GDPR Policy

IPI INTERMEDIATE PETROCHEMICAL INDUSTRY
PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

This Privacy Notice has been prepared by IPI Intermediate Petrochemical Industry (“the Company”) to inform the Company’s customers regarding the processing of their personal data by the Company under the Law on the Protection of Personal Data No. 6698 (“the Law”).

For detailed information regarding the processing of your personal data within the scope of this Privacy Notice, please refer to the IPI Intermediate Petrochemical Industry Company’s Personal Data Protection and Processing Policy, available at https://ipi.webtasarim.link/.

1. a) Methods and Legal Grounds for the Collection of Personal Data

Your personal data is collected electronically or in physical form. Your personal data, collected on the legal grounds set out in this Privacy Notice, may be processed and shared in accordance with the conditions for the processing of personal data set out in Articles 5 and 6 of the Act.

1. b) Purposes of Processing Personal Data

Your personal data is processed by the Company, in accordance with the conditions for the processing of personal data set out in Articles 5 and 6 of the Act, for the purposes of planning and carrying out the activities necessary to personalise the products and services offered by the Company in line with the preferences, usage habits and needs of data subjects, and to recommend and promote these to the relevant individuals, to enable the relevant business units to carry out the necessary work and execute the relevant business processes to ensure that data subjects benefit from the products and services offered by the Company; to enable the relevant business units to carry out the necessary work and execute the associated business processes for the conduct of the Company’s commercial activities; Processed for the purposes of planning and implementing the Company’s commercial and/or business strategies, and ensuring the legal, technical and commercial-business security of the Company and relevant individuals with whom the Company has a business relationship.

1. c) Parties with whom personal data may be shared and the purposes of such sharing

Your personal data is processed in accordance with the conditions and purposes of personal data processing set out in Articles 8 and 9 of the Act, for the planning and execution of activities necessary to personalise and recommend the products and services offered by the Company to data subjects in line with their preferences, usage habits and needs, to enable the relevant business units to carry out the necessary work and execute the relevant business processes to ensure that data subjects benefit from the products and services offered by the Company; to enable the relevant business units to carry out the necessary work and execute the associated business processes for the conduct of the Company’s commercial activities; Personal data may be shared with the Company’s business partners and suppliers, as well as with legally authorised public bodies and organisations and legally authorised private legal entities, for the purposes of planning and implementing the Company’s commercial and/or business strategies and ensuring the legal, technical and commercial-business security of the Company and relevant individuals with whom the Company has a business relationship.

1. d) Data Subjects’ Rights and the Exercise of Those Rights

If, as data subjects, you submit requests regarding your rights set out below to the Company using the methods specified under the heading ‘Exercise of Rights by Data Subjects’, your requests will be assessed and resolved by our Company as soon as possible and, in any event, within 30 (thirty) days. 

Under Article 11 of the Act, as a data subject, you have the following rights:

• To find out whether your personal data is being processed,
• If your personal data has been processed, you have the right to request information regarding this,
• To find out the purpose for which your personal data is processed and whether it is being used in accordance with that purpose,
• The right to know which third parties, whether within the country or abroad, your personal data has been transferred to,
• Should your personal data be incomplete or have been processed incorrectly, you have the right to request that it be rectified and, in this context, to request that the third parties to whom your personal data has been disclosed be informed of the rectification,
• Although your personal data has been processed in accordance with the provisions of this Act and other relevant legislation, you have the right to request the erasure or destruction of your personal data should the grounds justifying its processing cease to exist, and to request that third parties to whom your personal data has been disclosed be informed of the action taken in this regard,
• The right to object to a decision being made solely by automated systems that results in a decision to the detriment of the individual,
• To claim compensation for any loss suffered as a result of the unlawful processing of your personal data.
• Paragraph 2 of Article 28 of the Act sets out the circumstances in which data subjects do not have the right to make a request; within this scope:
• Where the processing of personal data is necessary for the prevention of crime or for the purposes of a criminal investigation,
• The processing of personal data that has been made public by the data subject themselves,
• Where the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for the purposes of disciplinary investigations or proceedings, by public bodies and organisations with the relevant mandate and authority, as well as by professional bodies with the status of public bodies, acting pursuant to the powers conferred by law,
• The processing of personal data is necessary for the protection of the State’s economic and financial interests in relation to budgetary, tax and financial matters,
• The rights set out above cannot be exercised in respect of data in such circumstances.
• However, in accordance with Article 28(1) of the Act, as data will fall outside the scope of the Act in the following circumstances, data subjects’ requests regarding such data will not be processed:
• The processing of personal data by natural persons, provided that such data is not disclosed to third parties and that obligations relating to data security are complied with, in the context of activities relating solely to themselves or to family members living in the same household.
• The processing of personal data for purposes such as research, planning and statistics by anonymising it through official statistics.
• The processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that such processing does not infringe upon national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, nor does it constitute a criminal offence.
• The processing of personal data in the context of preventive, protective and intelligence activities carried out by public bodies and organisations to which the law has conferred duties and powers to safeguard national defence, national security, public safety, public order or economic security.
• The processing of personal data by judicial authorities or enforcement authorities in connection with investigations, prosecutions, trials or enforcement proceedings.

Exercise of Rights by Data Subjects

• Data subjects may use the “_Form for Applications to the Data Controller by the Data Subject_” available at the link https://ipi.webtasarim.link/ to exercise the rights mentioned above.
• Applications must be submitted, together with documents verifying the identity of the relevant data subject, using one of the following methods:
• A completed copy of the form, bearing a wet signature, must be submitted in person, via a notary, or by registered post to the address: Wadi Al-Ush Industrial Zone, Zarqa, Jordan,
• The form must be signed using a secure electronic signature issued in accordance with the Electronic Signature Law No. 5070 and sent via registered email to info@ipi.com.jo,
• Compliance with a procedure prescribed by the Personal Data Protection Board.
• The company responds to data subjects wishing to exercise the rights in question, within the limits set out in the Act, within a maximum of thirty (30) days, as provided for in the Act. For third parties to submit a request on behalf of data subjects, there must be a special power of attorney drawn up by a notary public in the name of the person who will submit the request, authorised by the data subject.
• Whilst data subject requests are generally processed free of charge, a fee may be charged in accordance with the fee schedule[1] set out by the Personal Data Protection Board.
• The company may request information from the data subject in order to determine whether the applicant is the data subject, and may ask the data subject questions regarding their application in order to clarify the matters set out in the application.

[1] In accordance with the ‘Communication on the Procedures and Principles for Applications to the Data Controller’, published in the Official Gazette No. 30356 dated 10 March 2018, if a written response is to be provided to a data subject’s application, no fee shall be charged for up to ten pages. A processing fee of 1 Turkish Lira may be charged for each page in excess of ten. Where the response to the request is provided on a storage medium such as a CD or USB stick, any fee charged by the Authority may not exceed the cost of the storage medium.