Corporate Data Protection Policy

Data Protection Policy for Personal Data

BELPORT TOURISMUS UND BAU INDUSTRIE HANDEL AG

1. Purpose

The right to the protection of personal data is a fundamental right of personality. As BELPORT TOURISMUS UND BAU INDUSTRIE HANDEL AG, we consider compliance with this right to be one of our most important obligations. This policy was created to establish the principles, procedures, and measures we apply when processing and protecting personal data. Scope

2. Scope

This policy applies to all personal data processed by BELPORT. This includes the collection, storage, retention, modification, transmission, classification, provision, and deletion of personal data through both automated and non-automated processes. This policy applies to the personal data of shareholders, employees, customers, suppliers, business partners, and other third parties. Definitions 3. Definitions

Term Definition
Explicit consent Voluntary and informed consent for a specific purpose.
Personal data Any information relating to an identified or identifiable natural person.
Data subject The natural person whose personal data is being processed.
Data controller Natural or legal person who, for purposes and decides on the means of data processing.
Data Processor Natural or legal person who processes personal data on behalf of the controller.
Anonymization Processing personal data in such a way that identification of the data subject is excluded.

4. General Principles

  • Processing in accordance with law and good faith.
  • Ensuring the accuracy and timeliness of the data.
  • Processing for explicit, legitimate, and lawful purposes.
  • Restricting processing to what is necessary.
  • Storage only for the period required by law or as necessary.

5. Technical Security Measures

  • Network and application security.
  • Use of current antivirus solutions.
  • Firewall systems.
  • Regular backup of personal data.
  • Encryption of sensitive data.
  • Access and authorization management.
  • Maintaining and monitoring access logs.
  • Protection of physical data processing environments.

6. Organizational Security Measures

  • Regular employee training.
  • Confidentiality agreements.
  • Company policies on information security and data protection.
  • Risk assessment and risk monitoring.
  • Internal audits and controls.
  • Roles and permissions management.
  • Security measures for special categories of personal data.

7. Rights of Data Subjects

  • Right to information about the processing of personal data.
  • Right to obtain information about the purposes of processing.
  • Right to request the correction of inaccurate or incomplete data.
  • Right to request the erasure or anonymization of personal data.
  • Information

PDPL