Privacy Policy

Privacy Policy

MERITORIUS is committed to protect individuals’ personal data in line with the requirements of applicable law.

MERITORIUS commitment applies to all individuals whose personal data it may process. “Personal Data” means any information relating to an identified or identifiable natural person.

1. Who is MERITORIUS

Meritorius Group provides various services including, audit, tax and vat consulting, accounting, payroll and other related services. 

As the Controller, Meritorius determines the purpose and means of processing individuals’ personal data. In each case, the personal data controller will be the entity:

·  with which you have entered into any agreement; or

·  with which you are otherwise dealing or communicating with; or

·  which provides services or otherwise deals with a third party associated with you (e.g. a legal or other entity of which you are an employee, a director or other officer or representative) (the “Client Entity”).

Meritorius or Meritorius Group may include:

- Meritorius Audit Ltd and/or

-Meritorius Accounting Services Ltd

2. Personal data that we may collect:

Meritorius processes different personal data for a variety of reasons. These may include:

Personal data for contact, service provision and other purposes:

These may include, name, position, residential address, identification details (e.g. passport) postal address, business address, mobile number, email address, proof of source of income, login and other account data where you may be provided such data by Meritorius to logon to any platform by which Meritorius may offer its services.

Information necessary to make payments:

This may include bank account details and other relevant details.

Compliance details:

In offering its services to its clients, Meritorius may process personal data relating to individuals such as proof of residence documentation, source of income, tax identification numbers.

Publicly available information:

Meritorius may also process personal data from public sources including from databases for compliance checks.

Appointment to office:

Meritorius may process personal data in relation to individuals that may be appointed to an official position such as directors, shareholders or the secretary to a company or officers or persons involved in any other legal entity.

Compliance with statutory obligation:

Meritorius may process personal data where obliged to do so under the law (e.g. employment records, company records, tax reporting obligations).

Information collected during the registration for an event or conference organised by Meritorius:

Meritorius may organise different kind of events or conferences either for promoting and marketing its services to existing and potential clients, for networking purposes or for finding potential candidates for employment. 

In this respect, Meritorius may process personal data (e.g. name, surname, contact details and if relevant details in regard to academic and/or professional qualifications (including, but not limited to, name of University, subject of study, year of study) for efficient organisation and management of an event or conference. This information may be used for future contact, only with your consent, in order to market the Entity’s services to you or in order to inform you for similar events or in regard to possible employment opportunities that are tailored to you if appropriate. This information will be held by Meritorius until you choose to unsubscribe/withdraw your consent, in accordance with article 7(3) of the General Data Protection Regulation (Regulation EU 2016/679).

Photographs/pictures, presentations, audio and video recording of speakers and participants and live web streaming of the events or conferences may be taken. They may be reproduced in various media including Meritorius publications, Meritorius website, social networks, TV channels and the press, in connection with the event or conference as well as for promotional activities of Meritorius. 

If you wish that your image or voice is not recorded and published, for compelling and legitimate grounds relating to your particular situation, please follow the procedure described below at paragraph 11 for making a request.

3. Time of collection of personal data

Personal data may be collected by Meritorius  where you or an organisation with which you are related in any capacity (e.g. employee, officer, representative) contact Meritorius  in relation to any services that it may provide. Your personal data may also come to our possession in case you express any interest to and/or become an employee of Meritorius. Your data may also be processed if you sign up to receive any informative or marketing material. Your personal data may also be processed if you sign up to participate in an event or conference organised by Meritorius. Your data may also be collected when an organisation engages Meritorius to provide services and you are engaged in the organisation in any capacity that is relevant (for example, director, representative, employee of such entity with which Meritorius deals in providing any services.)

Meritorius may also collect personal data from other sources including client entities, government agencies and risk intelligence service providers (e.g. World-check).

4. Use of your personal data:

Meritorius will process personal data to:

·  Provide its services or enter into discussions for the provision of services to you or a Client Entity;

·  Manage the day-to-day tasks relating to the business relationship with you or a Client Entity (e.g. communication, payments, invoicing, support);

·  Analyse, market and improve its services as well as develop new services that may be of interest to you or a Client Entity;

·  For physical security and IT security purposes;

·  For insurance coverage purposes;

·  In compliance with its legal obligations including accounting and tax;

·  To be able to identify the individuals acting for a Client Entity or engaged by a Client Entity in a task which requires that Meritorius communicate with such individuals;

·  To defend or uphold its legal rights;

·  To comply with any order of a responsible court or other authority;

·  In relation to any services that may be offered to Meritorius by any person or other entity including for example legal services, tax services, public services;

·  For research purposes regarding the effectiveness of website services, marketing, advertising and sales efforts;

·  To keep you or a Client Entity informed in relation to its services and products;

·  For direct marketing purposes in promoting Meritorius legitimate interest. In such a case you may opt-out of direct marketing as provided further below.

·  For recruitment, employment, payroll and other related purposes of Meritorius;

·  For organising an event or conference and providing relevant information to participants;

·  For purposes that are similar or connected to the above or for any other purpose that you or a Client Entity will provide personal data to us.

5. Legal ground for personal data processing

Meritorius may process the personal data set out above on one or more of the following:

·  You have provided your consent to Meritorius for the specific purpose of processing;

·  The processing is necessary for the performance of a contract to which you or a Client Entity are party or in order to take steps at your or a Client Entity ‘s request prior to entering into a contract with Meritorius;

·  processing is necessary for compliance with a legal obligation to which Meritorius as the controller is subject;

·  processing is necessary in order to protect the vital interests of you or of another natural person;

·  processing is necessary for the purposes of the legitimate interests pursued by Meritorius as the controller or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where the data subject is a child. Examples where Meritorius may process personal data on this ground, for fraud detection and prevention as well as credit and KYC checks, inquire in relation to politically exposed persons, product development, communications and marketing, insurance purposes, employment and recruitment purposes, IT purposes (e.g. data loss prevention, information, system, network and cyber-security, employment data processing, general operations and due diligence (e.g. internal customer analysis, reporting and management information).

6. Provision of your personal data to third parties

·  Meritorius may share your information with other directly related Entities.

·  Meritorius may share information in the context of providing its services to you or any Client Entity with other third parties including for example, Tax Authorities, other regulatory authorities, Social Insurance Department, other specialist service providers, its own legal and/or other advisors, entities offering services in relation to AML and fraud prevention checks, financial institutions whose services may be required as part of the services that you require Meritorius to provide to you, other service providers (e.g. online storage centres, cloud service providers. and statistics monitoring).

·  Each Meritorius Entity may also share your information where obliged to do so by an applicable court order and/or where required to do so by an applicable law.

7. The safety of your personal data

MERITORIUS takes the appropriate measures (physical, organisational and technical) to ensure the safety of your personal data. Your personal data may be stored electronically or in paper form.

8. Personal data that you or a Client Entity provide to us in relation to other individuals.

Where you or a Client Entity provides to any Meritorius Entity personal data of other individuals (e.g. officers, secretary, employees, other individuals that the Client Entity interacts with or persons related to you) you or the Client Entity (as the case may be) represent to such Meritorius Entity that you or the Client Entity are duly entitled to do this.

You or a Client Entity also represent and that the individual in question is aware of the relevant Meritorius Entity’s data protection practices as stated in this policy which may be relevant to the individual, how such Meritorius Entity may be contacted as well as such information that you or a Client Entity are obliged to provide to such individual under applicable laws in relation to any Meritorius Entity.

9. How long we store your personal data for

Each Meritorius Entity stores personal data for no longer than is reasonably necessary for its processing purposes. Where an MeritoriusEntity stores personal data based on your consent, it will delete such personal data when you withdraw your consent and provided that it is not obliged under law to maintain such data. In case of recruitment activities, the Meritorius Entity will delete your personal data if you are not employed unless you expressly consent for to the storing of your personal data for potential future roles and/or other purposes. If you accept an offer of employment by Meritorius, any relevant personal data collected during your pre-employment period will become part of your personnel records and will be retained. Each Meritorius Entity may in any case, keep personal data as long as is necessary for the defending or making of legal claims as provided by applicable limitation laws in Cyprus.

10. Transfers of personal data to third countries

Each Meritorius Entity may transfer personal data to third countries outside the EU/EEA where required for any of the purposes stated above including for storage purposes. In each such case, the relevant Meritorius Entity will ensure that such transfers will comply with the General Data Protection Regulation (Regulation EU 2016/679 based on a Commission Adequacy decision, or appropriate safeguards (e.g. standard contractual clauses) or other grounds provided by the GDPR. You may contact the relevant Meritorius Entity in order to be informed of the appropriate or suitable safeguards (as the case may be).

11. Your rights as a data subject

·  Right of access – you have the right to request from us acting as your controller, to provide you with a copy of the personal data that we hold about you in which case we shall do so.

·  Right of rectification – you have a right to request from us as your controller to correct the personal data that it holds about you that is inaccurate or incomplete in which case we act as your controller shall do so.

·  Right to be forgotten – you have a right to request from Meritorius acting as your controller in certain circumstances to erase your personal data from its records. In case that these circumstances apply to your case and provided that no exception to this obligation applies (e.g. where we are obliged to store your personal data in compliance with a legal obligation under Cypriot or EU law), the Meritorius Entity acting as your controller will erase your personal data from its records.

·  Right to restriction of processing – you have a right to request from the Meritorius Entity acting as your controller where certain conditions apply, to restrict the processing of your personal data. Where these conditions apply the MeritoriusEntity will restrict the processing of your personal data.

·  Right of portability – you have the right to request from the Meritorius Entity acting as your controller where certain conditions apply, to have the data it holds about you transferred to another organisation. Where these conditions apply the Meritorius Entity will transfer your personal data to another organisation.

·  Right to object – you have the right to object on grounds relating to your particular situation, to certain types of processing such as direct marketing.

·  Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.

·  Right to judicial review: in the event that a Meritorius Entity refuses your request for any rights of access, it will provide you with a reason as to why.

You can make a request or exercise these rights by sending a request by e-mail to the following e-mail address:

info@meritorius.com

We may request you to provide us information for the purpose of verifying your identity and residency in order for us to comply with our security obligations and to prevent unauthorised disclosure of data.

We will answer your request, or request additional information form you within 1 (one) month. Occasionally, it may take us longer than 1 (one) month if your request is particularly complex or you have made a number of requests. In this case, we will notify you within 1 (one) month of the receipt of your request about the extension and keep you updated.

Each Meritorius Entity may charge you a reasonable fee when a request is manifestly unfounded, excessive or repetitive, or we receive a request to provide further copies of the same data. In this case we will send you a fee request which you will have to accept prior to us processing your request. Alternatively, we may refuse to comply with your request in these circumstances.

12. Failure to provide personal information

If a Meritorius Entity requests you to provide to it personal data and you fail to do so such Meritorius Entity may not be in a position to provide a service and/or enter into an agreement with you, in which case it will inform you accordingly.

13. Your right to make a complaint

Meritorius GDPR Unit will endeavour to promptly respond to your requests and complaints. In the event that you are unsatisfied, with the way we have handled your personal data or any privacy query or request that you have raised with us, you may submit a complaint to Meritorius GDPR Unit in writing at the following email address:

info@meritorius.com

We will try to respond to all requests within 1 (one) month. Occasionally, it may take us longer than 1 (one) month if your request is particularly complex or you have made a number of requests. In this case, we will notify you within 1 (one) month of the receipt of your request and keep you updated.

If you are not satisfied with our response to your complaint, you have the right to lodge a complaint with the Cyprus Data Protection Commissioner. You can find details about how to do this on the following website:

http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/page1i_gr/page1i_gr?opendocument

14. Changes to this Privacy Policy

This Privacy Policy is subject to change to reflect a change in the data protection practices or legal framework. In the case that this Policy will be amended the revised document will be posted on MERITORIUS websites and such change will apply from the date that it is posted unless otherwise stated in the revised Privacy Policy.