Conditions for the collection and processing of personal data
“SOLVAS” LLC processes your personal data in accordance with the following principles:
- lawfulness and fairness of the grounds for processing;
- confidentiality and security of personal data;
- prevention of any threat to human life and health, as well as protection of personal honour and dignity.
For marketing research purposes, we use anonymised information.
“SOLVAS” LLC does not process biometric personal data.
Our website uses cookies. Information about cookies, the purposes for which they are used, and how to opt out can be found in the "Cookie Policy", available on our website at: solvas.az.
Retention of personal data
We retain personal data only for as long as necessary to achieve the purposes for which it was collected, or for the periods expressly established by the legislation of the Republic of Azerbaijan, or until the occurrence of one of the following events:
- withdrawal of consent;
- expiry of the validity period of the consent.
Upon achievement of these purposes or expiry of the applicable periods, personal data shall be deleted or anonymized, unless further retention is required to comply with legal obligations or to protect our rights and legitimate interests.
To whom do we transfer your personal data?
In order to achieve the purposes of processing, your personal data may be made accessible to our partners and service providers:
- ALSO International Services GmbH (Germany, Soest).
- AppDynamics LLC (USA, San Francisco, California).
- Prospect One sp. z o.o. (Poland, Kraków).
- Usercentrics GmbH (Germany, Munich).
- Intercom, Inc. (USA, San Francisco, California).
- Whatfix Private Limited (India, Bangalore).
- Marketo Inc. (USA, California).
When transferring data outside the Republic of Azerbaijan, we will ensure that the foreign country to which the personal data is intended to be transferred provides reliable protection of the rights of data subjects. In addition, we ensure an adequate level of protection through contractual mechanisms (such as Standard Contractual) or other appropriate security measures.
Rights of data subjects
A data subject has the right to:
- obtain information about the existence of their personal data in an information system, as well as about the owner or operator of such a system;
- request the legal grounds for the collection, processing, and transfer of their personal data to third parties, and to receive information about the legal consequences of such collection, processing, and transfer;
- access the content of their personal data collected within an information system;
- receive information about the purposes, retention periods, and methods of processing of their personal data, the persons authorised to access such data, and the range of information systems with which data exchange is intended;
- request clarification regarding their personal data collected and processed within an information system and, except in cases provided for by law, to demand its destruction or to submit a request for its transfer to an archive in accordance with the established procedure;
- demand the prohibition of the collection and processing of their personal data;
- receive information about the sources of their personal data and to request confirmation of the lawfulness of such data;
- demand the protection of their personal data collected and processed within an information system;
- receive information about the existence of a conformity certificate and state expert assessment of information systems containing their personal data;
- object to the collection and processing of their personal data where such collection and processing are not mandatory under applicable law. No justification is required for such an objection;
- lodge a complaint with the competent executive authority or a court in the event of a violation of their rights resulting from the unlawful collection and processing of personal data, failure to comply with data protection requirements, or other breaches of applicable legislation, and to claim compensation for any material and moral damages suffered through judicial proceedings.
- to object to a decision made as a result of the collection and processing of personal data using information technologies, if it violates the interests of the data subject, except where the use of such method is mandatory under applicable law.
A request to exercise your rights as a data subject may be submitted either by filing a written application on paper, accompanied by a valid identity document, or by sending an electronic request signed with a qualified electronic signature to the following email address: dataprotect.AZ@solvas.tech
.
We will provide a response no later than 7 working days from the date of receipt of your request. Should the handling of your request require consultation with third parties, the response period may be extended by an additional period of no more than 7 working days. If, for reasons established by law, we are unable to fulfil your request, we will notify you of this no later than 5 working days from the date of receipt of the request.
Measures for personal data protection
To ensure the security of personal data, “SOLVAS” LLC implements legal, organisational, and technical measures.
Legal Measures:
- Development and use of internal regulations complying with personal data protection laws;
- Signing agreements with third parties having access to data with confidentiality and data protection terms;
- Avoidance of processing methods contradicting this Policy and personal data protection laws.
Organizational Measures:
- Appointment of a person responsible for organizing personal data processing;
- Defining persons responsible for personal data security in information systems;
- Restricting access to personal data and organizing permission-based access systems;
- Training employees involved in personal data processing in protection rules and familiarization with this Policy and internal acts;
- Regulation of processing procedures, segregation of personal data from other information;
- Accounting and storage organization of data carriers;
- Identification of threats to personal data security and forming a current threat model;
- Restriction of unauthorized access to premises where personal data processing occurs;
- Signing non-disclosure agreements with “SOLVAS” LLC employees.
Technical Measures:
- Use of certified information security tools;
- Assessment of the effectiveness of security measures;
- Logging and accounting for actions with personal data;
- Detection of malicious software (antivirus on all network nodes);
- Secure inter-network interaction (firewall);
- User identification and authentication by password;
- Control of software integrity;
- Protection of virtualization environments and network channels;
- Data backup and recovery in case of failures;
- Logging attempts to access accounts;
- Traffic scanning for suspicious requests;
- Data encryption and pseudonymization measures.
Final provisions
This Policy may be updated or revised as necessary, or in connection with:
- changes in the legislation of the Republic of Azerbaijan on personal data;
- changes in the practice of applying personal data legislation;
- changes in the information infrastructure of “SOLVAS” LLC and the introduction of new technologies affecting the processing of personal data.
All amendments and updates to this Policy will be reflected in a new version published on our website. The date of the last update will be indicated at the beginning of the document.