GDPR Policy
How Corefinity handles personal data under the GDPR, and the rights you have over yours.
Introduction
Corefinity is committed to protecting the privacy and security of our clients' data. This GDPR Policy outlines our practices and procedures for handling personal data in compliance with the General Data Protection Regulation (EU) 2016/679.
Scope
This policy applies to all personal data processed by Corefinity and its employees, regardless of the data's format.
Data Protection Principles
Corefinity adheres to the following data protection principles:
- Lawfulness, Fairness, and Transparency: We process personal data lawfully, fairly, and transparently.
- Purpose Limitation: We collect data for specified, explicit, and legitimate purposes.
- Data Minimisation: We ensure personal data is adequate, relevant, and limited to what is necessary.
- Accuracy: We keep personal data accurate and up to date.
- Storage Limitation: We retain personal data no longer than necessary.
- Integrity and Confidentiality: We ensure personal data is processed securely.
Lawful Basis for Processing
Our lawful bases for processing include consent (where individuals have explicitly agreed), contractual necessity (to fulfil our contractual obligations), compliance with legal obligations, protection of vital interests, performance of a task carried out in the public interest, and legitimate interests pursued by Corefinity or a third party.
Rights of Individuals
We recognise and facilitate the rights of data subjects, including access to data, correction, deletion, processing restrictions, data portability, objection to processing, and not being subject to automated decision-making.
Data Security
Corefinity employs robust technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.
Data Breaches
In the event of a data breach, we will promptly assess the risk to individuals' rights and freedoms and report this to the relevant supervisory authority within 72 hours of becoming aware of it, where feasible.
Data Transfers
Any transfer of data outside the EEA is done with appropriate safeguards in place, such as Standard Contractual Clauses or adherence to an adequacy decision by the European Commission.
Third-Party Processors
We engage third-party processors who comply fully with GDPR and ensure they meet our data protection standards.
Training and Awareness
All employees are provided with training on GDPR to ensure they understand their responsibilities towards data protection.
Policy Review and Updates
This policy is reviewed annually and updated as necessary to ensure ongoing compliance with GDPR.
Contact Information
For any enquiries regarding this policy or data protection practices, please contact our Data Protection Officer at dpo@corefinity.com.