ATTICS International Data Protection Policy (Including GDPR)

These policies are developed exclusively for ATTICS International. Any copying, sharing, or reuse without written consent is not permitted.

Purpose

ATTICS International is committed to protecting the privacy, confidentiality, and security of personal and organizational data entrusted to us.

The purpose of this policy is to ensure that all personal data is processed lawfully, fairly, transparently, and securely in accordance with the General Data Protection Regulation (GDPR) and applicable international data protection laws, while supporting ATTICS International’s operational and certification activities.

Scope

This policy applies to:

It covers all personal and confidential data processed during:

Definitions

Personal Data:

Any information relating to an identified or identifiable natural person.

Data Subject:

An individual whose personal data is processed by ATTICS International.

Processing:

Any operation performed on personal data including collection, recording, storage, use, transfer, or deletion.

Controller:

ATTICS International, which determines the purpose and means of data processing.

Processor:

Any third party processing data on behalf of ATTICS International.

Special Category Data refers to personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, or data concerning a person’s sex life or sexual orientation.

Policy Statement

ATTICS International shall:

Lawful Basis for Processing

ATTICS International processes personal data under one or more of the following lawful bases:

ATTICS International documents the specific lawful basis for each processing activity in its Record of Processing Activities (ROPA). For training and certification services, the primary lawful basis is performance of a contract; for marketing communications, legitimate interest applies with clear opt-out mechanisms provided.

Data Collected

ATTICS International may collect:

Data Protection Principles

All data processing follows these principles:

Data Subject Rights

Data subjects have the right to:

Requests shall be acknowledged and processed within 30 calendar days.

Data Security Measures

ATTICS International ensures:

Data Sharing and Transfer

Personal data may be shared with:

Where data is transferred internationally, ATTICS International ensures appropriate safeguards in accordance with GDPR.

International Data Transfer Safeguards

When personal data is transferred outside the European Economic Area (EEA) or other jurisdictions with adequacy decisions, ATTICS International ensures appropriate safeguards are implemented, including Standard Contractual Clauses (SCCs) approved by the European Commission, Binding Corporate Rules (BCRs) where applicable, or other legally recognized transfer mechanisms.

Data Retention

Data is retained only for as long as necessary to:

Retention periods are defined in ATTICS International’s Record Retention Procedure.

Data Breach Management

In case of a data breach:

Responsibilities

Top Management

Data Protection Officer / Assigned Representative

All Personnel

Third-Party Processors

All external processors handling ATTICS International data must:

Data Protection Officer (DPO)

ATTICS International has appointed a Data Protection Officer who oversees GDPR compliance, serves as the point of contact for data subjects and supervisory authorities, and ensures ongoing monitoring of data protection practices. The DPO can be contacted at services@atticsintl.com.

Training and Awareness

All personnel receive data protection awareness training to ensure proper handling of personal and confidential data.

Compliance with International Standards

This policy supports compliance with:

Records of Processing Activities (ROPA)

ATTICS International maintains a comprehensive Record of Processing Activities documenting all personal data processing, including purposes, data categories, recipients, retention periods, and security measures, in compliance with Article 30 of the GDPR.

Related Documents

This policy should be read in conjunction with:

Distribution

This policy is distributed to all employees via the company intranet and is available to stakeholders upon request. All personnel are responsible for reviewing and complying with the latest version available in the document management system.