This policy concerns the Processing (as this term is interpreted below) of Personal Data (as this term is interpreted below) carried out by the Municipality of Geroskipou (hereinafter the «Data Controller» or «Municipality»). The Municipality, as a local government authority, is a legal entity governed by public law, whose establishment and operation are governed by the Municipalities Law, Law 111/1985, and it is based at Geroskipou Square, 8201, Geroskipou. In carrying out its services and/or duties and/or activities, the Municipality processes a large volume of data, including Personal Data (as this term is interpreted below) of residents, employees and/or associates, members of its council, and other natural persons who use its services, submit requests, or come into contact with the Municipality.

The Municipality recognises that it has a duty to process Personal Data in accordance with the European General Data Protection Regulation (EU) 2016/679 (hereinafter the «Regulation») and is committed to protecting your privacy and processing your Personal Data on the basis of the principles of lawfulness, fairness and transparency.

This policy covers and concerns the conditions for the collection, storage and management of Personal Data by the Municipality and is addressed to natural persons who have benefited, are benefiting, or intend to benefit from the services and/or activities of the Municipality, to associates, employees, residents, as well as to natural persons who maintain a contractual relationship with the Municipality or had a contractual relationship with the Municipality in the past and/or who submit any applications/complaints/enquiries to the Municipality and/or who come into contact with the Municipality. It is important that you read this policy, which we apply when we collect or use your Personal Data, so that you are fully informed about the Municipality’s practices for the protection of Personal Data.

1. Definitions: For the purposes of this Personal Data Protection Policy, the following terms shall mean:

• «Personal Data» or «your Personal Data»): any information relating to a natural person who is regarded as the «Data Subject» (as this term is interpreted below) and who is identified or identifiable from the information. In other words, any information relating to a natural person whose identity can be established, directly or indirectly, from the information,
• «Data Subject», «you» or «your»: the natural person to whom the Personal Data relate and whose identity is known or can be established,
• «Processing»: any operation or set of operations performed on Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, and
• «Processor»: the natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Data Controller.

2. The Municipality may collect your Personal Data in various ways, such as:

• by electronic means (such as by email, through the Municipality’s website, by video cameras, through an employee location tracking system (GPS), through a system that records employees’ arrival and departure times),
• when you submit an application to participate in public tenders and/or competitions announced by the Municipality,
• when the Municipality performs a task in the public interest, such as the on-site examination of complaints,
• through a letter or an application/request in printed and/or electronic form,
• through the submission of a job application or curricula vitae to the Municipality and/or the conduct of job interviews,
• through the Municipality’s customer service centre and/or by telephone,
• through state authorities or services such as the Department of Lands and Surveys, or from publicly available sources which we obtain lawfully and are permitted to process,
• through the Municipality’s records,
• through registration to receive services provided by the Municipality,
• through the recording of details of your visit to the Municipality, and/or
• through third-party natural or legal persons.

3. Your Personal Data are processed by the Municipality mainly for the following purposes:

• maintaining a register of the Municipality’s residents,
• managing the assessment, issuance and collection of taxes/fees/charges and other revenues of the Municipality, including benefits and grants, and granting reductions to eligible beneficiaries,
• providing social support services,
• providing sanitation services, such as refuse collection, clearing of plots, removal of prunings, management of abandoned vehicles, and the conduct of health inspections,
• issuing licences and certificates under various laws,
• issuing out-of-court notices under the law,
• managing complaints,
• conducting civil marriages,
• participating in European programmes,
• applying the Extrajudicial Settlement of Traffic Offences Law and related Regulations,
• providing recreational, cultural and other services,
• holding events,
• conducting health and public awareness campaigns,
• managing the Municipality’s property,
• maintaining the Municipality’s accounts and records,
• recruiting, supporting, evaluating and managing the Municipality’s employees,
• making or collecting payments and paying the salaries of the Municipality’s staff,
• procuring services and goods and inviting tenders,
• promoting the services provided by the Municipality and informing the public about the Municipality’s events,
• operating the Municipal Sports Centre and Swimming Pool,
• managing archived records for historical, statistical and research purposes or purposes in the public interest,
• administering the Municipality and all activities that the Municipality is required to carry out under the law,
• operating a library, and
• ensuring the protection of the Municipality’s premises, assets, staff and visitors.

Note: A necessary condition for accepting the payment of fees/taxes/charges by third parties on your behalf and for delivering the payment receipt to the third party is the presentation of an invoice and/or written authorisation from the third party at the Municipality’s cash desks.

4. In order for the Municipality to fulfil its duties in the public interest, as well as for the purpose of performing its contractual obligations, complying with legal obligations, and for other ancillary purposes described more fully below, the Municipality may collect from you – among other things – Personal Data falling within the following categories:

• identity details (such as full name, identity card or passport number and/or copy, date of birth, utility account, social insurance number),
• details concerning your personal and family situation (such as details of your spouse and children),
• details concerning your social and financial situation (such as details of immovable property),
• data concerning the provision of goods and services to the Municipality,
• financial details (such as the financial statements of the Municipality’s tenderers, the VAT number of the Municipality’s associates and tenderers),
• details concerning your employment and education (such as curricula vitae and copies of the academic and professional qualifications of candidates for employment with the Municipality),
• images and data concerning your appearance and conduct (such as photographic or video footage within the Municipality’s premises, location data of the Municipality’s vehicles while on duty),
• data concerning the licences and/or rights held by you, and
• contact details (such as telephone number, fax number, postal address, billing address, email address).

In addition, with your explicit consent, or, among other things, where required for reasons of substantial public interest, for the purpose of assessing an employee’s fitness for work, for the performance of obligations in the field of employment law, for the establishment, exercise or defence of legal claims, as well as in accordance with other legal bases for Processing provided for by the Regulation, the Municipality may collect Personal Data relating to criminal convictions and offences, or falling within special categories such as racial or ethnic origin, political opinions, philosophical or religious beliefs, health data, genetic or biometric data, trade union membership, and so on.

The collection of your Personal Data will always be for a specific purpose or a set of related purposes. However, if we intend to use your Personal Data for other new purposes, we will contact you first where this is required by the Regulation. For example, in certain cases the Municipality may wish to use your information to improve and develop its services or to prevent and/or detect fraud. Where feasible and reasonable, we will always seek to inform you of any significant proposed changes to the way in which we process or intend to process your Personal Data, in order to ensure full transparency about how we handle your information.

5. The Municipality will ensure that it meets the necessary conditions for the lawful processing of your Personal Data and will ensure that this is adequately documented. There are several ways in which processing can be lawful – obtaining consent is one method of ensuring lawful processing – but it is emphasised that obtaining consent is not always necessary and the Municipality may lawfully process your Personal Data provided that one of the following legal bases is met:

• the Processing is necessary for the fulfilment of the Municipality’s contractual obligations (such as paying the Municipality’s associates), and/or
• the Processing is necessary for the fulfilment of the Municipality’s legal obligations (such as the obligation to pay the social insurance contributions of the Municipality’s employees under the law), and/or
• the Processing is necessary for the purposes of the Municipality’s legitimate interests in cases where it carries out Processing for purposes other than the performance of its duties in the public interest, and/or
• the Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Municipality (such as the collection of taxes/fees/charges, the examination and processing of technical applications, or the resolution of complaints), and/or
• the Processing is necessary in order to protect your vital interests or the vital interests of another natural person, and/or
• on the basis of your consent (such as contacting you to provide information about the Municipality’s events after obtaining your consent to the communication).

6. Where are your Personal Data disclosed?

In certain cases the Municipality needs to disclose or exchange information internally between its various services or departments and the members of the Municipal Council, as well as externally with other organisations, such as the Municipality’s associates and subcontractors (such as IT consultants, suppliers, auditors and legal advisers), government bodies and state authorities, insurance companies, banking institutions, charitable or social welfare organisations, educational institutions and other third parties. The Municipality will make such disclosures or exchanges only where it is deemed appropriate and lawful to do so, for example, if there is a risk of serious harm or threat to life, for the prevention and detection of fraud or crime, the assessment of any tax or duty, or if required by any court or law. Whenever such disclosure or exchange is deemed necessary, it will take place in accordance with the provisions of the Regulation and any other data protection legislation.

7. Automated individual decision-making – profiling:

Profiling means any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate personal aspects of a natural person, in particular to analyse or predict aspects concerning that person’s personal preferences, interests and/or movements. Automated decision-making occurs when an electronic system processes Personal Data to make a decision without human intervention. The Municipality does not carry out automated decision-making. Should the Municipality carry out such a type of Processing, you will be informed in writing before that Processing begins.

8. Transfer of your Personal Data to Third Countries or to an International Organisation outside the European Union:

In cases where it is necessary to transfer Personal Data to a third country or international organisation, any transfer that takes place will be in full compliance with the Regulation.

The Municipality transfers Personal Data to countries outside the European Union in very limited cases, such as where this is necessary for the purpose of arranging business travel of the Municipality’s staff members to a third country in order to obtain an entry and residence permit in that third country.

9. Period for which the Municipality retains your Personal Data:

Your Personal Data are retained for as long as is necessary to carry out the purposes for which they were collected, such as, among other things, to satisfy any legal, contractual, regulatory or accounting requirements.

Note:

Some of the Municipality’s records form part of the State Archive (as this term is interpreted in the State Archive Law (Law 208/1991)). Under the State Archive Law, all legislative, administrative and judicial records of Local Government Authorities constitute public records. The deletion of these records is subject to the approval of the Keeper of the State Archive in relation to the obligation of permanent preservation.

10. What are your rights in relation to your Personal Data?

• right of access: for the purpose of exercising the right of access to your Personal Data, you may obtain a copy of the Personal Data that the Municipality holds about you,
• right to rectification: you may request the correction of your details by the Municipality,
• right to erasure: you have the right to submit a request for the erasure of your Personal Data when their Processing is based on your consent or on the fact that it is necessary for the purposes of the Municipality’s legitimate interests. In all other cases (such as, indicatively, where there is a contract between you and the Municipality, an obligation to Process Personal Data imposed by law, or Processing for the purpose of performing a task in the public interest), this right is subject to specific restrictions or does not exist, depending on the case,
• right to restriction: you have the right to request the restriction of the Processing of your Personal Data if you find that it is inaccurate or has been used unlawfully, is no longer necessary, or you have requested that the use of your Personal Data cease but it has not been confirmed that the Municipality has legitimate grounds for using it,
• right to object: you have the right to object in cases where the Municipality Processes your Personal Data when the legal basis for the Processing is the performance of a task carried out in the public interest or where it is deemed necessary for the purpose of legitimate interests pursued by the Municipality (unless the Municipality is able to demonstrate that the Processing is carried out on legitimate grounds which override your interests, rights and freedoms). In addition, you have the right to object to Processing carried out for the purposes of direct marketing or for the purposes of scientific or historical research or for statistical purposes on grounds relating to your particular situation,
• right to portability: you have the right to receive your Personal Data free of charge in a format that will allow you to access, use and process it using commonly used processing methods. You also have the right to request the Municipality, where technically feasible, to transmit the data directly to another data controller. This right exists for data that you have provided to us and whose Processing is carried out by automated means on the basis of your consent or for the performance of a relevant contract,
• right not to be subject to automated individual decision-making: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you,
• right to withdraw consent: where the Processing is based on your consent, you have the right to withdraw it freely. Any withdrawal of your consent does not affect the lawfulness of the Processing based on your original consent before it was withdrawn or revoked by you, and/or
• right to lodge a complaint with the Office of the Commissioner for Personal Data Protection (the «Commissioner»): you have the right to lodge any complaint with the Commissioner if you consider that any of your above rights have been violated by the Municipality (commissioner@dataprotection.gov.cy).

Please note that if your Personal Data were provided to the Municipality by a third party, you must contact that third party/organisation to submit the aforementioned requests.

To exercise any of your above rights, you may contact us directly at the Municipality’s offices at Geroskipou Square or submit a request through the relevant request submission form on our website.

11. Changes to your Personal Data:

If there are changes to your circumstances and personal details, you must notify us immediately, so that we can maintain an accurate and up-to-date record of your information.

12. Response time:

We endeavour to respond to requests submitted as soon as possible and within a timeframe of one month. However, if the request is complex or several requests are submitted together, we may need more time and you will be informed accordingly.

13. Personal Data Security:

• The Municipality takes seriously the risks involved in the use of the internet and information systems and applies appropriate security measures to protect the Personal Data it processes from accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, or any other form of unlawful Processing. It assesses and manages, as far as possible, the threats, any vulnerabilities of the existing protection measures, and changes to the Municipality’s operations and systems through periodic security reviews, and develops plans to improve the level of protection of personal data on an ongoing basis.
• The Municipality’s integrated approach to the security of the information it holds is included in the Municipality’s data protection system, which aims to ensure the confidentiality, integrity and availability of personal data. The data protection system includes, among other things, the information security policy, data governance, and the technical and organisational measures and security controls for all information assets in electronic or physical form.
• In addition, the Municipality ensures that its staff faithfully apply the information security and physical security measures and procedures, and requires that any Processors who process Personal Data on behalf of the Municipality be subject to an obligation to sign and observe relevant confidentiality clauses.
• Any security incidents from which breaches of your Personal Data may arise are managed by the Municipality through a specific response plan. The data breach response plan describes the mechanisms that the Municipality has established for containment, handling, notification where necessary, as well as correction and improvement, in order to address any risks arising from data breaches.

14. Changes to this Personal Data Protection Policy:

The Municipality reserves the right to revise this personal data protection policy when deemed necessary. For any amendments to this policy, the public will be informed immediately and the stated revision date will be changed.