Introduction
TechQ Business Systems is committed to protecting the privacy and security of personal data. This GDPR Policy outlines our approach to ensure compliance with the General Data Protection Regulation (GDPR) and other relevant data protection laws.
Scope
This policy applies to all employees, contractors, and third parties who handle personal data on behalf of Business Achiever.
Definitions
- Personal Data: Any information relating to an identified or identifiable natural person.
- Processing: Any operation performed on personal data, including collection, storage, use, and deletion.
- Data Subject: The individual to whom the personal data relates.
- Data Controller: The entity that determines the purposes and means of processing personal data.
- Data Processor: The entity that processes personal data on behalf of the data controller.
Data Protection Principles
Business Achiever adheres to the following principles when processing personal data:
- Lawfulness, Fairness, and Transparency: We process personal data lawfully, fairly, and transparently.
- Purpose Limitation: We collect personal data for specified, explicit, and legitimate purposes.
- Data Minimization: We collect only the personal data that is adequate, relevant, and necessary.
- Accuracy: We ensure that personal data is accurate and up-to-date.
- Storage Limitation: We retain personal data only for as long as necessary for the purposes for which it was collected.
- Integrity and Confidentiality: We process personal data securely, protecting it against unauthorized or unlawful processing, and against accidental loss, destruction, or damage.
- Accountability: We take responsibility for and can demonstrate compliance with GDPR.
Legal Basis for Processing
We process personal data based on one or more of the following legal grounds:
- Consent from the data subject.
- Performance of a contract.
- Compliance with a legal obligation.
- Protection of vital interests of the data subject or another person.
- Performance of a task carried out in the public interest.
- Legitimate interests pursued by [Company Name] or a third party, unless these are overridden by the interests or fundamental rights and freedoms of the data subject.
Data Subject Rights
Data subjects have the following rights regarding their personal data:
- Right to Access: Obtain confirmation as to whether or not personal data concerning them is being processed, and access to that data.
- Right to Rectification: Request the correction of inaccurate personal data.
- Right to Erasure: Request the deletion of personal data in certain circumstances.
- Right to Restriction of Processing: Request the restriction of processing of personal data in certain circumstances.
- Right to Data Portability: Receive personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.
- Right to Object: Object to the processing of personal data in certain circumstances.
- Right to Withdraw Consent: Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Data Security
Business Achiever implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of personal data.
- Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
- Procedures for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures.
Data Breach Notification
In the event of a personal data breach, Business Achiever will notify the relevant supervisory authority within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If the breach is likely to result in a high risk, we will also inform the affected data subjects without undue delay.
Data Protection Impact Assessments (DPIAs)
We conduct DPIAs for processing activities that are likely to result in a high risk to the rights and freedoms of data subjects.
Training and Awareness
All employees and contractors who handle personal data receive training on data protection and GDPR compliance.
Third-Party Processors
Where we engage third parties to process personal data on our behalf, we ensure that they provide sufficient guarantees to implement appropriate technical and organizational measures and comply with GDPR requirements.
Policy Review
This policy is reviewed annually or as necessary to reflect changes in legislation or our data processing practices.
Contact Information
For questions about this policy or to exercise any of your rights, please contact our Data Protection Officer (DPO) at 076 554 8989 or info@techq.co.za
TechQ Business Systems Sage accounting Partner. Sageone accounting. Sage sage invoicing software