Qiy Trust Principles

Access

I have access to all my personal data* processed by a Qiy Trust Service Provider*.

Insight

I shall be able to easily gain insight in the present use of my personal data*: who is processing my personal data, for what purpose, how and under what agreements.

I should also be able to easily understand past uses of my personal data.

Control

I have control over all my personal data*:

• I can choose to share my personal data
• I have the right to terminate the processing of my personal data without undue delay, whenever I wish
• I have the right to have my personal data deleted without undue delay, whenever I want.

Provenance

I may share my personal data* in such a way that its authenticity, content, source of origin, timeliness, validity and integrity can be reliably established and verified.

In this way, I can not only reuse my personal data, but also share verified data*.

Anonymity

I have the right to remain anonymous

Consent

My personal data* may only be processed with my freely given consent and for specific purposes*. My personal data may not be further processed in a manner incompatible with those purposes.

I may withdraw my consent* at any time or, in the case of a contract, upon termination of the contract or expiration of the period specified in the contract for which the consent was given. The withdrawal of consent does not affect the lawfulness of the processing based on the consent before it was withdrawn. It should be as easy to withdraw consent as it is to give consent. In assessing whether consent has been freely given, the primary consideration shall be whether, among other things, the performance of a contract, including the provision of a service, is contingent on consent to the processing of personal data not necessary for the performance of that contract.

Transparency

When I am asked to provide personal data* for an online service, I will be clearly informed by the Service Provider* about the purposes for which the personal data will be used or may be used in the future. If the performance of a contract, including the provision of a service, depends on my consent* to the processing of personal data, the service provider will explain to me why this is necessary. Only when I am fully informed can I decide to make (part of) my personal data available.

Data minimization

The amount and nature of the personal data* requested by a data subject* must be adequate, relevant and limited to what is necessary in relation to the purpose(s) for which it is processed.

Online tracking

Online tracking is not permitted without my prior express consent*

Security Policy

Each service provider* shall ensure that personal data* is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. Each service provider has an adequate security policy, based on the requirements set by or on behalf of the Qiy Scheme Authority*.

Privacy Statement Service Providers

Service providers* accept that these Qiy Trust Principles take precedence over their existing or future privacy notices if they provide me with a higher level of protection and that the provisions of their privacy notices that are inconsistent with the Qiy Trust Principles will be deemed null and void. In the event that existing or future privacy statements of service providers provide higher protection, those privacy statements will take precedence.

Complaints and Disputes

In the event of a complaint or dispute, I will address my service provider* first. If this does not lead to a satisfactory resolution, I can refer the complaint or dispute may be referred to the Regional Authority* (for now: Qiy Foundation*). Each service provider will publish on its website a clear and easily findable notice indicating to whom complaints can be filed and to whom one I can turn in case of a dispute.

The complaints and dispute resolution procedure as prescribed by the Scheme Authority* or, in delegation by the Scheme Authority*, as established by the Regional Authority* shall apply.