Qiy Trust Principles

Access

I shall have access to all my personal data and data that I generated by using online services or connected devices.

Transparency

I shall be able to easily gain insight in the use of my personal data and data that I generated by using online services or connected devices: Who is processing my personal data, for which purpose, how and under which agreements.

I should also be able to monitor any past and present use of this data.

Control

I shall have control over personal data and data that I generated by using online services or connected devices. Within the limitations set by law:

• I can choose to share my personal data and data that I generated by using online services or connected devices
• I have the right to terminate the processing of my personal data and data that I generated by using online services or connected devices, without undue delay, whenever I wish
• I have the right to have my personal data and data that I generated by using online services or connected devices, deleted without undue delay, whenever I want

Provenance

I may share my personal data and data that I generated by using online services or connected devices, in such a way that its authenticity, content, source of origin, timeliness, validity and integrity can be reliably established and verified.

In this way, I can not only reuse this data, but also share verified data*.

Anonymity

Within the limitations set by law I shall have the right to remain anonymous. In cases in which certain data are indispensable for the delivery of a particular service, I shall be informed and be given the option to choose whether or not to submit that data.

Consent

My personal data and data that I generated by using online services or connected devices, may only be processed with my freely given consent and for specific purposes*. This data may not be further processed in a manner incompatible with those purposes.

I may withdraw my consent* at any time or, in the case of a contract, upon termination of the contract or expiration of the period specified in the contract for which the consent was given. The withdrawal of consent does not affect the lawfulness of the processing based on the consent before it was withdrawn. It should be as easy to withdraw consent as it is to give consent. In assessing whether consent has been freely given, the primary consideration shall be whether, among other things, the performance of a contract, including the provision of a service, is contingent on consent to the processing of personal data not necessary for the performance of that contract.

Data minimization

The amount and nature of personal data and data that I generated by using online services or connected devices, requested by an organisation* must be adequate, relevant and limited to what is necessary in relation to the purpose(s) for which it is processed.

Online tracking

Online tracking is not permitted without my prior express consent*

Security Policy

Each service provider* shall ensure that personal data* is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. Each service provider has an adequate security policy, based on the requirements set by or on behalf of the Qiy Scheme Authority*.

Privacy Statements Data Controllers and Data Processors

Data controllers and data processors accept that these Qiy Trust Principles take precedence over their existing or future privacy statements if they provide me with a higher level of protection and that the provisions of their privacy statements that are inconsistent with the Qiy Trust Principles shall be deemed null and void. In the event that existing or future privacy statements of service providers provide higher protection, those privacy statements will take precedence.

Complaints and Disputes

In the event of a complaint or dispute, I shall address my service provider* first. If this does not lead to a satisfactory resolution, I can refer the complaint or dispute may be referred to the Regional Trust Framework Authority (for now: Qiy Foundation*). Each service provider will publish on its website a clear and easily findable notice indicating to whom complaints can be filed and to whom one I can turn in case of a dispute.

The complaints and dispute resolution procedure as prescribed by the Qiy Trust Framework Authority or, in delegation by the Qiy Trust Framework Authority, as established by the Regional Trust Framework Authority shall apply.