Introduction
Purpose: This Data Protection Policy outlines the principles, responsibilities, and practices to ensure the secure and compliant handling of personal and sensitive data within Quadcore Technologies Limited
Scope: This policy applies to all employees, contractors, and third-party service providers who process, store, or handle data on behalf of Quadcore Technologies Limited
Policy Statement
Quadcore Technologies Limited is committed to protecting the privacy and security of personal and sensitive data. We comply with the Nigeria Data Protection Act, Nigeria Data Protection Regulation and implement appropriate measures to safeguard data against unauthorized access, disclosure, alteration, and destruction.
Data Protection Principles
We adhere to the following data protection principles:
-
Transparency: In line with Section 24(1) of the Nigeria Data Protection Act we shall ensure that
- personal data shall be processed in a fair, lawful and transparent manner.
- Personal Data shall be collected for specified, explicit, and legitimate purposes
- Personal Data shall not to be further processed in a way incompatible with these purposes
-
Lawful basis for processing: In line with Section 25 of the NDPA we shall process Personal Data according to the following lawful bases:
- where the Data Subject has given and not withdrawn consent for the specific purpose or purposes for which Personal Data is to be processed;
- where processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract;
- where processing is necessary for compliance with a legal obligation to which we are subject;
- where processing is necessary in order to protect the vital interests of the Data Subject or of another natural person;
- where processing is necessary for the performance of a task carried out in the public interest or in exercise of official public mandate vested in us; or
- where processing is necessary for the purposes of the legitimate interests pursued by the us, or by a third party to whom the data is disclosed.
- Purpose limitation: In line with the principle of purpose limitation in relation to Section 24(1)(b) of the NDPA, we shall ensure that Personal Data is collected for specified, explicit and legitimate purposes, and not to be further processed in a way that is incompatible with these purposes.
- Data minimization & Proportionality: In accordance with Section 24(1)(c) of the NDPA requires we shall ensure that Personal Data is adequate, relevant and limited to the minimum necessary for the purposes for which the personal data was collected or further processed.
- Retention: In conformity with Section 24(1)(d) of the NDPA we shall ensure that Personal Data is retained for not longer than is necessary to achieve the lawful bases for which the Personal Data was collected or further processed
- Data Security: In line with Section 24(1)(f) we shall ensure that Personal Data is processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorized or unlawful processing, access, loss, destruction, damage, or any form of data breach.
-
Accountability: In accordance with Section 24(3) we owes you a duty of care, in respect of data processing, hence we ensure compliance with the NDPA.
Data Subject Rights
Individuals have the following rights regarding their personal data:
-
Right of access to data/copies of data: In line with Section 34(1)(b) of the NDPA we guarantee
- the right of the Data Subject to obtain from us their personal data, without constraint or unreasonable delay in a concise, transparent, intelligible and easily accessible form, using clear and plain language within a maximum period of one month within receipt of the Data Subject’s request, to provide the information requested.
- The information may be provided free of charge or at a reasonable fee to cover the administrative costs of providing the information
-
We may refuse to provide the information where the Data Subject’s data access request is manifestly unfounded or excessive or is repetitive and inform the Data
Subject and the NDPC at instances wherein we refuse to act on the data access request of the Data Subject.
- Right to rectification of errors: In line with Section 34(1)(c) of the NDPA we guarantee the right of Data Subject to request that we correct or if not feasible or suitable, delete the Data Subject’s Personal Data that is inaccurate, out of date, incomplete or misleading. We shall also provide information to the Data Subject about any recipient of such data if the requests for this disclosure is made.
- Right to deletion/right to be forgotten: In line with Section 34(1)(d) of the NDPA we uphold the right of the Data Subject to request for the erasure of Personal Data without undue delay in line with Section 34(2) of the NDPA
- Right to object to processing: According to Section 36 of the NDPA we assure the right of Data Subject to object to the processing of his/her Personal Data. We shall discontinue the processing of such Personal Data, unless the it is of public interest or other legitimate grounds, which overrides the fundamental rights and freedoms, and the interests of the Data Subject.
- Right to restrict processing: In accordance with Section 34(1)(v) of the NDPA we uphold the right of Data Subject to request for the restriction of processing of their Personal Data or to object to such processing in line with the Regulation
- Right to data portability: In line with Section 38 of the NDPA we commit to the right of Data Subject to Data Portability and guarantee that Data Subject can receive structured, commonly used, and machine-readable format Personal data and transmit the same to another Data Controller without any hindrance where technically possible.
- Right to withdraw consent: We uphold the right of the Data Subject according to Section 35 of the NDPA to at any time, withdraw consent to the processing of his/her Personal Data. We commit to making it easy for the Data Subject to withdraw consent as they gave the consent also to informed the Data Subject of the right to withdraw consent, prior to the granting of consent.
- Right to complain to the relevant data protection authority(ies): We are accountable to the Nigeria Data Protection Commission hence all our Data Subjects are empowered under 34 of the NDPA to lodge a complaint with the NDPC.
Data Security
In accordance with Section 39 of the NDPA, we commit to implementing appropriate technical and organizational measures to ensure the security, integrity and confidentiality of Personal Data in our possession. We adopt measures such as protection against accidental or unlawful destruction, loss, misuse, alteration, unauthorized disclosure or access.
We uphold our obligation to secure Personal Data: Where data is being transferred to a third party, such transfer will be governed by a contract with the third party spelling out roles in relation to the protection of the Personal Data. We would ensure data security measures such as
-
Access Controls:
- Implement role-based access controls to restrict data access to authorized personnel only.
- Use multi-factor authentication for accessing sensitive data.
-
Encryption:
- Encrypt data at rest and in transit using strong encryption standards.
- Regularly review and update encryption protocols.
-
Data Backup:
- Perform regular backups of critical data.
- Store backups in secure, offsite locations.
- Test backup and recovery processes periodically.
-
Incident Response:
- Establish an incident response plan to handle data breaches and security incidents.
- Notify affected individuals and relevant authorities in the event of a data breach.
Data Processing Activities
-
Data Inventory:
- Maintain an inventory of all data processing activities, including data types, processing purposes, and data retention periods.
-
Third-Party Processors:
- Ensure third-party service providers comply with data protection requirements.
- Include data protection clauses in contracts with third-party processors.
-
Data Protection Impact Assessments (DPIA):
- Conduct DPIAs for high-risk data processing activities to identify and mitigate risks.
Training and Awareness
We commit to the provisioning of regular training and awareness programs to our employees and service providers. We shall provide regular training on data protection and security to all employees. We shall also raise awareness of data protection policies and procedures.
Policy Review and Updates
With regards to our Data Protection Policy, we shall review this policy annually or when there are significant changes in data protection laws or practices. We shall also update the policy as necessary to ensure ongoing compliance.
Responsibilities
-
Data Protection Officer (DPO):
- Oversee data protection strategy and implementation.
- Monitor compliance with data protection laws and policies.
- Serve as the point of contact for data protection inquiries and issues.
-
Employees:
- Follow data protection policies and procedures.
- Report any data breaches or security incidents immediately.
Compliance and Enforcement
We have put in place internal measures to ensure that this policy is adhered to strictly and non-compliance with this policy may result in disciplinary action. All legal and regulatory requirements for data protection will also be enforced.
DPO Contact Information
- Name:
- Babajide Oshifuye
- Office No:
- Mini Room 2
- Email Address:
- info@quadcore.com.ng
- Phone Number:
| 
