The Controller complies with the requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation“/”GDPR“/”Regulation“), which enters into force on 25.05.2018.
I. Principles relating to processing of personal data
The Controller guarantees and complies with the following principles in relation to the processing of personal data:
1. “Principle of lawfulness, fairness and transparency” – personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject;
2. “Principle of purpose limitation” – personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
3. “Principle of data minimisation” – personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
4. “Principle of accuracy” – personal data shall be accurate and, where necessary, kept up to date; every reasonable step is taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
5. “Principle of storage limitation” – personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes provided that the appropriate technical and organisational measures in order to safeguard the rights and freedoms of the data subject are applied;
6. “Principle of integrity and confidentiality” – personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures;
7. “Principle of accountability” – the Controller shall be responsible for, and be able to demonstrate compliance with the hereinabove principles.
The Controller guarantees and complies with the following principles in relation to the processing of personal data:
1. “Personal data” means any information relating to an identified or identifiable natural person;
2. “Data subject” means an identifiable natural person – user of the Website, who can be identified, directly or indirectly;
3. “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data;
4. “Controller” means Iris AI AS – a legal person, which alone determines the purposes and means of the processing of personal data;
5. “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
6. In this Policy, the European Union is referred to as the “Union”.
III. Identity and contact details of the Controller and Controller’s representative
Controller within the meaning of Art. 4, para. 7 of the Regulation and the present Policy is: Iris AI AS, a Norwegian limited liability legal entity (AKSJESELSKAP) with registration number 916 246 269 , represented by Anita SchjøllBrede.
Phone: 00 47 455 07 380
IV. Categories of personal data that the Controller processes
Upon registration, the Controller collects the following information constituting personal data of the natural persons, respectively the representatives of the legal entities: names and email.
Upon request for a Newsletter, the Controller collects: only an email.
V. Purposes of the processing of the personal data
The data collected upon registration: names and email, is collected and processed for the following purposes:
- 1. Individualization and authentication of the users;
- 2. Products and services provision;
- 3. Security of users accounts in cases of forgotten password;
- 4. Contact and correspondence;
- 5. Services improvement.
The data collected upon request for a Newsletter: an email, is collected and processed for direct marketing purposes.
VI. Legal basis for the processing of personal data
The data collected upon registration: names and email, is collected and processed on the grounds of Art. 6, para. 1, letter “b” of the Regulation, and namely processing is necessary for the performance of a contract to which the Data subject is party or in order to take steps at the request of the Data subject prior to entering into a contract.
The data collected upon request for a Newsletter: an email, is collected and processed on the grounds of Art. 6, para. 1, letter “a” of the Regulation, and namely the Data subject has given consent to the processing of his or her personal data for one or more specific purposes.
VII. Categories of recipients of personal data
- 1. Persons, if provided for in a normative act, including state bodies, in respect of which there is a statutory requirement to provide certain categories of personal data;
- 2. Processors by virtue of a contract between the Controller and processor providing IT services, hosting services, hardware, software, networking, storage, and related technology services required to run the Iris.ai Service. Those processors may process personal data only at the direction of the Controller, unless processing is required by current legislation. Processors are required to provide sufficient guarantees for the application of appropriate technical and organizational measures in such a way that the processing proceeds in accordance with the requirements of the Regulation and protect the rights of data subjects;
- 3. Persons who, under the direct authority of the Controller, process personal data, have taken confidentiality commitment and are aware of the personal data legislation.
The Controller has taken steps to ensure that any natural person acting under his authority who has access to personal data does not process them except on instructions from the Controller, unless he or she is required to do so by Union or Member State law.
VIII. Period for which the personal data will be stored
Personal data is stored up until the termination of user’s account.
IX. Rights of the Data subjects
- 1. The Data subject shall have the right to obtain from the Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
- 1.1. the purposes of the processing;
- 1.2. the categories of personal data concerned;
- 1.3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
- 1.4. the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- 1.5. the existence of the right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data concerning the Data subject or to object to such processing
- 1.6. the right to lodge a complaint with a supervisory authority;
- 1.7. where the personal data are not collected from the Data subject, any available information as to their source;
- 1.8. the existence of automated decision-making, including profiling.
2. The Controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the Data subject, the latter shall pay the administrative costs for the same.
3. Where the Data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
4. The Data subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning him or her.
5. The Data subject has the right to the terminate his account and respectively obtain from the Controller the erasure of personal data concerning him or her without undue delay and the Controller has the obligation to terminate the account and erase the personal data without undue delay.
- 6. The Data subject has the right to obtain from the Controller restriction of processing where one of the following applies:
- 6.1. the accuracy of the personal data is contested by the Data subject, for a period enabling the Controller to verify the accuracy of the personal data;
- 6.2. the processing is unlawful and the Data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- 6.3. the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data subject for the establishment, exercise or defence of legal claims;
- 6.4. the Data subject has objected to processing pending the verification whether the legitimate grounds of the Controller override those of the Data subject.
7. The Controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with item 4. – 6. to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Controller shall inform the Data subject about those recipients if the Data subject requests it.
- 8. The Data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Controller to which the personal data have been provided, where:
- 8.1. the processing is based on consent or on a contract; and
- 8.2. the processing is carried out by automated means.
9. In exercising his or her right to data portability pursuant to item 8., the Data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
10. Where personal data are processed for direct marketing purposes, the Data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
11. Where the Data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
12. The Data subject may exercise his or her right to object by automated means using technical specifications.
13. The Data subject has the right to withdraw his or her consent for processing of his or her personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
14. Every Data subject has the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States of his or her habitual residence, place of work or place of the alleged infringement if the Data subject considers that the processing of personal data relating to him or her is in breach of the provisions of the Regulation.
15. The Controller undertakes to take all necessary action at the request of the Data subject for the exercise of his rights under the Regulation, and the Controller has the right to refuse only in cases where the Controller is unable to identify the Data subject.
16. The Controller shall provide information on action taken on a request to the Data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Controller shall inform the Data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the Data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the Data subject.
17. If the Controller does not take action on the request of the Data subject, the Controller shall inform the Data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
18. In the case of a personal data breach, the Controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
19. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Controller shall communicate the personal data breach to the Data subject without undue delay.
X. Security of the personal data
The Controller has implemented appropriate technical and organisational measures to ensure that processing is carried out in accordance with the Regulation.
- The Controller has implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- 1. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
- 2. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
- 3. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
The Controller documents any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.
The Controller does not perform automated decision-making and profiling.
The Controller may periodically update this Policy and publish the updated Policy on the Website. If the changes in the Policy are important and they substantially alter the rules on data protection, The Controller will further notify the users through other means, such as by email or notice, before the changes come into force.
If you believe that any information about you is false or inaccurate, please inform us as soon as possible on support@Iris.ai.
Last updated: 25 May 2018