Data Protection Policy

13. Data subject’s rights in the EU

InnovA’s Staff must be aware of the data subject’s rights of persons in the EU, which can exercise it and can submit a number of requests to InnovA as described hereunder. Individuals in the UK will have the same rights as the UK GDPR mirrors the EU GDPR. InnovA shall apply the same data subject rights to persons outside of the UK / EU, unless otherwise provided in this Policy.

Upon receipt of a request, InnovA’s Staff shall verify whether InnovA acts as a controller / processor. If InnovA is not a controller, but merely a processor, you should inform the data subject and refer them to the actual controller.

13.1. Right to be informed about the personal data collection and information;

If the personal data was collected directly from the data subject, the latter has the right to be informed about:

• the identity and the contact details of the controller and, where applicable, of the controller’s representative;
• the contact details of the DPO, where applicable;
• the purposes of the processing for which the personal data is intended as well as the legal basis for the processing;
• where the processing is based on point (f) of Article 6.1 of the GDPR, the legitimate interests pursued by the controller or by a third party;
• the recipients or categories of recipients of the personal data, if any;
• where applicable, the fact that the controller intends to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47 of the GDPR, or the second subparagraph of Article 49.1 GDPR, reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
• the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
• where the processing is based on point (a) of Article 6(1) or point (a) of Article 9.2 GDPR, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• the right to lodge a complaint with a supervisory authority;
• whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
• the existence of automated decision-making, including profiling, referred to in Article 22.1 and 22.4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
• If InnovA intends to further process the personal data for a purpose other than that for which the personal data were collected, we shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information.

If the personal data was not collected directly from the data subject, the latter must be informed about:

• the identity and the contact details of the controller and, where applicable, of the controller’s representative;
• the contact details of the data protection officer, where applicable;
• the purposes of the processing for which the personal data is intended as well as the legal basis for the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients of the personal data, if any;
• where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organization and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47 GDPR, or the second subparagraph of Article 49(1) GDPR, reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.
• the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
• where the processing is based on point (f) of Article 6(1) GDPR, the legitimate interests pursued by the controller or by a third party;
• the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;
• the right to lodge a complaint with a supervisory authority;
• from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

13.2. Right of access

Data subjects have the right to obtain confirmation as to whether or not personal data concerning to him / her are being processed and, where that is the case, access to the personal data and the following information:

• The purpose of the processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular, recipients in third countries (i.e. non-EEA countries) or international organisations;
• Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• The existence of the request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• The right to lodge a complaint with the supervisory authority;
• Where the personal data wasn’t collected from the data subject, any available information as to their source;
• The existence of automated-decision making tools.

Data subjects can request a copy of all the personal data that InnovA is processing related to them in a machine-readable format at any time. However, if an access request by an individual includes information about others, their rights must also be adequately protected and balanced with the foregoing request. In certain situations, the personal data may be redacted before its disclosure. If that would turn out to be impossible or apparently unreasonable, the consent of the other involved persons should be required before the access request is finally granted.

Such a request may also be requested by a third-party on behalf of the concerned data subject, e.g. accountant, lawyer or any other person. Should this happen, personal data can only be disclosed once it has been sufficiently ensured that the third party making the request is entitled to do it. While it is the third party’s responsibility to provide evidence on this entitlement, as a part of the process, the nature of the request as a proxy request and retain proof of the entitlement, whether it is a written authority to make the request or a more general power of attorney.

13.3. Right to withdraw consent for processing

It is important to understand that consent may be withdrawn at any time by the data subject when the data processing is based on the consent of the data subject.

The consent must be withdrawn:

• Completely;
• In a timely manner;
• Free of costs for the data subject that had withdrawn the consent;
• In the same form that the request was made, unless the data subject would request it otherwise. Should this be the case, the responsible person should document this action.
• The withdrawal can be performed through the following mechanisms:
• Opt-out links in mailings or electronic communications;
• Opt-out process explanation and steps on website and in all written communications;
• Ability to opt-out verbally, in writing or by email.

13.4. Request to move their data to a different organisation in a machine-readable format

Data subjects have the right to receive the personal data that is processed by InnovA in a structured, commonly used and machine-readable format.

InnovA should facilitate this transfer to another organization where the data subject wants to have the personal data transferred to or send it directly to the data subject.

Should this request take place, please consult … for further guidance/assistance.

13.5. Right to rectification

Data subjects have the right to request rectification of any inaccurate personal data that is processed by InnovA. Data subjects have the right to provide additional personal data that is necessary to complete any missing information.

This should be done without unreasonable delay.

13.6. Right to erasure

Data subjects have the right to request the erasure of the personal data in full / partially that is processed by InnovA. This right is applicable under the GDPR only if the request meets one of six specific conditions as described under Article 17 of the GDPR:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
• the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1) GDPR, or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing;
• the data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR;
• the personal data has been unlawfully processed;
• the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
• the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

You can however deny this request if the processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• for the establishment, exercise or defence of legal claims.

13.7. Right to object to, or limit to restrict, the use of data

The data subject shall have the right to obtain the restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;
• the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

A data subject who has obtained restriction of processing pursuant to the paragraph above shall be informed by the controller before the restriction of processing is lifted.

13.8. Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

• the processing is based on consent on a contract to which the data subject is party to; and (the processing is carried out by automated means.
• In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
• The exercise of this right shall be without prejudice to the right to be forgotten. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

When processing such request, InnovA’s Staff must be aware that the right to data portability of an individual shall not adversely affect the rights and freedoms of others.

13.9. Right to object to automated individual decision-making

Data subjects have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the legitimate interests of the controller, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

13.10. Information about the data recipients

Data subjects are also entitled to request information about the identities of recipients to whom InnovA has disclosed or intends to disclose the personal data.

If the data subject has subsequently exercised the right of rectification, erasure or blocking, InnovA shall make all reasonable efforts to notify all those third-parties of the data subject’s exercise of the foregoing rights. If this action would involve a disproportionate effort, InnovA is exempt from this obligation. However, this disproportionate effort will have to be proven by InnovA.

If you have doubts on assessing whether disproportionate efforts are necessary, you should clarify this with the DPO or the responsible privacy person / department.

13.11. Right to filling complaints

Data subjects have the right to file complaints with their relevant data protection authority in their country in relation to InnovA’s processing of their personal data. When data subjects exercise their rights, InnovA should also inform the latter about the possibility to submit an official complaint to the relevant authority.

The responsible Staff must also be aware that according to agreement where InnovA is part of, InnovA must inform its Customer(s) without unreasonable delay about any complaint or request in particular, requests for access, rectification, erasure, restriction, portability, blocking or deletion of Customer Personal Data received directly from data subjects of Customer(s). InnovA will not substantively respond to any such request without Customer’s prior written authorization.

InnovA shall also inform the Customer if an official complaint is submitted against InnovA and/or the Customer.

a.    CCPA

A consumer complaint under the CCPA can be submitted here: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

b.    EU

For data subjects in the European Union, the appropriate data protection authorities are listed here: https://edpb.europa.eu/about-edpb/board/members_en.

c.     UK

For data subjects in the United Kingdom, the appropriate data protection authority is the Information Commissioner’s Office and a complaint can be issued here: https://ico.org.uk/make-a-complaint/

13.12. Third party data processors

InnovA has outsourced a number of processing activities to third-parties processors as described hereunder:

Subprocessor	Subject matter	Nature	Duration of processing
Microsoft Azure	Cloud storage	Collection, structuring, storage, access, correction, adaptation, alteration, dissemination, erasure, restriction, destruction	Linked to the purpose of the Services provided by InnovA and to the duration of the Agreement.
Twilio	Communication	Collection, structuring, storage, access, adaptation correction, alteration, dissemination, erasure	Linked to the purpose of the Services provided by InnovA and to the duration of the Agreement.
SendGrid	E-mail delivery service	Collection, structuring, adaptation, storage, access, correction, alteration, dissemination, erasure	Linked to the purpose of the Services provided by InnovA and to the duration of the Agreement.
DocuSign	Electronic Signature and Agreement Cloud	Collection, structuring, storage, access, dissemination, erasure	Linked to the purpose of the Services provided by InnovA and to the duration of the Agreement.
Smartystreets	Address verification	Collection, structuring, storage, access, correction, alteration, dissemination, erasure	Linked to the purpose of the Services provided by InnovA and to the duration of the Agreement.
Avalara	Tax compliance software	Collection, structuring, storage, access, correction, alteration, dissemination, erasure	Linked to the purpose of the Services provided by InnovA and to the duration of the Agreement.

It is important to keep this list updated as this is information is necessary when EU Standard Contractual Clauses are signed between InnovA and its Customer(s). This is usually mentioned in Annex 1 of the foregoing document.

14. Data subject rights under CCPA

InnovA’s Staff must be aware that the California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the In addition to the Chapter above, InnovA’s Staff must be aware that the CCPA regulations provide guidance on how to implement the law. This landmark law secures new privacy rights for California consumers, including:

• The right to know about the personal information a business collects about them and how it is used and shared;
•  The right to delete personal information collected from them (with some exceptions);
• The right to opt-out of the sale of their personal information; and
• The right to non-discrimination for exercising their CCPA rights.

It is important to know that under the CCPA, if the business sells consumers’ personal information, then the notice at collection must include a Do Not Sell link. The notice must also contain a link to the business’s privacy policy, where consumers can get a fuller description of the business’s privacy practices and of their privacy rights.

14.1.   The right to know

The CCPA requires businesses to give consumers certain information in a “notice at collection.” A notice at collection must list the categories of personal information businesses collect about consumers and the purposes for which they use the categories of information.

Under the “right to know” data subjects may request that businesses disclose what personal information they have collected, used, shared, or sold about you, and why they collected, used, shared, or sold that information. Specifically, you may request that businesses disclose:

• The categories of personal information collected
• Specific pieces of personal information collected
• The categories of sources from which the business collected personal information
• The purposes for which the business uses the personal information
• The categories of third parties with whom the business shares the personal information
• The categories of information that the business sells or discloses to third parties

Businesses must provide this information for the 12-month period preceding the request submitted by the data subject. Businesses must provide this information free of charge.

InnovA must respond to this request within 45 calendar days. You can extend that deadline by another 45 days (90 days total) if the data subject is notified accordingly.

There are some exceptions to the right to know. Common reasons why businesses may refuse to disclose personal information include:

• The business cannot verify the request;
• The request is manifestly unfounded or excessive, or the business has already provided personal information to you more than twice in a 12-month period;
• Businesses cannot disclose certain sensitive information, such associal security number, financial account number, or account passwords. However, the business must communicate if they’re collecting that type of information.
• Disclosure would restrict the business’s ability to comply with legal obligations, exercise legal claims or rights, or defend legal claims.
• If the personal information is certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA.

If InnovA is considered a service provider, it may deny the request and refer the data subject to the responsible entity, i.e. the controller.

See Civil Code section 1798.145 for more exceptions.

Businesses must verify that the person making a request to delete is the consumer about whom the business has personal information. Businesses may need to ask for additional information for verification purposes. If the business asks for personal information to verify the identity, it can only use that information for this verification purpose.

14.2. Right to request deletion of personal information

Data subjects may request that businesses delete personal information they collected and to tell their service providers to do the same. However, there are many exceptions that allow businesses to keep the personal information.

Businesses must respond to this request within 45 calendar days. They can extend that deadline by another 45 days (90 days total) if the data subject is notified accordingly.

There are exceptions to the right to delete. Common reasons why businesses may keep your personal information include:

• The business cannot verify your request;
• To complete your transaction, provide a reasonably anticipated product or service, or for certain warranty and product recall purposes;
• For certain business security practices;
• For certain internal uses that are compatible with reasonable consumer expectations or the context in which the information was provided;
• To comply with legal obligations, exercise legal claims or rights, or defend legal claims;
• If the personal information is certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA;

See Civil Code sections 1798.105(d) and 1798.145 for more exceptions.

If InnovA is considered a service provider, it may deny the request and refer the data subject to the responsible entity, i.e. the controller.

Businesses must verify that the person making a request to delete is the consumer about whom the business has personal information. Businesses may need to ask for additional information for verification purposes. If the business asks for personal information to verify the identity, it can only use that information for this verification purpose.

14.3. Right to non-discrimination

Businesses cannot deny goods or services, charge data subjects a different price, or provide a different level or quality of goods or services just because you exercised your rights under the CCPA.

However, if you refuse to provide your personal information to a business or ask it to delete or stop selling your personal information, and that personal information or sale is necessary for the business to provide you with goods or services, the business may not be able to complete that transaction.

Businesses can also offer you promotions, discounts, and other deals in exchange for collecting, keeping, or selling your personal information. But they can only do this if the financial incentive offered is reasonably related to the value of your personal information. If you ask a business to delete or stop selling your personal information, you may not be able to continue participating in the special deals they offer in exchange for personal information. If you are not sure how your request may affect your participation in a special offer, ask the business.

14.4. The right to opt-out of the sale of their personal information

Businesses that sell personal information are subject to the CCPA’s requirement to provide a clear and conspicuous “Do Not Sell My Personal Information” link on their website that allows you to submit an opt-out request. Businesses cannot require you to create an account in order to submit your request.

Data subjects may request that businesses stop selling their personal information (“opt-out”). With some exceptions, businesses cannot sell the personal information after they receive the opt-out request unless the data subject later provide authorization allowing them to do so again.

Businesses must wait at least 12 months before asking you to opt back in to the sale of personal information.

There are some exceptions to the opt-out right. Common reasons why businesses may refuse to stop selling personal information include:

• If a sale is necessary for the business to comply with legal obligations, exercise legal claims or rights, or defend legal claims
• If the personal information is certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA.

See Civil Code section 1798.145 for more exceptions.

While businesses are not required to verify that the person submitting an opt-out request is really the consumer for whom the business has personal information, they may need to ask for additional information to make sure they stop selling the right person’s personal information. If the business asks for personal information to verify the identity, it can only use that information for this verification purpose.