1. Data Protection Principles

We are committed to processing data in accordance with our responsibilities under the GDPR. Personal data shall be:

1. Processed lawfully, fairly, and transparently.
2. Collected for specified, explicit, and legitimate purposes.
3. Adequate, relevant, and limited to what is necessary.
4. Accurate and, where necessary, kept up to date.
5. Kept in a form that permits identification of data subjects for no longer than necessary.
6. Processed securely, including protection against unauthorized or unlawful processing, loss, destruction, or damage.

2. General Provisions

• This policy applies to all personal data processed by us.
• We take responsibility for ongoing compliance with this policy.
• This policy shall be reviewed at least annually.

3. Lawful, Fair, and Transparent Processing

• We maintain a Register of Systems to ensure lawful, fair, and transparent processing.
• The Register of Systems shall be reviewed annually.
• Individuals have the right to access their personal data, and requests shall be dealt with in a timely manner.

4. Lawful Purposes

• Data processing must be done on lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
• Evidence of opt-in consent shall be kept with the personal data.
• Systems are in place to ensure accurate reflection of consent revocation.

5. Data Minimisation

We ensure that personal data are adequate, relevant, and limited to what is necessary for the purposes for which they are processed.

6. Accuracy

We take reasonable steps to ensure personal data is accurate and kept up to date.

7. Archiving / Removal

• An archiving policy is in place and reviewed annually.
• The policy considers what data should/must be retained, for how long, and why.

8. Security

• Data is stored securely using modern software that is kept up-to-date.
• Access to personal data is limited to necessary personnel with appropriate security.
• Data deletion is done safely, and appropriate back-up and disaster recovery solutions are in place.

9. Breach

In the event of a breach, we shall promptly assess the risk to people’s rights and freedoms and report if required.