| Milanova & partners

GDPR QUESTIONNAIRE

Before filling out, please read carefully the definitions at the end of the questionnaire, which define the terms in bold.

1. Number of employees/self-employed contractors working in your Undertaking? *

please see definition of undertaking at the end of the questionnaire

2. Approximate number of other people whose personal data is processed? *

3. Groups of people, whose personal data is processed? *

e.g. counterparties, employees, jobseekers, customers, etc.

4. For each of the personal data sets, please specify the purposes for which the personal data is processed. Have you formulated these purposes in a contract/other document? *

5. What type of personal data are you processing for each of the groups listed in question 3? *

such as names, addresses, ID numbers, e-mails, photos, video surveillance images, people’s preferences and choices, their market behavior, etc.

5.1. Do you process any of the following personal data sets?

racial or ethnic origin
political views, religious or philosophical beliefs
professional organization membership
genetic data
data concerning health status
data concerning people’s sex life
criminal convictions and offences or related security measures

5.2. Do you process personal data of children? *

6. Do you keep Filing system of collected data, which has additional information like purpose of the data collection, storage period, legal basis, etc.? *

7. Do you collect personal data by express consent of people? If the answer is yes – do you use standardized declarations for consent? *

8. Do you have internal rules, forms, policies related to the processing of personal data? *

9. Do you collect personal data through third parties? If the answer is yes, on what basis and what is your relation with these third parties? *

10. Do you distribute the collected personal data to third parties? If the answer is yes, on what ground? *

11. Do you have an employee, who performs the function of human resources in your company, or this function is outsourced? *

12. Do you have any other activities in your company that are outsourced? *

e.g. external accounting, legal services etc.

13. Do you transfer personal data to other countries and to which (a member state of the European Union/European Economic Area/third country)?

14. Do you do automatic profiling based on the personal data you collect? *

15. Do you use the collected personal data for direct marketing? *

16. Do you have specific needs that require video and/or photo shooting of people or GPS tracking? *

17. How and where do you store the personal data you collect (do you have physical archive; do you use cloud encrypting software, etc.)? *

18. Do you organise events that require the processing of personal data? *

e.g. advertising campaigns, games, marketing strategy, etc.

19. What are the technical and organizational measures you have taken in your undertakings with regard to the data you collect? *

e.g. keys/passwords/access codes to software for information processing/deletion/ encryption/pseudonymisation , etc.

Name of your Undertaking *

UIC

Contact person *

Telephone number *

E-mail *

Phone

DEFINITIONS:

‘Undertakings’ is every subjectengaged in an economic activity, regardless of its legal form.

‘Personal data’ means any information relating to an identified or identifiable physical person (‘data subject’); an identifiable physical person is one, who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that physical person;

‘Processing’ means any operation or set of operations, which is performed with personal data or with sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

‘Third party’ means a physical or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data;

‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects, concerning that physical person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;