Data Processing & GDPR Policy
Last updated: March 15, 2024
1. Introduction
This Data Processing and GDPR Policy outlines how Abacus ("we", "us", or "our") processes personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This policy applies to all data processing activities conducted by us as both a data controller and data processor.
2. GDPR Compliance
We adhere to the following GDPR principles:
- Lawfulness, fairness, and transparency
- Purpose limitation
- Data minimization
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
3. Data Processing Activities
3.1 Types of Data Processed
We may process the following types of personal data:
- Identity and contact information
- Professional and employment information
- Technical and usage data
- Customer service and communication data
3.2 Processing Purposes
We process personal data for the following purposes:
- Providing and maintaining our services
- Managing customer relationships
- Ensuring security and compliance
- Improving and optimizing our services
- Meeting legal and regulatory obligations
4. Data Protection Measures
4.1 Technical Measures
- End-to-end encryption for data in transit and at rest
- Access control and authentication systems
- Regular security assessments and penetration testing
- Continuous monitoring and threat detection
4.2 Organizational Measures
- Staff training on data protection
- Data protection impact assessments
- Incident response procedures
- Regular compliance audits
5. Data Subject Rights
Under GDPR, data subjects have the following rights:
- Right to access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
- Rights related to automated decision-making
6. International Data Transfers
When transferring personal data outside the EEA, we ensure appropriate safeguards are in place through:
- Standard contractual clauses
- Binding corporate rules
- Adequacy decisions
- Data processing agreements
7. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. We have established data retention schedules and secure deletion procedures.
8. Data Breach Procedures
In the event of a personal data breach, we will:
- Notify relevant supervisory authorities within 72 hours
- Inform affected data subjects without undue delay
- Document all breaches and remedial actions
- Implement measures to prevent future breaches
9. Data Protection Officer
Our Data Protection Officer can be contacted at: dpo@goabacus.co
10. Updates to This Policy
We regularly review and update this policy to reflect changes in our practices and legal requirements. We will notify data subjects of any material changes.
11. Contact Us
For questions about this policy or to exercise your data protection rights, please contact us at privacy@goabacus.co.
