1. Purpose, Scope, and Definition of Data Controllers
‍
The purpose of this notice is to record the data management principles of Paper Dog
Ltd., including its data controller activities, as well as the data management
principles and data protection measures applied in connection with the website at
https://www.paperdog.com, in accordance with applicable legislation. The
information on the processing and protection of personal data required by Regulation
(EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”)
must be concise, transparent, comprehensible, and easily accessible.

This data management notice contains the rules governing the processing of
personal data in relation to services provided through this website, as well as
information on data processing. By using the services provided through the website,
users accept the terms of this notice.
‍
For the purposes of this notice, Data Controllers are those who perform data
processing tasks on behalf of the members of Paper Dog Ltd., and who are therefore
authorised to transfer the relevant personal data to the regionally competent Data
Controller to which the data subject has expressly consented.
‍
The material scope of this notice extends to all data processing activities carried out
by the data controllers involving the processing of personal data, regardless of the
nature of the personal data or the category of data subjects. A data subject is any
person whose personal data is processed by the Data Controller. This term is used
in this sense throughout.
‍
The personal scope of this notice extends to all employees of the data controllers
and, where provided in data processing agreements, to data processors in a
contractual relationship with the Data Controller.
‍

‍
2. General Provisions
‍
The competent Data Controllers process numerous personal data in connection with
their activities. With regard to the personal data processed, we always ensure the
lawfulness and purpose-limitation of data processing, and we promptly inform the
data subject about the processing of their personal data and its conditions. The
purpose of this notice is to ensure that persons registering on our website can
receive appropriate information before providing their personal data, under what
conditions and guarantees and for how long the regionally competent Data
Controllers will process their data.
‍
The competent Data Controllers comply with the provisions of this notice in all cases
involving personal data processing. We reserve the right to amend this unilateral
declaration, but will always do so with appropriate notice to the data subjects.

If you have any questions or comments regarding the contents of this notice, please
contact the Data Controller by email or by post to the Data Controller’s registered
address.
‍
Our data processing activities have been established in accordance with the
provisions of Regulation (EU) 2016/679 of the European Parliament and of the
Council (General Data Protection Regulation, hereinafter: “GDPR”) and Act CXII of
2011 on Informational Self-Determination and Freedom of Information (“Info Act”).
Our details and contact information:

‍
Name: Paper Dog Ltd.
Registered address: Unit B, 11 Bell Yard Mews, Bermondsey Street, London,
England, SE1 3TN
Company registration number: 05297245
Email: info@paperdog.com
‍

‍
3. Processing of Data of Visitors Who Register on the Website
‍
Persons interested in our services may register online on our website.
‍
Data controller: Competent Data Controller
‍
Purpose of processing: To make contact following an enquiry about the software.
‍
Legal basis for processing: Prior consent of the data subject (Article 6(1)(a)
GDPR).
‍
Data subjects: Persons registering on the paperdog.com website.
‍
Categories of personal data processed:
• Data required to complete registration: surname, first name, email address,
phone number.
‍
Duration of data processing:
• The duration of personal data processing extends until the explicit withdrawal
of the data subject’s consent. Once the data subject notifies the Data
Controller that they no longer wish to be registered as a user after a given
date, the Data Controller will delete the data subject’s personal data within 30
working days. The data subject acknowledges that the Data Controller is
nonetheless obliged to continue processing personal data if required to do so
by law or — based on authorisation by law, within the scope defined therein
— by local government decree for public interest purposes (hereinafter:
mandatory processing), until the deadline set by law. In the case of mandatory
processing, the types of data to be processed, the purpose and conditions of
processing, the accessibility of the data, the duration of processing, and the
identity of the data controller shall be determined by the law or local
government decree ordering such processing.
‍
Recipients: The processed personal data may only be accessed within the
competent Data Controller’s organisation by authorised employees whose job
function requires it, and by designated staff of data processors.
‍
Rights of the data subject in brief: The data subject (the person whose personal
data is processed by the Data Controller) may:
a. request access to the personal data relating to them,
b. request rectification of such data,
c. request erasure of such data: a request for erasure, and the resulting deletion,
does not affect the lawfulness of processing carried out on the basis of
consent prior to its withdrawal;
d. request restriction of processing under the conditions set out in Article 18
GDPR (i.e., that the Data Controller not delete or destroy the data pending a
court or authority request, but for no longer than thirty days, and not process
the data for any other purpose beyond that),
e. object to the processing of personal data,
f. exercise the right to data portability. Under this right, the data subject is
entitled to receive the personal data relating to them in Word or Excel format,
and to request that our company transfer such data to another data controller.
g. lodge a complaint with the supervisory authority as set out in the section of
this notice entitled “Rights of Data Subjects and Remedies”.
‍
Other information regarding data processing:
• The Data Controller takes all necessary technical and organisational
measures to prevent a potential data protection incident (e.g., loss,
disappearance, or unauthorised access to files containing personal data). Our
data is protected by state-of-the-art physical and IT security measures. The
general terms and conditions, privacy statements, and contracts concluded
with data processors provide high-level guarantees for lawful and secure data
processing.
‍

‍
4. Processing of Personal Data for Marketing Newsletter Purposes
‍
The email addresses of registered persons are processed by the competent Data
Controller in accordance with Sections 2 and 3. However, Paper Dog Ltd. may also
send marketing notifications to email addresses — based on the explicit consent of
the data subject — and this activity therefore constitutes an independent processing
purpose.
‍
Data controller: Data Controller
‍
Purpose of processing: To inform data subjects about new services, news, events,
and other marketing communications of the Data Controller.
‍
Legal basis for processing: Prior consent of the data subject (Article 6(1)(a)
GDPR).
‍
Data subjects: Persons who subscribe to the newsletter.
Categories of personal data processed: Email address.
‍
Duration of data processing:
• The duration of personal data processing extends until the explicit withdrawal
of the data subject’s consent. Once the data subject notifies the Data
Controller that they no longer wish to appear in the newsletter database after
a given date, the Data Controller will cease data processing under this
provision.
• The Data Controller also informs data subjects that it plans to clean its
database every year, during which data subjects who have been registered in
the newsletter database for at least 2 years will be asked whether they still
wish to receive the newsletter. If no response is received from the data
subject, or if they state that they no longer wish to receive the newsletter, the
Data Controller will not send further marketing newsletters to the data subject.
Recipients: The processed personal data may only be accessed within the Data
Controller’s organisation by authorised employees whose job function requires it,
and outside the organisation by authorised employees of data processors.
Use of data processor: The Data Controller uniformly engages a data processor for
maintaining the newsletter database and communicating with subscribers.
Possible consequences of not providing data: Provision of data is voluntary and
based on the data subject’s consent. If data is not provided, the Data Controller will
not send marketing newsletters to the data subject.
‍
Rights of the data subject in brief: The data subject may:
a. request access to the personal data relating to them,
b. request rectification of such data,
c. withdraw consent to data processing,
d. request erasure of such data: a request for erasure, and the resulting deletion,
does not affect the lawfulness of processing carried out on the basis of
consent prior to its withdrawal;
e. request restriction of processing under the conditions set out in Article 18
GDPR,
f. object to the processing of personal data,
g. exercise the right to data portability — to receive personal data in Word or
Excel format and to have it transferred to another data controller,
h. lodge a complaint with the supervisory authority as described in the section
“Rights of Data Subjects and Remedies”.
‍
Other information:
• The Data Controller takes all necessary technical and organisational
measures to prevent data protection incidents. Our data is protected by state-
of-the-art physical and IT security measures.
• The data subject may withdraw consent to data processing at any time by
clicking the “unsubscribe” link in the newsletter, or by logging into
www.paperdog.com and navigating to the “My Settings” menu. The Data
Controller will cease processing immediately upon unsubscription.
‍
‍
‍
5. Web Analytics, Cookies, and Local Storage on the Website
‍
To measure website traffic, monitor visitor behaviour, compile statistics, and assess
the effectiveness of advertisements, the website uses Google Analytics and
AdWords.
‍
These programmes place so-called cookies on the user’s computer, which collect
user data. Visitors to the site consent to the monitoring and tracking of their
behaviour and to the use of all services provided by these programmes on behalf of
the Data Controller. Users may at any time disable future cookie recording and
storage as described below. We inform our users that the settings and use of Google
Analytics and AdWords Conversion Tracking fully comply with the requirements of
the data protection authority.
‍
According to Google, Google Analytics primarily uses first-party cookies to report
visitor interactions on the website. These cookies only record non-personally
identifiable information. Browsers do not share first-party cookies across domains.
‍
Google Analytics
www.paperdog.com uses Google Analytics primarily for generating statistics,
including measuring the effectiveness of its campaigns. Through this programme,
the Data Controller obtains information mainly about how many visitors accessed its
website and how long they spent on it. The programme recognises the visitor’s IP
address, enabling it to track whether the visitor is returning or new, and to follow the
path the visitor took on the website and where they entered from.
‍
Google AdWords Conversion Tracking
The purpose of Google AdWords conversion tracking is to enable the Data Controller
to measure the effectiveness of AdWords advertisements. This is done through
cookies placed on the user’s computer, which exist for 30 days and do not collect
personal data.
‍
Disabling Cookies
If you wish to manage or disable cookie settings, you can do so on your own
computer through your browser. This option is typically found under Tools > Settings
> Privacy Settings, where you can enable or disable tracking features.
Users who do not want Google Analytics to report on their visit can install the Google
Analytics opt-out browser add-on. This add-on instructs Google Analytics JavaScript
scripts (ga.js, analytics.js, and dc.js) not to send visit information to Google. Visitors
who have installed the opt-out browser add-on will also not participate in content
experiments.
‍
To disable Analytics web activity, visit the Google Analytics opt-out page and install
the add-on for your browser.
‍

‍
6. Other Data Processing
‍
Information about data processing not listed in this notice will be provided at the time
the data is collected. We inform our clients that certain authorities, public bodies, and
courts may contact the Data Controller for the purpose of disclosing personal data.
The Data Controller will only disclose personal data to such bodies — where the
requesting body has specified the exact purpose and scope of the data — to the
extent strictly necessary to fulfil the purpose of the request, and only where required
by law.

‍
‍
7. Method of Storing Personal Data and Data Processing Security
‍
Our IT systems and other data storage locations are located at the premises of the
regionally competent Data Controllers and on leased servers. The regionally
competent Data Controllers select and operate the IT tools used in the provision of
services for personal data processing such that the processed data:
a. is accessible to those authorised (availability);
b. its authenticity and authentication is ensured (authenticity of processing);
c. its integrity can be verified (data integrity);
d. is protected against unauthorised access (data confidentiality).
‍
We pay special attention to data security and take all necessary technical and
organisational measures and establish procedural rules required to enforce the
guarantees under the GDPR. Data is protected by appropriate measures, in
particular against unauthorised access, alteration, transmission, disclosure, deletion,
destruction, accidental destruction or damage, and inaccessibility resulting from
changes in the technology used.
‍
Our and our partners’ IT systems and networks are equally protected against
computer-assisted fraud, computer viruses, computer intrusions, and denial-of-
service attacks. The operator ensures security through server-level and application-
level protection procedures. Daily data backup is in place. To prevent data protection
incidents, the Data Controller takes all possible measures; in the event of such an
incident, we act immediately to minimise risks and remedy damage in accordance
with our incident management policy.
‍

‍
8. Rights of Data Subjects and Remedies
‍
The data subject may request information about the processing of their personal
data, and may request rectification, erasure, or withdrawal of their personal data —
except in the case of mandatory processing — and may exercise the right to data
portability and the right to object, as indicated at the time of data collection or by
contacting the Data Controller at the address provided above.
‍
Upon the data subject’s request, information will be provided in electronic form
without delay and at the latest within 30 days, in accordance with our relevant policy.
Requests from data subjects for the exercise of the rights below are fulfilled free of
charge.
‍
Right to Information
The Data Controller takes appropriate measures to ensure that all information
referred to in Articles 13 and 14 GDPR and all notifications under Articles 15–22 and
34 GDPR are provided to data subjects in a concise, transparent, comprehensible,
and easily accessible form, written in clear and plain language, yet precisely.
The right to information can be exercised in writing through the contact details
provided in Section 1. Upon request — after verification of identity — information
may also be provided verbally. If the Data Controller’s staff have doubts about the
data subject’s identity, we may request information necessary to confirm the data
subject’s identity.
‍
Right of Access
The data subject is entitled to obtain confirmation from the Data Controller as to
whether personal data concerning them is being processed. If processing is taking
place, they are entitled to access their personal data and the following information:
the purposes of processing; the categories of personal data; the recipients or
categories of recipients to whom the personal data have been or will be disclosed, in
particular recipients in third countries or international organisations; the intended
storage period; the right to rectification, erasure, restriction, and the right to object;
the right to lodge a complaint with a supervisory authority; information about the data
sources; the existence of automated decision-making, including profiling, and
meaningful information about the logic involved and its significance and expected
consequences. Where personal data are transferred to a third country or
international organisation, the data subject has the right to be informed about the
appropriate safeguards.
‍
Right to Rectification
Anyone may request the rectification of inaccurate personal data relating to them
processed by the Data Controller, and the completion of incomplete data.
‍
Right to Erasure
The data subject is entitled to request that we erase their personal data without
undue delay in any of the following circumstances:
a. the personal data is no longer necessary for the purpose for which it was
collected or otherwise processed;
b. the data subject withdraws the consent on which processing is based and
there is no other legal basis for processing;
c. the data subject objects to processing and there are no overriding legitimate
grounds;
d. the personal data has been unlawfully processed;
x. the personal data must be erased to comply with a legal obligation under EU
or Member State law;
e. the personal data was collected in relation to the offer of information society
services.
‍
Erasure may not be requested where processing is necessary for: exercising the
right to freedom of expression and information; compliance with a legal obligation;
the performance of a task carried out in the public interest; public health purposes;
archiving, scientific, historical research, or statistical purposes in the public interest;
or the establishment, exercise, or defence of legal claims.
‍
Erasure from the personal data database is only possible upon written request and
will be completed within 30 days of receipt. Such requests should be submitted to
the customer service office where the data was registered, or by email to the
territorially competent Data Controller (info@paperdog.com).
‍
Right to Restriction of Processing
At the data subject’s request, we will restrict processing if the conditions under
Article 18 GDPR are met, i.e., if:
a. the data subject contests the accuracy of the personal data, in which case
restriction applies for the period needed to verify accuracy;
b. the processing is unlawful but the data subject opposes erasure and requests
restriction instead;
c. the Data Controller no longer needs the data but the data subject requires it
for establishing, exercising, or defending legal claims;
d. the data subject has objected to processing; in this case restriction applies for
the period until it is determined whether the Data Controller’s legitimate
grounds override those of the data subject.
‍
Where processing is restricted, personal data may, with the exception of storage,
only be processed with the data subject’s consent, for the establishment, exercise, or
defence of legal claims, for the protection of the rights of another person, or for
important public interests of the EU or a Member State. The data subject must be
informed before the restriction is lifted.
‍
Right to Data Portability
The data subject is entitled to receive the personal data concerning them, which they
have provided to the Data Controller, in a structured, commonly used, machine-
readable format, and to transmit those data to another data controller. The Data
Controller can fulfil this request in Word or Excel format.
‍
Right to Withdraw Consent
The data subject is entitled to withdraw their consent at any time. Withdrawal does
not affect the lawfulness of processing carried out on the basis of consent prior to its
withdrawal.
‍
Procedural Rules
The Data Controller shall inform the data subject about measures taken in response
to a request under Articles 15–22 GDPR without undue delay and in any event within
one month of receipt of the request. Where necessary, taking into account the
complexity and number of requests, this period may be extended by a further two
months. The Data Controller shall inform the data subject of any extension within
one month of receipt of the request, stating the reasons for the delay.
If the data subject submitted the request electronically, the information shall be
provided electronically, unless the data subject requests otherwise.
If the Data Controller does not take action following the data subject’s request, the
Data Controller shall inform the data subject without delay, and at the latest within
one month of receipt of the request, of the reasons for not taking action and of the
possibility of lodging a complaint with a supervisory authority and seeking a judicial
remedy.
‍
The Data Controller shall inform each recipient to whom personal data has been
disclosed of any rectification, erasure, or restriction of processing, unless this proves
impossible or involves disproportionate effort. The Data Controller shall inform the
data subject about those recipients upon request.
‍
Damages and Compensation for Non-Material Harm
Any person who has suffered material or non-material damage as a result of a
breach of data protection regulations is entitled to compensation from the Data
Controller or data processor for the damage suffered. A data processor shall only be
liable for damage caused by processing where it has not complied with its
obligations under applicable law specifically imposed on data processors, or where it
has disregarded or acted contrary to lawful instructions from the Data Controller.
Where multiple data controllers or processors are involved in the same processing
and are liable for damage, each shall be jointly and severally liable for the full
amount of the damage.
‍
The Data Controller or data processor shall be exempt from liability if they prove that
they are not responsible in any way for the event causing the damage.
‍
Right to Judicial Remedy and Data Protection Authority Proceedings
In the event of a violation of their rights, the data subject may take legal action
against the Data Controller. The court shall handle the case on a priority basis.
‍
London, 18 June 2019
Paper Dog Ltd.
Competent Data Controllers