Categories of Data Processed by BDO

BDO processes various types of personal data depending on the nature of its services and interactions. Below are the categories of personal data, the data collection methods, and the legal grounds for processing:

BDO Clients (Legal Entities) - In the course of BDO providing professional services or products to its clients, it may be necessary for the client to share with BDO the personal data of its employees, hired individuals, or other related individuals. The categories of personal information shared depend on the content of the professional service and may include the following: name, surname, contact details, financial information, and other data that allows the identification of an individual. In this case, the basis for the processing of personal data is the performance of contractual obligations, and BDO acts as an authorized data processor.

BDO Clients (Individuals) - BDO is provided with personal data directly by its individual clients. The categories of personal data depend on the content of the contract that BDO enters into with the client. For BDO’s individual clients who receive training services, please visit this link.

Personal Data required For Identification And Verification Of BDO Clients - Based on the requirements of the Law of Georgia On the Prevention of Money Laundering and the Financing of Terrorism, BDO collects data required for the identification and verification of directors, persons responsible for management, and beneficial owners of its clients as defined by law. In this case, the processing of data is provided for by law.

BDO’s Subcontractors/Suppliers (Legal Entities) - In the course of providing services to BDO, it may be necessary for BDO’s subcontractors/suppliers to share personal data of their employees, hired individuals, or other related individuals with BDO. The categories of personal information shared depend on the content of the service and may include the following: name, surname, contact details, financial information, and other data that allows for the identification of a person. In this case, the basis for the processing of personal data is the performance of contractual obligations, and BDO acts as an authorized data processor.

BDO's Hired Subcontractors/Suppliers (Individuals) - In the framework of providing services or supplying products to BDO, individuals providing services or supplying products may share their personal data as part of the contract concluded between them and BDO. In this case, the basis for processing personal data is the performance of obligations imposed by the contract, and BDO acts as the person responsible for the processing.

BDO Office Visitors (Video Monitoring) - BDO’s common areas and meeting rooms are monitored by a video monitoring system, which processes the image of a person and their movement. The purpose of video monitoring is to protect the safety of employees, safeguard the property of BDO Group firms, and prevent and/or detect crime. The video monitoring system and recordings are protected from unauthorized access and use. Access to video recordings is limited and occurs only when necessary, such as during an investigation, when an incident occurs, when property is lost or stolen, or to take actions necessary for the safety of employees. BDO Group ensures that each access to video recordings is recorded, including the time of access and the username of the individual accessing the recording. Video recordings are stored for a period of no more than 6 months and are accessible to the BDO Group Procurement and Office Supply Manager and senior executives of BDO Group (if necessary). Warning signs about video monitoring are prominently placed in appropriate locations.

Other Individuals - BDO collects personal data from individuals who contact BDO with a query, complaint, comment, or feedback. Such data may include name and surname, contact information, and the content of the relevant communication. In such cases, the individual who contacts BDO determines the data shared, and BDO uses this data only to respond to the inquiry. Such personal data may include the individual’s name and surname, employer name, contact title, telephone number, email address, and other business contact details.