Personal Data Protection Policy
of the Rural Development Agency
Article 1. General Provisions
1.1 The Personal Data Protection Policy (hereinafter – the “Policy”) establishes the principles, purposes, and rules for the processing of personal data at the N(N)LE – Rural Development Agency (hereinafter – the “Agency”).
1.2 For the purposes of this document, a data subject means a natural person applicant/interested party, as well as their representative (if the applicant/interested party has applied to the Agency through a representative), natural persons indicated in the documentation/data maintained by the Agency, beneficiaries/potential beneficiaries, users of the Agency’s website, hotline, and other communication channels, visitors, employees/interns of the Agency and candidates for employment/internship, as well as contractor natural persons.
1.3 The terms used in this document shall have the meanings defined by the Law of Georgia on Personal Data Protection.
Article 2. Purpose and Scope of the Policy
2.1 The purpose of the Policy is to provide interested persons with information regarding the process of personal data processing at the Agency.
2.2 The Agency processes and protects personal data in accordance with the requirements of the legislation of Georgia on personal data protection.
Article 3. Grounds for Processing Personal Data
3.1 The Agency implements programs and projects initiated by the Ministry of Environmental Protection and Agriculture of Georgia, within the framework of which the Agency’s beneficiaries receive various types of support.
3.2 The Agency processes personal data in order to ensure the participation of potential beneficiaries/beneficiaries in the Agency’s programs and projects, and for the purpose of regulating relations with employees/interns and candidates for employment/internship.
3.3 The Agency processes personal data if one of the following grounds exists:
3.3.1 The consent of the data subject (in the case of a minor under the age of 16, the consent of their parent or other legal representative);
3.3.2 For the performance of a contract, or at the request of the data subject prior to entering into a contract;
3.3.3 The processing of data is provided for by law;
3.3.4 The data is publicly available;
3.3.5 The processing of data is necessary for the protection of vital and/or public interests;
3.3.6 The Agency is fulfilling an obligation imposed on it by the legislation of Georgia;
3.3.7 The processing of data is carried out for the protection of legitimate interests, including the monitoring of projects and programs, reporting, and research into their effectiveness.
Article 4. Categories of Personal Data and Their Processing
4.1 The information processed by the Agency may include the following categories of data, proportionate to the purpose of processing:
4.1.1 Identification Data – information specified in an identity document and signature;
4.1.2 Contact Information – telephone number, email address, residential address (registered and actual);
4.1.3 Financial Information – bank account details, certificate from a banking institution confirming the existence of the amount required for participation in a project/program in the account;
4.1.4 Documentary Information – information specified in the submitted documentation;
4.1.5 Contractual Information – information provided for in contracts concluded between the Agency and data subjects;
4.1.6 Technical Information – information about devices and technologies used when visiting the Agency’s website;
4.1.7 Special Categories of Data – processed only if there is a strictly defined legal basis provided for by the applicable legislation of Georgia, including the written consent of the data subject or another legal basis established by law;
4.1.8 Optional Personal Data – based on the prior consent of the data subject, the Agency may process optional personal data for the purpose of improving programs and projects, and planning new services or training activities. Sharing such data is entirely voluntary, and failure to provide it does not restrict the subject’s access to the Agency’s services;
4.1.9 Any type of personal data or special category personal data provided for by law that the data subject voluntarily shares with the Agency;
4.1.10 For the purpose of improving ongoing projects/programs of the Agency, as well as developing new projects/programs or educational/practical training activities, various personal data may be processed with the consent of the data subject, the sharing of which is not mandatory.
Article 5. Sources of Obtaining Personal Data
5.1 The Agency obtains the personal data of data subjects from the following sources:
5.1.1 When the data subject applies to the Agency for employment or internship purposes;
5.1.2 When the data subject applies to participate in the Agency’s projects/programs or uses other Agency services;
5.1.3 Upon conclusion of various types of contracts with the Agency;
5.1.4 When using the Agency’s communication channels (hotline, website, email) and during visits;
5.1.5 From electronic and physical correspondence received by the Agency;
5.1.6 From publicly available sources;
5.1.7 Within the framework of projects/programs, in certain cases, the Agency may obtain personal data from the relevant person. The purpose of obtaining such data is to simplify the service delivery process and ensure the accuracy of the data.
Article 6. Processing of Personal Data of Employees, Interns, and Employment/Internship Candidates
6.1 The purposes of processing the personal data of employees/interns and candidates are:
6.1.1 Conclusion, termination, and performance of a contract;
6.1.2 Payment of remuneration in accordance with the contract, administration of pension contributions, taxes, and other payable amounts;
6.1.3 Communication with the employee/intern or candidate;
6.1.4 Protection of the rights of the Agency’s employees/interns and third parties;
6.1.5 Appropriate response to complaints submitted by employees/interns or candidates;
6.1.6 Any other similar legitimate purpose that complies with the Labor Code and the legislation of Georgia on personal data protection.
6.2 The Agency processes the following types of personal data of employees/interns or candidates:
6.2.1 Identification Data – the employee’s first and last name, year, month, and date of birth;
6.2.2 Contact Information – address, email address, and mobile phone number;
6.2.3 The employee’s photograph (photo from the identity card or a photo voluntarily shared by the employee with the employer);
6.2.4 Information related to education, qualifications, and work experience (to the extent that the employee/candidate shares such information in the form of a résumé/CV);
6.2.5 Medical documentation;
6.2.6 Certificate of narcological registration;
6.2.7 Criminal record certificate;
6.2.8 Financial Information – bank account details;
6.2.9 Information regarding the terms of employment and internship agreements, and the performance or non-performance of rights and obligations.
6.3 Access to the personal data of employees/interns or candidates may be granted only to authorized persons within the scope of performing their functions.
Article 7. Audio and Video Monitoring
7.1 The purpose of video monitoring at the Agency (central office) is to ensure the safety of employees and visitors and the protection of property.
7.2 Video monitoring is conducted at the Agency (central office) 24 hours a day, 7 days a week, at building entrances and in corridors. The video monitoring system records only video and does not conduct audio monitoring. Appropriate warning signs are placed near the video surveillance cameras.
7.3 The hotline of the Ministry of Environmental Protection and Agriculture of Georgia operates 24 hours a day, 7 days a week, through which calls related to the activities of agencies within the system of the Ministry are received and processed.
7.4 The Agency records telephone calls only after prior notification.
7.5 The purpose of audio monitoring is to improve customer service, enhance the provision of information within the scope of the activities of the Ministry of Environmental Protection and Agriculture of Georgia, record telephone inquiries and ensure appropriate responses, monitor service quality, and fulfill the Agency’s legal obligations.
Article 8. Transfer of Personal Data to Third Parties
8.1 The Agency may transfer the personal data of a data subject to third parties in cases provided for by the legislation of Georgia, in the interests of the data subject, when necessary for the provision of its services, as well as for the purpose of fulfilling the Agency’s obligations imposed by law or undertaken under a contract.
8.2 Third parties may include natural or legal persons, state authorities, and donor organizations to whom information is transferred for purposes defined by the legislation of Georgia, within the framework of the Agency’s contractual obligations, for servicing data subjects, monitoring, research, and analytical purposes.
Article 9. Data Security
9.1 The Agency has implemented all necessary organizational and technical measures to ensure that data processing is carried out in accordance with the Law of Georgia on Personal Data Protection.
9.2 The organizational and technical measures adopted by the Agency ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure, acquisition, unlawful use, and loss.
9.3 Access to personal data maintained by the Agency is granted only to those employees who require such data processing in order to perform their assigned duties.
Article 10. Persons Authorized to Process Data
10.1 On behalf of the Agency, the processing of personal data may be entrusted to third parties (persons authorized to process data), who process the data on the Agency’s instructions and on the basis of an appropriate agreement.
10.2 Persons authorized to process data are obliged to process personal data only in accordance with the Agency’s instructions and only to the extent necessary to achieve the purposes established by law or to provide services defined under the contract.
10.3 The Agency ensures that agreements concluded with persons authorized to process data contain clear conditions regarding the processing of personal data within the framework of the law, including the implementation of appropriate technical and organizational measures.
10.4 In specific cases, the Agency shall provide information about persons authorized to process data. A person may also apply to the Agency and request information regarding a specific authorized processor.
Article 11. Transfer of Data to Another State and/or International Organization
In cases where beneficiaries participate in international exhibitions, the data of beneficiary representatives may be transferred through the Agency to exhibition organizers from various countries, of which the data subjects shall be informed in advance.
Article 12. Rights of the Data Subject
12.1 The data subject has the right to request information regarding the processing of their personal data and to obtain copies of such data, including:
12.1.1 What data is being processed about them;
12.1.2 For what purpose the data is being processed;
12.1.3 On what legal basis the data is being processed;
12.1.4 Through which source their data was collected;
12.1.5 Whether their personal data has been transferred to a third party, including information about the third party, the basis for the transfer, and its purpose;
12.1.6 To request the correction, blocking, updating, and/or completion of incorrect, inaccurate, and/or incomplete data;
12.1.7 To request the termination of processing, deletion, or destruction of data;
12.1.8 To withdraw at any time, without any explanation, the consent previously given for the processing of personal data and to request the deletion of data processed on the basis of such consent.
12.2 The Agency shall respond appropriately to notifications provided for under paragraph 1 of this article within the timeframes established by the Law of Georgia on Personal Data Protection, no later than within 10 working days.
12.3 The rights of the data subject may be restricted in accordance with the procedures established by the legislation of Georgia.
12.4 The data subject may submit an application to the Agency via email at info@rda.gov.ge ; submit the application either to the Agency’s central office or regional information-consultation centers (see addresses at https://rda.gov.ge/contact/contact ), or send it by post. The application must be accompanied by a copy of the applicant’s identity card.
Article 13. Retention Periods for Personal Data
13.1 The Agency stores personal data only for the period necessary to achieve the purposes defined in this document and/or to fulfill obligations imposed on the Agency by legislation regarding data retention.
13.2 Taking into account the legitimate interests of the Agency and data subjects (including the consideration of possible applications and complaints), video recordings are stored for no longer than 3 months. After the expiration of this period, the recordings are automatically deleted, unless there is a legitimate interest and appropriate legal basis for retaining the recordings for a longer period.
13.3 Taking into account the legitimate interests of the Agency and data subjects (including the consideration of possible applications and complaints), hotline audio recordings are stored for a period of 1 year. After the expiration of this period, the recordings are deleted, unless there is a legitimate interest and appropriate legal basis for retaining the recordings for a longer period.
13.4 The retention periods for personal data at the Agency are regulated in accordance with the timeframes established by Order No. 72 of March 31, 2010, of the Minister of Justice of Georgia “On Approval of the List of Standard Administrative Documents Created in the Course of Institutional Activities (with Indication of Their Retention Periods),” which depend on the types of data and the purposes of their use.
Article 14. Right to Appeal
The data subject has the right, in the event of a violation of the rights and procedures established by the Law of Georgia on Personal Data Protection, to apply to the State Audit Office and/or the court in accordance with the procedure established by law.
Article 15. Contact
Regarding issues related to personal data at the Agency, interested persons may contact the Personal Data Protection Officer via email at dpo@rda.gov.ge , as well as contact the Agency’s hotline at 15 01 and online support through the website rda.gov.ge .
Article 16. Updating the Document
16.1 The Policy shall be periodically reviewed as necessary.
16.2 The latest version of the Policy is available on the Agency’s website at rda.gov.ge .