third party service provider; we will inform you in advance if other safeguards are to apply.

We will only collect personal data to the extent that it is required for the specific purpose made clear to you at the time. We will only process personal data in accordance with relevant data protection legislation.

If you contact us, we will keep a record of that contact including your contact details and any relevant account information.

In addition to your access details, we will log details of your interactions with us including transactions you carry out through the Site.

Like most websites, the Site uses cookies. These are small text files that are sent to your computer when you log into this site. By using a cookie we can keep track of your log-in status even if you leave the site and return.

NB: a cookie only tracks which device is logging on to the Site: it does not identify (and we do not record) who is using that device. (You may refuse to accept cookies by changing the settings on your browser. However, doing so may affect your ability to access or use certain parts of the Site. Please see our Cookie Policy published on the Site).

Our server logs requests for Site content. By analysing this information, we can identify which parts of the Site are popular and which are not, helping us to improve the Site. The Site uses these log files to compile non-personal statistical information about matters such as length of stay on the Site, type of pages visited and other general information. This information is entirely anonymous: we want to know how people in general are using the Site, not what you in particular are doing on the Site.

We will hold your personal data on our systems for as long as:

your account remains valid; and/or

any contracts you make with us are live; and/or

is necessary to comply with our legitimate business interests; and/or

is necessary to comply with our legal obligations; and/or

you have indicated you are happy for us to do so.

We will hold your data in accordance with our Data Retention Policy.

We may use your personal data:

to carry out our obligations arising from any contracts entered into between you and us;

to provide you with information, products or services that you request from us or which we feel may interest you, including changes and updates (subject to any opt-out as set out in para 1.5 above);

to ensure that the Site is presented in the most effective manner for you and for your computer;

in accordance with our legitimate business interests and legal obligations.

The Site may from time to time contain links to other unrelated sites (including those of our advertisers). This privacy statement does not apply to these sites nor are we responsible for the content and practices of these websites. In particular, please note that such other sites may also use cookies, and that we have no control over this. Please refer to our Cookie Policy.

You have the following rights in respect of your personal data held by us. Please send all requests in respect of these rights to our Data Protection Manager at info@clinbay.com:

to access your personal data;

to be provided with information about how your personal data is processed (this information is set out in this Policy);

to have your personal data corrected where necessary (please contact our Data Protection Manager promptly should you become aware of any incorrect or out-of-date information);

to have your personal data erased in certain circumstances (please refer to the appropriate data protection legislation or consult the ICO for details);

to object to or restrict how your personal data is processed;

to have your personal data transferred to yourself or to another business.

If you consider that we have not complied with this Policy or the relevant data protection legislation in respect of your personal data or someone else’s, you should raise the matter with our Data Protection Manager. Any such breach will be taken seriously and will be dealt with in accordance with the relevant data protection legislation.

You have the right to take any complaints about how we process your personal data to the Commissioner for Personal Data Protection in Cyprus:

1, Iasonos Street, 1082 Nicosia
P.O. Box 23378, 1682 Nicosia

Tel: (+357) 22818456
Fax: (+357) 22304565
Email: commissioner@dataprotection.gov.cy

For more details, please consult the relevant data protection legislation or address any questions, comments and requests regarding our data processing practices to our Data Protection Manager at info@clinbay.com.