This policy concerns the Processing (as this term is defined below) of Personal Data (as this term is defined below) carried out by the Municipality of Geroskipou (hereinafter the «Data Controller» or «Municipality»). The Municipality, as a local government authority, is a legal entity under public law whose establishment and operation are governed by the Municipalities Law, L. 111/1985, and is based at Geroskipou Square, 8201, Geroskipou. In the course of carrying out its services and/or duties and/or activities, the Municipality processes a large volume of data, including the Personal Data (as this term is defined below) of residents, its employees and/or associates, the members of its council and other natural persons who use its services, submit requests or come into contact with the Municipality.

The Municipality recognises that it has a duty to process Personal Data in accordance with the European General Data Protection Regulation (EU) 2016/679 (hereinafter the «Regulation») and is committed to protecting your privacy and processing your Personal Data on the basis of the principles of lawfulness, fairness and transparency.

This policy covers and concerns the conditions for the collection, storage and management of Personal Data by the Municipality and is addressed to natural persons who have benefited, are benefiting or intend to benefit from the services and/or activities of the Municipality, to associates, employees, residents, as well as to natural persons who maintain a contractual relationship with the Municipality or had a contractual relationship with the Municipality in the past and/or submit any applications/complaints/enquiries to the Municipality and/or come into contact with the Municipality. It is important that you read this policy, which we apply when we collect or use your Personal Data, so that you are fully informed about the Municipality’s practices for the protection of Personal Data.

1. Definitions: For the purposes of this Personal Data Protection Policy, the following terms shall have the meanings set out below:

«Personal Data» or «your Personal Data»): any information relating to a natural person who is regarded as the «Data Subject» (as this term is defined below) and who is identified or identifiable from the information. In other words, any information relating to a natural person whose identity can be established, directly or indirectly, from the information,
«Data Subject» «you» or «your»: the natural person to whom the Personal Data refers and whose identity is known or can be established,
«Processing»: any operation or set of operations performed on Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, and
«Processor»: the natural or legal person, public authority, agency or other body that processes Personal Data on behalf of the Data Controller.

2. The Municipality may collect your Personal Data in various ways, such as:

by electronic means (such as email, the Municipality’s website, video cameras, an employee location tracking system (GPS), an employee arrival and departure time recording system),
when you submit an application to participate in public tenders and/or competitions announced by the Municipality,
in the performance of a task carried out in the public interest by the Municipality, such as the on-site examination of complaints,
through a letter or application/request in printed and/or electronic form,
through the submission of a job application or CV to the Municipality and/or the conduct of job interviews,
through the Municipality’s customer service centre and/or by telephone,
through government authorities or services such as the Department of Lands and Surveys, or from sources available to the public, which we obtain lawfully and are permitted to process,
through the Municipality’s records,
through registration to receive services provided by the Municipality,
through the recording of details of your visit to the Municipality, and/or
through third-party natural or legal persons.

3. Your Personal Data is processed by the Municipality primarily for the following purposes:

maintaining a register of the Municipality’s residents,
managing the assessment, issuance and collection of taxes/fees/charges and other revenues of the Municipality, including benefits and grants, and granting reductions to eligible persons,
providing social support services,
providing sanitary services, such as waste collection, clearing of plots, removal of prunings, management of abandoned vehicles and carrying out sanitary inspections,
issuing licences and certificates under various pieces of legislation,
issuing out-of-court notices under the law,
handling complaints,
performing civil marriages,
participating in European programmes,
applying the Out-of-Court Settlement of Traffic Offences Law and related Regulations,
providing recreational, cultural and other services,
holding events,
conducting health and public awareness campaigns,
managing the Municipality’s property,
maintaining the Municipality’s accounts and records,
recruiting, supporting, assessing and managing the Municipality’s employees,
making or collecting payments and paying salaries to the Municipality’s staff,
purchasing services and goods and obtaining tenders,
promoting the services provided by the Municipality and providing information about the Municipality’s events,
operating the Municipal Athletic Centre and Swimming Pool,
managing archived records for historical, statistical and research reasons or purposes in the public interest,
administering the Municipality and all activities that the Municipality is required to carry out under the law,
operating a library, and
ensuring the protection of the Municipality’s premises, assets, staff and visitors.

Note: An essential precondition for accepting the payment of fees/taxes/charges from third parties on your behalf and delivering the payment receipt to the third party is the presentation of an invoice and/or written authorisation from the third party to the Municipality’s cash desks.

4. In order for the Municipality to fulfil its duties in the public interest, as well as for the purposes of performing its contractual obligations, complying with its legal obligations and for other ancillary purposes described in more detail below, the Municipality may collect from you – among other things – Personal Data falling within the following categories:

identity details (such as full name, identity card or passport number and/or copy, date of birth, utility account, social insurance number),
details relating to your personal and family situation (such as details of your spouse and children),
details relating to your social and financial situation (such as details of immovable property),
data relating to the provision of goods and services to the Municipality,
financial details (such as the financial statements of the Municipality’s tenderers, the VAT number of the Municipality’s associates and tenderers),
details relating to your employment and education (such as CVs and copies of the academic and professional qualifications of candidates for employment with the Municipality),
images and data relating to your appearance and conduct (such as photographic or video footage within the Municipality’s premises, location data of the Municipality’s vehicles while on duty),
data relating to the licences and/or rights held by you, and
contact details (such as telephone number, fax number, postal address, billing address, email address).

In addition, with your explicit consent, or, among other things, where required for reasons of substantial public interest, for the purpose of assessing an employee’s working capacity, for the performance of obligations in the field of employment law, for the establishment, exercise or defence of legal claims, as well as in accordance with other legal bases for Processing provided for by the Regulation, the Municipality may collect Personal Data relating to criminal convictions and offences or falling within special categories such as racial or ethnic origin, political opinions, philosophical or religious beliefs, health data, genetic or biometric data, trade union membership and so on.

The collection of your Personal Data will always be for a specific purpose or set of related purposes. However, if we intend to use your Personal Data for other new purposes, we will first contact you where this is required by the Regulation. For example, in certain cases the Municipality may wish to use your information to improve and develop its services or to prevent and/or detect fraud. Where feasible and reasonable, we will always seek to inform you of any significant proposed changes to the way in which we process or intend to process your Personal Data, in order to ensure full transparency regarding how we handle your information.

5. The Municipality will ensure that it meets the necessary conditions for the lawful processing of your Personal Data and will ensure that this is adequately documented. There are several ways in which processing may be lawful – obtaining consent is one method of ensuring lawful processing – but it should be stressed that obtaining consent is not always necessary and the Municipality may lawfully process your Personal Data provided one of the following legal bases is met:

Processing is necessary for the performance of the Municipality’s contractual obligations (such as paying the Municipality’s associates), and/or
Processing is necessary for the fulfilment of the Municipality’s legal obligations (such as the obligation to pay social insurance contributions for the Municipality’s employees under the law), and/or
Processing is necessary for the purposes of the legitimate interests of the Municipality in cases where it carries out Processing for purposes other than the performance of its duties in the public interest, and/or
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Municipality (such as collecting taxes/fees/charges, examining and processing technical applications, or resolving complaints), and/or
Processing is necessary in order to protect your vital interests or the vital interests of another natural person, and/or
on the basis of your consent (such as contacting you with information about the Municipality’s events after obtaining your consent to be contacted).

6. With whom is your Personal Data shared?

In certain cases the Municipality needs to disclose or exchange information internally between its various services or departments and the members of the Municipal Council, as well as externally with other organisations, such as the Municipality’s associates and subcontractors (such as IT consultants, suppliers, auditors and legal advisors), government bodies and state authorities, insurance companies, banking institutions, charitable or social welfare organisations, educational institutions and other third parties. The Municipality will make such disclosures or exchanges only where it is appropriate and lawful to do so, for example, if there is a risk of serious harm or threat to life, for the prevention and detection of fraud or crime, for the assessment of any tax or duty, or if required by any court or law. Whenever such disclosure or exchange is deemed necessary, it will take place in accordance with the provisions of the Regulation and any other data protection legislation.

7. Automated individual decision-making – profiling:

Profiling means any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate personal aspects of a natural person, in particular to analyse or predict aspects concerning that person’s personal preferences, interests and/or movements. Automated decision-making occurs when an electronic system processes Personal Data to make a decision without human intervention. The Municipality does not carry out automated decision-making. Should the Municipality carry out such Processing, you will be informed in writing before the start of that Processing.

8. Transfer of your Personal Data to Third Countries or to an International Organisation outside the European Union:

In cases where the transfer of Personal Data to a third country or international organisation is necessary, any transfer that takes place will be in full compliance with the Regulation.

The Municipality transfers Personal Data to countries outside the European Union only in very limited cases, such as where this is necessary for the purpose of arranging the business travel of members of the Municipality’s staff to a third country in order to obtain an entry and residence permit for that third country.

9. Period for which the Municipality retains your Personal Data:

Your Personal Data is retained for as long as is necessary to fulfil the purposes for which it was collected, including, among other things, to satisfy any legal, contractual, regulatory or accounting requirements.

Note:

Some of the Municipality’s records form part of the State Archive (as this term is defined in the State Archive Law (L. 208/1991)). Under the State Archive Law, all legislative, administrative and judicial records of Local Government Authorities constitute public records. The deletion of these records is subject to the approval of the State Archive Commissioner in relation to the obligation of permanent retention.

10. What are your rights in relation to your Personal Data?

right of access: for the purpose of exercising the right of access to your Personal Data, you may obtain a copy of the Personal Data that the Municipality holds about you,
right to rectification: you may request the correction of your details by the Municipality,
right to erasure: you have the right to submit a request for the erasure of your Personal Data where its Processing is based on your consent or on the fact that it is necessary for the purposes of the Municipality’s legitimate interests. In all other cases (such as, indicatively, where there is a contract between you and the Municipality, an obligation to process Personal Data imposed by law, or Processing for the purpose of performing a task in the public interest), this right is subject to specific limitations or does not exist depending on the case,
right to restriction: you have the right to request the restriction of the Processing of your Personal Data if you find that it is inaccurate or has been used unlawfully, is no longer necessary, or you have requested that the use of your Personal Data be stopped but it has not yet been confirmed whether the Municipality has legitimate grounds for using it,
right to object: you have the right to object in cases where the Municipality processes your Personal Data when the legal basis for the Processing is the performance of a task carried out in the public interest or where it is deemed necessary for the purpose of legitimate interests pursued by the Municipality (unless the Municipality is able to demonstrate that the Processing is carried out for legitimate reasons which override your interests, rights and freedoms). In addition, you have the right to object to Processing carried out for direct marketing purposes or for the purposes of scientific or historical research or for statistical purposes on grounds relating to your particular situation,
right to portability: you have the right to receive, free of charge, your Personal Data in a format that allows you to access, use and process it using commonly used processing methods. You also have the right to request that the Municipality, where technically feasible, transmit the data directly to another controller. This right of yours applies to data that you have provided to us and whose Processing is carried out by automated means on the basis of your consent or for the performance of a relevant contract,
right not to be subject to automated individual decision-making: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you,
right to withdraw consent: where Processing is based on your consent, you have the right to withdraw it freely. Any withdrawal of your consent does not affect the lawfulness of the Processing based on your original consent before it was withdrawn or revoked by you, and/or
right to lodge a complaint with the Personal Data Protection Authority (the «PDPA»), namely the Office of the Commissioner for Personal Data Protection: you have the right to lodge any complaint with the PDPA if you consider that any of your above rights have been violated by the Municipality (commissioner@dataprotection.gov.cy).

Please note that if your Personal Data has been provided to the Municipality by a third party, you must contact that third party/organisation in order to submit the above requests.

To exercise any of your above rights, you may contact us at dpo@geroskipou.org.cy or at the Municipality’s offices at Geroskipou Square, or submit a request through the relevant request submission form on our website.

11. Changes to your Personal Data:

If there are changes to your circumstances and personal details, you must notify us immediately so that we can maintain an accurate and up-to-date record of your information.

12. Response time:

We strive to respond to submitted requests as soon as possible and within a period of one month. However, if the request is complex or several requests are submitted together, we may need more time and you will be informed accordingly.

13. Personal Data security:

The Municipality takes seriously the risks involved in the use of the internet and information systems and applies appropriate security measures to protect the Personal Data it processes from accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, or any other form of unlawful Processing. It assesses and manages, as far as possible, threats, any vulnerabilities of the existing protection measures and changes in the Municipality’s operations and systems through periodic security reviews, and develops plans to improve the level of personal data protection on an ongoing basis.
The Municipality’s comprehensive approach to the security of the information it holds is included in the Municipality’s data protection system, which aims to ensure the confidentiality, integrity and availability of personal data. The data protection system includes, among other things, the information security policy, data governance, and the technical and organisational measures and security controls covering all information assets in electronic or physical form.
In addition, the Municipality ensures that its staff faithfully apply information security and physical security measures and procedures, and requires that any Processors who process Personal Data on behalf of the Municipality be subject to an obligation to sign and comply with relevant confidentiality clauses.
Any security incidents that may result in breaches of your Personal Data are managed by the Municipality with a specific response plan. The data breach response plan describes the mechanisms that the Municipality has established for containing, handling, notifying where necessary, and correcting and improving in order to address any risks arising from data breaches.

14. Changes to this Personal Data Protection Policy:

This statement will be revised where necessary to adapt to legislative changes, to respond to the comments and needs of data subjects, and to changes in the Municipality’s products, services and internal procedures. Every change will be published, with a simultaneous revision of the last-updated date at the top of this statement – Personal Data Protection Policy.