Effective Date: August 14, 2020
Construction and Demolition Services for Waste Recycling Company LLC (“SIRC”) and Base Alpha Limited (“BA”) committed to protecting your personal data and privacy.
This Privacy Policy sets out important information in relation to who we are, which of your personal data we collect and process, how we process such personal data, for what purpose we process such personal data and your rights in relation to the processing of your personal data in the context of the SIRC Digital Waste Management Platform (“Platform”).
In this privacy policy references to “we” or “us” or “our” are references to SIRC and/or BA as the context may require and references to “Authorised Users” or “you” or “your” are references to independent contractors and their employees who provide services to SIRC including but not limited to the collection, transport and delivery of industrial waste.
We trust that you will find this policy helpful and informative. For further information, please contact:
Construction and Demolition Services for Waste Recycling Company LLC
Base Alpha Limited
We keep our privacy policy under regular review. This version was last updated on 14 August 2020. Our business changes constantly, and our Privacy Policy may therefore also need to change. We will post the current version of this Privacy Policy on the Platform and each such change will be effective upon posting on the Platform or upon the date designated by us as the “effective date”. We may e-mail periodic reminders of our notices and conditions, but you should check our Platform frequently to see recent changes. It is your obligation to regularly check the Privacy Policy. Your continued use of the Platform following any such change constitutes your agreement to this Privacy Policy as so modified.
It is important that the personal data that you store on the PDA (as described below) and make available to and which we hold in the Platform about you is accurate and current. Please update the information on your PDA and keep us informed if your personal data changes during your relationship with us.
If you use our Platform, you consent to the collection, use and sharing of your personal data under this Privacy Policy (which includes all other documents referenced in this Privacy Policy) and agree to the Terms of Use for the Platform. We created this Privacy Policy to give you confidence as you use the Platform and Services and to demonstrate our commitment to the protection of privacy.
BA and SIRC have entered into an agreement pursuant to which BA has developed, hosts and maintains an online waste management platform (“Platform”) which is designed to enable SIRC through a management portal to capture and analyse data and information related to industrial waste generation, accumulation, collection, transport and processing across the Kingdom of Saudi Arabia.
Platform components developed by BA include, but are not limited to the following: Platform file structures and encumbrances; data architecture and databases; identity Management System; Application Programming Interfaces (APIs) to manage certifications, to manage and transfer assets and to expose Platform functionality to its web and mobile apps; frontend interface integrations; AI and machine learning algorithms and integrations. Platform components are owned or controlled by BA or licensed to BA.
The Platform’s end-user facing interfaces (the “Product”) consists of various we and mobile applications, including the mobile Driver application and Vendor web application, to which this Privacy Policy applies. Product components include but are not limited to the source code, interface and graphical design for these web and mobile applications as well as any designs, audio, video, text, photographs, and graphics, and the trademarks, service marks, and logos contained therein (the “Marks”). The Product and Marks are owned by SIRC.
BA has granted to SIRC an Exclusive Master Licence to use the Platform and to purchase subscriptions which enable Authorised Users to access and use the Platform through web and mobile applications.
SIRC requires its independent contractors to use the Platform including inputting their personal data and data relating to waste collection, transport and delivery into the Platform as part of their services to SIRC.
SIRC requires the personal and other data collected through the Platform to be processed for the purposes of its business. BA is hosting the Platform on behalf of SIRC and as such is processing personal data on behalf of SIRC.
SIRC is responsible for the collection and controls the processing of your personal data and as such is solely responsible and liable to you for the collection and processing of your personal data. BA’s sole liability and responsibility is to SIRC in relation to the processing by BA of your personal data under the instructions of SIRC and as such BA has no responsibility or liability to you in relation to such processing of your personal data pursuant to its agreement with SIRC.
The Platform requires Authorised Users to establish a Personal Data Account (“PDA”) which contains personal data of Authorised Users including:
(the “PDA Data”)
PDAs use a new technology called a "HAT Microserver" that enables Authorised Users to own and control their data in the cloud. PDAs are issued by Dataswift Ltd and governed by the HAT Community Foundation to ensure the ethical use of data on behalf of the PDA owners.
Please note that the PDA is subject to a separate privacy policy provided by Dataswift Ltd, a company incorporated in England (company number 09821157), whose registered office is at The Cottages, 8 Comberton Road, Barton, Cambridge, CB23 7BA, UK (“Dataswift”) which is the operator of the PDAs. We do not accept any liability for this privacy policy or for your PDA Data (as defined below) which is put on to your PDA by you or your employer.
The PDA enables each Authorised User to legally own and control their personal data and any other digital data should they so wish. PDAs give Authorised Users full control over their data. PDA Data which relates to the Platform shall be stored in a dedicated part of the PDA called the “SIRC Namespace”.
Neither SIRC, nor any of its data processors (including BA where BA agrees to process personal data on behalf of SIRC), can access any data in your PDA including the SIRC Namespace, without your explicit permission. Accordingly, each Authorised User shall on registering on the Platform provide explicit permission to SIRC and its data processors, to access, extract from and process the PDA Data in the SIRC Namespace section of its PDA for the purposes of the Platform. The provision of such consent is a condition to the engagement by SIRC of an Authorised User to provide services to SIRC.
An Authorised User may only withdraw its permission for SIRC and its data processors to access and process the PDA Data in the SIRC Namespace with the consent of SIRC in writing. SIRC will not provide such permission for the withdrawal of permission for the period during which an Authorised User is providing waste collection, transport and delivery and/or other related services to SIRC.
Furthermore, an Authorised Person will not be entitled to delete any PDA Data in the SIRC Namespace of its PDA without the permission of SIRC in writing. SIRC will not provide such permission for deletion of such data the period during which an Authorised User is providing waste collection, transport and delivery and/or other related services to SIRC
For this Privacy Policy we define the following terms:
All other types of data collected or generated by the Platform, including Platform Content Data, may be stored in either your PDA or on Platform servers.
For more information on PDAs, see https://dataswift.io
As a result of the use of the Platform, we may collect, use, store and transfer the following types of Personal Data of Authorised Users on behalf of SIRC:
Aggregated Data
We also collect, use and share aggregated data such as statistical data for any purpose. Aggregated data may be derived from personal data but is not considered personal data in law as this data does not directly or indirectly reveal an individual’s identity. For example, we may aggregate your Metadata and Platform Content Data to calculate the percentage of users accessing a specific Platform feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.
We do not collect other Special Categories of Personal Data
We do not collect any other Special Categories of Personal Data about you (this includes details about your political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about past criminal convictions and offences.
Minors
By accessing, using and/or submitting information to or through the Platform and the Services, you represent that you are not a child (minor). If we learn that we have received any information directly from a child without his/her parent’s written consent, we will use that information only to respond directly to that child (or his/her parent or legal guardian) to inform the child that he/she cannot use the Services, and we will subsequently delete that information.
If you fail to provide personal data
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to terminate your use of the Platform or reject your registration which may adversely impact on your ability to comply with your obligations to SIRC.
Passwords and Confidentiality
If you generate or are provided with a password or any other piece of information as part of our security procedures for our Platform, you are responsible for maintaining the confidentiality of your password and user name for the Platform and you are responsible for all activities that are carried out under them. We do not have the means to check the identities of people using the Platform and we will not be liable where your password or user name is used by someone else. You agree to inform SIRC immediately of any unauthorised use of your password or user name of which you become aware. We have the right to disable any user identification code or password, whether chosen by you or allocated by us, at any time, if in our opinion, you have failed to comply with any of the provisions of these terms.
We only use your PDA Data pursuant to the permissions as stated in your HAT Microserver Instruction Contract as set up by Dataswift (HMIC).
We will only use your Platform Personal Data where we are permitted to do so by law. This will most commonly include using data for the following purposes which describe the lawful basis we rely on for the processing of your personal data.
Marketing
We will not use your Platform Personal Data for the purposes of our own or third party marketing.
Cookies
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Platform may become inaccessible or not function properly.
We only use your PDA Data according to the permissions stated in your HMIC.
We may use your Platform Personal Data, in combination with Metadata, Platform Content Data and Aggregated Data for the following purposes:
Metadata, Platform Content Data, Platform Personal Data, Cryptographic keys and Aggregated Data may be used to improve the Platform in the following ways:
We may use Platform Personal Data for a purpose other than the originally stated purposes where the new purpose is required by law or where we have obtained consent in writing for each new purpose.
We cannot share your PDA Data unless the permissions have been set up by Dataswift.
We may share your Platform Personal Data only in the following situations
We require all third parties to respect the security of your Platform Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
The Platform Personal Data that we collect from you may be transferred to, and stored at, a destination outside of the jurisdictions in which the persons to whom such Personal Data relates being United Arab Emirates, Saudi Arabia, Bahrain and United Kingdom. It may also be processed by staff operating outside such jurisdictions who work for us or for one of our suppliers. Your Platform Personal Data may be transferred, stored, processed and used by our affiliated companies and/or non-affiliated service providers in one or more countries outside your originating country.
We ensure your Platform Personal Data is protected by requiring all our group companies to follow the same rules when processing your Platform Personal Data. Whenever we transfer your platform personal data out of such jurisdictions or to third parties, we aim ensure a similar degree of protection is afforded to it by the use of contractual obligations.
Your PDA data security is maintained by Dataswift.
We maintain commercially reasonable technical, administrative, and physical safeguards to ensure your Platform Personal Data is treated securely and in accordance with this Privacy Policy, and to protect against unauthorized access or alteration to, disclosure, or destruction of your Platform Personal Data. We may, for example, use encryption technology to secure your Platform Personal Data during transmission to our Platform as well as external firewall and on-host firewall technology to prevent network level attacks. Only those authorized employees, contractors, and agents who need to know your Platform Personal Data in connection with the performance of their services are allowed to access this Platform Personal Data.
It is important for you to protect yourself against unauthorised access to your password and to your devices used to access the Platform. You are responsible for keeping your password confidential. For example, ensure that you sign off when you have finished using a shared device.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Platform Personal Data, we cannot guarantee the security of your Platform Personal Data transmitted to our Platform and any transmission is at your own risk.
The data retention policy for your PDA data is set by Dataswift and subject to their terms and conditions when you signed up to a PDA.
We will only retain your Platform Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your platform personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the Platform Personal Data, the potential risk of harm from unauthorised use or disclosure of your Platform Personal Data, the purposes for which we process your platform personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Generally, the retention periods for different aspects of your platform personal data will be six years.
In some circumstances you can ask us to delete your data: see your legal rights below for further information.
In some circumstances we will anonymise your platform personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
You have full legal rights to your PDA data.
Under certain circumstances, you have rights under data protection laws in relation to your Platform Personal Data. Subject to the terms of this Privacy Policy, in particular, you have the right to:
If you wish to exercise any of the rights set out above, please contact SIRC by email at sirconomy@sirc.sa
You will not have to pay a fee to access your Platform Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your Platform Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Platform Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.