17.1 The Company shall be responsible for full compliance with all relevant data protection legislation applicable in the territories in which it operates, including the General Data Protection Regulation 2016/679 (EU GDPR), the Data Protection Act 2018 (UK), and the Lei Geral de Proteção de Dados 2018 (LGPD - Brazil Data Protection Law), in relation to the processing of any personal data collected and held by the Company.
17.2 We will only use such personal data for administration, management, operations (including payment), record keeping, performance of contract, complying with legal requirements, and for the purpose of other legitimate interests during the term of subscription. Unless specifically required to do so by law, MyCena® will not share any Subscriber or User personal data with any third parties.
17.3 A Governance, Risk and Compliance section in the MyCena® Console records every successful and unsuccessful User action in the Console and Application (for example answering security questions, accessing Bronze, Silver, and Gold levels within the Application, clicking on the “go to” button, etc.). This allows User access monitoring without anyone actually knowing any individual User password(s).
17.4 Business and Enterprise Subscribers warrant that they have the rights to use their User’s data.
17.5 Subscribers can write to Our Data Protection Officer (DPO) by sending an email to [email protected] at any time to request confirmation, access, correction, anonymization, blocking, deletion, portability, or to raise any other information request or matter in relation to their Personal Data and the processing thereof.
17.6 We will undertake that data is processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing, unlawful access by or sharing with unauthorized persons, and against accidental loss, destruction, or damage, using appropriate technical and/or organizational measures.
17.7 Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Company shall in relation to personal data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR, and Article 46(1) of LGPD. For avoidance of doubt, the Website, Console, and Applications use end-to-end data encryption.
17.8 We will notify You without undue delay upon becoming aware of any security incident affecting personal data held by Us that may create risk or relevant damage to You. In such circumstances, we will provide You with the following information:
(a) information on who has been affected by the incident;
(b) a description of the nature of the affected personal data;
(c) an indication of the technical and security measures used to protect the data (subject to commercial and industrial secrecy);
(d) the risks related to the incident;
(e) explanations for any delay, in cases in which Our communication to You was not immediate; and
(f) the measures that were or will be adopted to investigate, reverse, mitigate and/or remediate the effects of the damage.
17.9 Each User’s licence/account may only be used by that User. Sharing a licence/account with any other person is not permitted. The User is solely responsible for maintaining the security of their account and their authentication credentials, including their own security questions, fingerprint, face ID, PIN, lock pattern and passphrase for use with the Applications, and their login and password for Console access.