Yacuna AG Logo

DATA PROTECTION AND PRIVACY POLICY

Yacuna AG and its subsidiaries and affiliates (collectively, “Yacuna”) respect the privacy of Personal Data and are committed to protecting Personal Data for which Yacuna is a Controller. This Data Protection and Privacy Policy (this “Policy”) describes the policies and procedures Yacuna has implemented to protect Personal Data Processed by Yacuna in accordance with applicable Data Protection Laws.

Yacuna has voluntarily opted to apply the protections and obligations outlined in this Policy to all Data Subjects. However, such protections and obligations may be beyond the legal requirements of the jurisdiction of certain Data Subjects. Data Protection Laws vary widely across jurisdictions and while Yacuna will strive to meet this Policy for all Data Subjects, the Data Protection Laws for the Data Subject ultimately govern the protections conferred in the specific jurisdiction applicable to that Data Subject, and this Policy does not confer any rights beyond those granted by the relevant Data Protection Laws.

This Policy describes how Yacuna collects and uses Personal Data, the circumstances under which Yacuna may share Personal Data, the applicable rights of Data Subjects, and Yacuna’s technical and physical safeguards to protect the security of Personal Data.

DEFINITIONS

“Controller” means a natural or legal person, public authority, agency, or other body that, independently or jointly with others, determines the purpose and means of Processing Personal Data, as defined in Data Protection Laws. Controller shall refer to Yacuna, and with regard to certain Processes, Yacuna may act as joint Controller with a third-party.

“Data Protection Laws” refer primarily to the Regulation (EU) 2016/679 (GDPR), the Singapore Personal Data Protection Act 2012 (PDPA), and the Chinese Cyber Security Law (the CS Law), but may extend to other applicable privacy legislations, regulations, or codes issued by data protection regulators in jurisdictions in which Yacuna has a physical presence.

“Data Subject” means a natural person who can be identified, directly or indirectly, by reference to their Personal Data. In this section, Data Subjects shall include“Personnel”, meaning all employees and interns, contract-based, and part-time Yacuna employees.

“Personal Data” means any information attributable to an identified or identifiable natural person (a Data Subject), as defined in Data Protection Laws. Personal Data does not include data where the identity has been removed (anonymous data). Personal Data shall encompass Special Category Data.

“Process” or “Processing” or “Processed” or “Processes” means, as applicable, any operation or set of operations performed upon Personal Data, whether or not by automatic means, such as collecting, recording, using, organizing, structuring, storing, adapting or altering, retrieving, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing, or purging.

“Processor” means a natural or legal person, public authority, agency, or other body that Processes Personal Data on behalf of a Controller, as defined in Data Protection Laws. A Processors’ activities are limited to the more “technical” aspects of a Process and do not include the exercise of professional judgment or significant decision-making in relation to Personal Data. Processors may include third-party service providers, applications, or agencies utilized by Yacuna in the course of business.

“Special Category Data” means Personal Data revealing racial or ethnic origin, criminal history, political opinions, religious or philosophical beliefs, sexual orientation, trade union membership, or health, genetic, or biometric data, or data pertaining to a child or minor.

GROUNDS FOR PROCESSING PERSONAL DATA

Yacuna will only use Personal Data when Data Protection Laws allow Yacuna to do so. Personal Data shall be Processed in a manner that is adequate, relevant, and not excessive in relation to the intended business purpose(s) of such Processing. Yacuna’s bases for Processing Personal Data may include:

  1. Data Subject giving consent to the Processing of his or her Personal Data for a specific purpose(s);
  2. Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract;
  3. Processing is necessary for compliance with a legal obligation to which Yacuna is subject;
  4. Processing is necessary in order to protect the vital interests of the Data Subject or of another natural person; or
  5. Processing is necessary for the purposes of the legitimate interests pursued by Yacuna or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data, in particular where the Data Subject is a child.

RIGHTS OF DATA SUBJECTS

When applicable, Yacuna shall honor Data Subject rights, as described herein. In accordance with Data Protection Laws and in certain circumstances, a Data Subject may possess the right to:

  1. Request access to his or her Personal Data that Yacuna holds to check that it is accurately and lawfully being Processed.
  2. Request correction of his or her Personal Data that Yacuna holds. This enables Personnel to have any incomplete or inaccurate Personal Data be corrected, though Yacuna may need to verify the accuracy of any new Personal Data provided.
  3. Request erasure of his or her Personal Data. This enables Personnel to ask Yacuna to delete or remove Personal Data where there is no legitimate purpose for the Processing of such Personal Data by Yacuna. Yacuna may not always be able to comply with the request of erasure for specific legal reasons or other legitimate grounds, which will be notified to Personnel, if applicable, at the time of the request.
  4. Object to Processing of his or her Personal Data where Yacuna is relying on a legitimate interest (or those of a third party) and he or she would like to object to the Processing because it impacts his or her fundamental rights and freedoms.
  5. Request restriction of Processing of his or her Personal Data. This enables Data Subjects to ask Yacuna to suspend Processing Personal Data in the following scenarios: (a) establishing the accuracy of Personal Data; (b) where Yacuna's use of Personal Data is unlawful, but there is no request of erasure; (c) where a Data Subject needs Yacuna to hold Personal Data even if retention is no longer required and it is needed to establish, exercise, or defend a legal claim; or (d) a Data Subject objects to Yacuna's use of Personal Data, but Yacuna needs to verify whether there are overriding legitimate grounds to use it.
  6. Request the transfer of his or her Personal Data. Yacuna will provide to Personnel, or a third party, his or her Personal Data in a structured, commonly used, machine-readable format. This right only applies to automated information.
  7. Withdraw consent at any time where Yacuna is relying on consent to Process Personal Data. This will not affect the lawfulness of any Processing carried out before consent is withdrawn.
  8. Be notified of a data breach involving a Data Subject's Personal Data.

Yacuna shall accept, when applicable, any written requests through the appropriate channels from a Data Subject to exercise his or her rights and freedoms pursuant to Data Protection Laws. Yacuna shall use reasonable means to verify the identity of the requester. If Personnel receive a request from a Data Subject in relation to his or her Personal Data, such request shall be promptly escalated to that jurisdiction’s designated Data Protection Officer, or his or her designee, or sent to [email protected].

A Data Subject will not generally have to pay a fee to access his or her Personal Data or to exercise any of the above rights. However, Yacuna may charge a reasonable fee if the request is clearly unfounded or excessive. Yacuna will try to respond to all legitimate requests within one (1) month. Occasionally, it may take Yacuna longer if the request is particularly complex. Alternatively, Yacuna may refuse to comply with the request in certain circumstances.

Yacuna DATA PROTECTION OBLIGATIONS

Yacuna and its Personnel have implemented appropriate technical and organizational measures to provide adequate protection regarding Data Subjects’ rights and the lawful, fair, and transparent Processing of Personal Data, as described herein. Yacuna data protection obligations include the following:

  1. Consent: When consent is the lawful basis for Processing, Yacuna shall obtain the affirmative consent of a Data Subject prior to such Processing. Consent shall be written in clear and plain language by Yacuna and the Data Subject must give consent freely. Prior to providing consent, a Data Subject shall be notified by Yacuna that consent may be withdrawn at any time. Consent may not be permanently binding on Data Subjects, as such Data Subjects may withdraw consent at any time.
  2. Purpose Limitation: Yacuna shall restrict the Processing of Personal Data to the intended business purpose(s).
  3. Notification: Yacuna shall provide notification in clear language to a Data Subject at the outset of Processing, which may include: name of Controller and contact information; purpose of Processing; type(s) of Personal Data Processed; who has access to Personal Data; Processing location(s); retention period; Data Subject’s rights and instructions for exercising such rights; and protections against data breaches.
  4. Access: Upon request by a Data Subject, Yacuna shall provide such Data Subject with access to his or her Personal Data in the possession or under the control of Yacuna and information about the ways in which Personal Data may have been previously Processed.
  5. Correction: Upon request by a Data Subject, Yacuna shall correct any error or omission in a Data Subject’s Personal Data in the possession or under the control of Yacuna. If Personal Data is corrected, Yacuna must inform (i) third-parties to whom data has been disclosed of correction and (ii) Data Subjects that his or her Personal Data has been disclosed to third-parties.
  6. Erasure: Upon request by a Data Subject, Yacuna shall erase such Data Subject’s Personal Data in the possession or under the control of Yacuna, if: (i) Personal Data is no longer necessary for the intended business purpose for which it was Processed; (ii) the Data Subject withdraws consent and there is no other legitimate basis for the Processing; (iii) the Data Subject objects to Processing based solely on Yacuna’s legitimate interest; (iv) the Processing of Personal Data is unlawful; or (v) Personal Data is related to the offer of information society services to a child.” This is not an absolute right, as Personal Data may be retained to the extent required or permitted under applicable law. If Yacuna discloses Personal Data to a third-party, Yacuna shall notify such third-parties of any fulfilled request to erase, unless unreasonable or would result in a disproportionate effort.
  7. Accuracy: Yacuna shall make a reasonable effort to verify that Personal Data Processed by or on behalf of Yacuna is accurate and complete. Generally, Personal Data is obtained directly from the Data Subject.
  8. Protection: Yacuna shall protect Personal Data in its possession or under its control by securing against unauthorized Processing, as further described in the “Security Measures Taken to Protect Personal Data” Section.
  9. Retention: Yacuna shall cease to retain documentation containing Personal Data or remove the means by which Personal Data can be associated with a particular Data Subject, when (i) the intended purpose for which Personal Data was Processed is no longer applicable and (ii) the retention is no longer necessary for legal or business purposes.
  10. Breach Notification: In the case of a data breach involving any loss, misuse, or alteration of Personal Data that is likely to result in (i) a risk to Data Subjects’ rights and freedoms, Yacuna shall notify the supervisory or data protection authorities within seventy-two (72) hours; or (ii) a high risk to Data Subjects’ rights and freedoms, Yacuna shall notify Data Subjects without undue delay.

SHARING OF PERSONAL DATA

Yacuna has executed appropriate documentation to protect the privacy and fundamental rights and freedoms of Data Subjects and has taken appropriate measures to ensure data protection during the sharing of Personal Data.

Yacuna may share Personal Data with third-parties to Process (maintain, store, use) on Yacuna’s behalf. Yacuna requires all such Processors to take appropriate security measures to protect Personal Data in accordance with Yacuna’s policies. Yacuna does not allow Processors to Process Personal Data for their own purposes and only permits them to Process Personal Data for specified purposes and in accordance with Yacuna's instructions. Please email [email protected]for a current list of third-parties Processing Personal Data.

Yacuna may share Personal Data with third parties to Process on their own behalf. Such third parties will be considered joint-Controllers of such Personal Data. While joint-Controllers have shared discretion over the purposes of Processing, all such Controllers agree to Process such shared Personal Data in accordance with Data Protection Laws.

Yacuna may Process Personal Data in the United States, United Kingdom, European Union, or Singapore. Regarding transfers from the European Economic Area, Yacuna has taken steps to provide an adequate level of protection for Personal Data in accordance with Data Protection Laws.

  1. Third-Parties. Yacuna may, from time to time, engage with Processors or joint Controllers, such as third-party service providers, applications, or agencies, to Process Personal Data. Prior to the Processing of Yacuna-controlled Personal Data by a Processor or joint Controller, Yacuna will work with such third-parties to verify that adequate documentation and security safeguards are in place to Process Personal Data in accordance with Data Protection Laws. The Processor or joint Controller shall restrict Processing to the intended business purpose.
  2. Yacuna Entities. Yacuna shall not transfer Personal Data to a country or territory outside the jurisdiction in which it was Processed, except in accordance with the requirements prescribed under Data Protection Laws. Yacuna may transfer or provide access to Personal Data across jurisdictions and entities in accordance with its Data Protection Agreements and Intercompany Agreements, which are aligned with Data Protection Laws.

SECURITY MEASURES TAKEN TO PROTECT PERSONAL DATA

Yacuna has implemented appropriate elements of privacy by design in conjunction with technical and physical safeguards to protect the security of Personal Data from unauthorized or unlawful Processing. As more fully described in the Network Protection and Monitoring Policy, Yacuna uses a number of systems and applications to protect Personal Data at all times, which also allow for the following capabilities: (i) the anonymization and encryption of Personal Data; (ii) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of Processing Personal Data; (iii) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and (iv) a process for regularly testing, assessing, and evaluating, at least annually, the effectiveness of such security measures.

In assessing the appropriate level of security as well as the risks of varying likelihood and severity for the rights and freedoms of Data Subjects, Yacuna assesses the risks presented by the Processing of Personal Data. Such risks may include, but are not limited to, any accidental, unlawful, or unauthorized destruction, loss, disclosure, alteration, or access to Personal Data Processed by or on behalf of Yacuna, or other factors that may impact Data Subject rights and freedoms. Yacuna shall make reasonable attempts to ensure that any risks presented by the Processing of Personal Data are sufficiently mitigated by technological and/or organizational controls, including limited access of Personal Data utilizing access controls and password protections.

THIRD PARTY WEBSITES AND SOCIAL MEDIA

This website may contain content and links to third-party websites that are not owned, operated, or controlled by Yacuna. Yacuna is not responsible for the privacy practices of or the content displayed on such third-party websites.

When engaging with Yacuna’s content on or through a third-party social networking website, plug-in, or application, Yacuna may Process Personal Data associated with your social media account.

REVIEW AND UPDATES TO POLICY

Yacuna will review and may update this Policy to reflect changes to Yacuna’s privacy practices or security measures as needed. If a review is not satisfactory, Yacuna will take immediate steps to remedy any noted deficiencies. Please periodically review this Policy for the latest on Yacuna’s privacy practices. The use of Yacuna’s website after any updates constitutes an acknowledgement of having read and understood the Policy.

CONTACT

Please contact Yacuna by email at [email protected] should you have any questions or comments about this Policy or your Personal Data.