"Personal Data": any information related to an identified or identifiable natural person ("Data Subject"). An identifiable natural person is one whose identity can be determined, directly or indirectly.
"Data Processing": any operation or set of operations performed on Personal Data or sets of Personal Data, whether by automated or non-automated means, such as collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, communication by transmission, dissemination, or any other form of provision of access, alignment, or interconnection, limitation, erasure, or destruction.
"Data Controller": a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
"Data Processor": a natural or legal person, public authority, agency, or other body that processes Personal Data on behalf of the Controller.
"Applicable Regulations": applicable legislation corresponding to the Controller in the Territory.
4. Identification of the Data Controller#
PSP is a technological tool to manage and implement the Poverty Elimination Stoplight survey and its methodology. This tool, although owned by Fundación Paraguaya de Cooperación y Desarrollo, is used by various organizations/partners (hereinafter, "licensees") located around the world so that they will be the Data Controllers of the personal data of workers, surveyed individuals, and any other third party registered and collected in PSP. In this regard, Fundación Paraguaya de Cooperación y Desarrollo will be the Data Processor for the data mentioned above to provide technical support and storage services for PSP data to the licensees.
Finally, it should be noted that Fundación Paraguaya de Cooperación y Desarrollo will be solely responsible for the processing of Personal Data collected by PSP in a statistical (aggregated, anonymous) manner; that is, data that does not allow the identification of natural persons. This data is used for commercial, academic, or demonstrative purposes. The legal basis for processing this data is the legitimate interest of Fundación Paraguaya de Cooperación y Desarrollo in improving the processes of the tool itself and providing real information to potential clients (potential licensees) to demonstrate the tool's effectiveness.
5. Categories of Processed Data#
The categories of data that may be processed in PSP are:
a) Regarding workers or personnel of the licensees:
Authentication data (username and password)
b) Regarding surveyed individuals:
Information related to the overall quality of life, including:
Academic or professional data
Economic data or financial situation
Special categories of data: Health data and data related to sexual life
* In no case are data related to criminal convictions or offenses collected, but questions can be asked regarding drug use, violence and alcohol abuse, or domestic violence.
6. Purposes of Processing#
The purposes of processing the aforementioned data categories carried out by licensees as Data Controllers are:
a) Register users in PSP, allowing them to generate reports, assign projects, and conduct surveys.
b) (i) Understand the living conditions of surveyed individuals and, thus, promote the implementation of programs to help improve the quality of life indicators that require more attention; as well as (ii) monitor and evaluate the impact they have on the communities in which they operate.
7. Legal Bases#
The legal bases that legitimize the processing of personal data for the purposes mentioned above are:
a) Execution of the contract.
b) Explicit and voluntary consent of surveyed individuals aged 14 or older. In any case, it is optional to answer all the survey questions (the individual can leave any question blank).
8. Data Communications#
Personal data will not be transferred to third parties unless there is express consent, in compliance with a legal obligation, or at the request of a competent authority.
However, data may be processed by service provider companies ("Sub-Processors") of Fundación Paraguaya de Cooperación y Desarrollo, which, within the framework of provision, may have access to data to fulfill the service (web hosting providers, data storage, email sending, etc.). With such companies, the corresponding Data Processing Agreement is being signed, obliging them to adopt the necessary security measures to ensure the confidentiality, integrity, availability, and permanent resilience of the systems and services for the processing of Personal Data, in order to prevent loss, deletion, or destruction of data and unauthorized or improper access to it.
9. International Data Transfers#
Service providers ("Sub-Processors") of Fundación Paraguaya de Cooperación y Desarrollo may be located outside the European Economic Area or Paraguay. In case it is detected that data is processed/hosted in countries that do not comply with an adequate level of protection, you will be properly informed of this situation and, if applicable (according to the Applicable Regulations to the licensee as Data Controller), express consent will be obtained for the international transfer.
10. Data Retention Period#
Data will be processed until the purposes described above are satisfied, and beyond this period, they will be retained to address possible responsibilities or in compliance with a legal obligation. In any case, the licensees, as Data Controllers, will be responsible for specifying the retention periods in greater detail.
11. Data Protection Rights#
If you are a surveyed individual, you can request the deletion of your data from the representative who administered the survey by email or in person, once you have completed the survey. If you are still completing the survey, you have the option to delete the
information you have already provided or leave fields blank.
In any case, you can exercise the rights of access, rectification, erasure, objection, limitation, portability, and not to be subject to automated decisions, when applicable, before Fundación Paraguaya de Cooperación y Desarrollo, by sending a written request to the email email@example.com. Upon receipt of the communication, Fundación Paraguaya de Cooperación y Desarrollo will proceed to communicate the request to the licensee who is the Data Controller of your data so that they can process it.
If you believe that your data is not being processed correctly by Fundación Paraguaya de Cooperación y Desarrollo, you can file a complaint with its Data Protection Officer (Adaptalia Legal-Formativo S.L.) or with the competent supervisory authorities, when applicable, such as:
13. Security and Confidentiality#
To safeguard the security of your data, we inform you that Fundación Paraguaya de Cooperación y Desarrollo has adopted all technical and organizational measures necessary to ensure the protection of the personal data provided. All this to prevent its alteration, loss, and/or unauthorized processing or access, as required by regulations, although absolute security does not exist. Similarly, we inform you that your data will be treated with the utmost care and confidentiality by all personnel involved in any phase of the processing.