General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) aims to protect the privacy and personal data of individuals within the European Union (EU) and European Economic Area (EEA). It also addresses the export of personal data outside the EU and EEA areas. Here, we explain the key components of GDPR and how we ensure compliance.

Data Protection Principles

We are committed to processing personal data in a lawful, fair, and transparent manner. Here are the data protection principles under the GDPR:

• Lawfulness, fairness, and transparency: Personal data must be processed lawfully, fairly, and transparently.
• Purpose limitation: Data should only be collected for specified, legitimate purposes.
• Data minimization: Only the necessary amount of personal data should be collected.
• Accuracy: Personal data must be accurate and up to date.
• Storage limitation: Personal data should only be kept as long as necessary.
• Integrity and confidentiality: Personal data must be processed securely.

Data Subject Rights

Individuals have the following rights under the GDPR:

• Right to access: Individuals can request a copy of their personal data.
• Right to rectification: Individuals can request corrections to their personal data.
• Right to erasure: Also known as the "right to be forgotten," individuals can request the deletion of their personal data.
• Right to restrict processing: Individuals can request the restriction of the processing of their personal data.
• Right to data portability: Individuals can request the transfer of their data to another service provider.
• Right to object: Individuals can object to the processing of their personal data for marketing purposes.

Accountability and Documentation

We are required to maintain documentation of our data processing activities and demonstrate compliance with the GDPR. This includes:

• Appointing a Data Protection Officer (DPO) when necessary.
• Maintaining records of data processing activities.
• Conducting Data Protection Impact Assessments (DPIAs) when required.

Data Breaches

In case of a data breach, we will follow GDPR procedures:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach.
• Inform affected individuals if the breach is likely to result in a high risk to their rights and freedoms.

International Data Transfers

We ensure that personal data transferred outside the EU/EEA will be protected in accordance with GDPR standards.

Fines and Penalties

Failure to comply with the GDPR can result in significant fines, up to 4% of annual global turnover or €20 million, whichever is higher.