PAHAPPA SMC LIMITED
PAHAPPA LIMITED DATA PROTECTION POLICY
Table of Contents
1. Preamble
1.1. Commitment to data protection and privacy
Pahappa Limited, (the “company”, “we”, “us”, or “our”) takes its data protection and information security responsibilities very seriously. The effective management of all personal data, including its security and confidentiality, lies at the heart of our business. This is not only conditioned by Applicable Data Protection Laws, but is also driven by our commitment to our clients and to meet their expectations of having in place robust compliance and risk management practices and protocols.
1.2. Applicable Law
As a Company, we are subject to the varying requirements of Uganda data protection and privacy laws. The “Applicable Law” for the purposes of this Policy is the Data Protection and Privacy Act, 2019, and any other laws pertaining to data privacy as enacted pursuant to the Constitution of Uganda. We recognise that, some laws from outside Uganda may apply to the services offered globally. In such cases, applicable law will include the relevant data protection laws applying to such data collection and processing. In case of a conflict between a provision or requirement of Applicable Laws and a provision of this Policy, the former shall take precedence.
1.3. Responsibility to protect personal data
Pahappa Limited (or the Company) and their personnel have the responsibility to protect and safeguard the confidentiality of all personal data (Personal Information) collected, held or processed by Pahappa Limited. This Policy applies to all employees, consultants and general staff and sets out the Company’s policy in respect of the rights of individuals with respect to their Personal Information and the responsibilities of general staff and the
Company. Each person working for or representing Pahappa Limited is personally responsible for
maintaining the security and confidentiality of Personal Information at Pahappa Limited.
1.4. Personal Information (Data)
Any Personal Information collected, held or processed by Pahappa Limited relating to any individual is subject to the relevant provisions of the Applicable Law as defined in Clause 1(B) above. The provisions set out in this Policy are intended to be the Company’s guidelines and are therefore subject to any Applicable Law provisions that may govern the use of Personal Information Uganda.
2. Principles for Data Collection
2.1. There are eight principles for processing Personal Data as provided for under the Applicable Law. The information must be:
- Fairly and lawfully processed;
- processed for limited purposes and not in any manner incompatible with those purposes; adequate, relevant and not excessive; iv. accurate;
- not kept for longer than necessary;
- processed in accordance with the individual’s rights;
- secure; and not transferred to countries without adequate protection. These principles apply to all Personal Information collected, held or processed by the Company. They cover the Personal Information of general staff and all employees.
3. Application
This Policy applies to Personal Information held in electronic records (for example, on computers, laptops used by personnel for work purposes) or in manual filing systems.
4. Definitions
4.1. Processing is broadly defined and includes: obtaining, recording, holding, using, organizing, altering, retrieving, disclosing, erasing or destroying Personal Information.
4.2. Information or Data includes, without limitation, information stored in a form capable of being processed electronically, or stored as part of a manual filing system (including index cards or filing cabinets, where that system allows Personal Information about a specific individual to be readily identified).
4.3. Personal Information is any personal information or data relating to a living individual and from which that individual is identifiable, including Sensitive Personal Information (where permitted by applicable law). This may include: name, date of birth, address and title, payroll details, financial details, employment or other references about him/her, a description in information from which the individual can be identified, biometric and photographic data, and other biographical information about that individual.
4.4. Sensitive Personal Information, subject to applicable local law, may include, without limitation, any Personal Information relating to a living individual including: racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexuality, criminal proceedings or convictions and physical or mental health.
The above definitions used in this Policy are for guidance and are not exhaustive and are subject to the Data Protection and Privacy Act, 2019 requirements and interpretation at all times.
5. The Rules
Anyone processing Personal Information must comply with the eight principles of good practice set out below. Personal Information must be:
5.1. Fairly and Lawfully Processed
The individual must be informed about who will be processing the Personal Information and why the Personal Information is to be processed, in accordance with Applicable Law requirements. All practicable steps will be taken to ensure that the individual is informed as to whether the supply/collection of the Personal Information (including sensitive Personal Information) is obligatory or voluntary and where the supply of that Personal Information is obligatory for some specified purpose, the individual will be informed of the consequences of failure to supply that Personal Information. In addition, particular care must be taken to ensure that the processing of Personal Information does not breach any copyright laws, duty of confidence or any other provision of the Applicable Law.
5.2. Personal Information
Personal Information will not be considered to be processed fairly unless certain conditions are met and, subject to applicable law requirements and permissions, these conditions may include: the individual has consented to the processing; or the processing is permitted by applicable law, or any exemption contained in applicable law justifies the processing, in circumstances where consent is not required; or the processing is necessary for the legitimate interests and/or performance of a contract with the individual (e.g., payroll or obtaining references); or the processing is necessary to comply with any legal obligation; or the processing is necessary for the purposes of a legitimate interest pursued by the Company (unless it could prejudice the individual’s interests); or the processing is necessary to carry out public functions; or the processing is necessary to protect the vital interests of the individual.
5.3. Sensitive Personal Information
Sensitive Personal Information may be processed if permitted by applicable law, and will not be considered to be processed fairly and lawfully unless processed in compliance with strict conditions of any such applicable law which may include: the individual has given his/her explicit consent; or the processing is permitted by applicable law, or any exemption contained in applicable law justifies the processing, in circumstances where consent is not required; or the processing is necessary for the Company to meet a legal obligation in relation to employment or the processing is necessary to protect the vital interests of the individual; or the processing is necessary for the administration of justice or legal proceedings. The Company collects Personal Information relating to individuals (including general staff, job applicants, clients and third parties) from a variety of sources but mainly from the individuals themselves.
5.4. Processed for Limited Purposes
5.4.1. Personal Information should only be processed for specific and lawful purposes, each of which has been disclosed to the individual; or is obvious in the context in which the Personal Information is collected; or is permitted by applicable law. The Personal Information should not be processed in any manner incompatible with the stated purposes.
5.4.2. Personal Information (including Sensitive Personal Information) relating to employees is collected (including via electronic communications) for several business purposes including, without limitation: for the Company’s administration and management of its business; for compliance with applicable procedures, laws and regulations; for the transfer, storage and processing of Personal Information by the Company (or its agent(s) including any third parties retained by it together with their successors and assigns); the Company’s administration and management of its employees (including without limitation for: taxation and wage administration; medical information for the administration of private medical and other insurance schemes; performance evaluations; contingency planning; business travel; training; career planning; recruitment; provision of references; reimbursement of expenses; disciplinary purposes; compiling personnel profiles, contact lists and directories); and any matters ancillary to the aforesaid.
5.4.3. As a matter of Company practice, all channels through which Personal Information is gathered
(for example, via application forms, the Pahappa Limited or its products’ websites, etc.) will normally contain wording and/or a reference to the Company’s Privacy or Data Protection Policies so that individuals are informed of the intended use of the Personal Information being collected. Any communication will normally contain standard notification wording in the template or footer which directs individuals to the Company’s “Disclaimer” which includes its Privacy Policy. The templates will also ask unintended recipients immediately to delete any communications received in error and copies of such communications should always be retained until it is envisaged that there will be no further contact with the individual concerned.
5.4.4. It is Pahappa Limited’s policy not to share any Personal Information with any non-affiliated third parties unless: Pahappa Limited is so directed by or with the consent of the individual in question; it is necessary in the processing or administration of transactions/cases; it is in connection with providing services; it is related to Pahappa Limited’s operations; or it is permitted by applicable law or any exemption contained in applicable law.
5.4.5. Under no circumstances, unless prior authorization is obtained from the individual, will any Personal Information be disclosed to non-affiliated third parties other than as further described herein.
5.4.6. Personal Information may be shared with other non-affiliated third parties where such third party entity (and/or its successors and assigns) is performing certain services on behalf of Pahappa Limited, pursuant to its direction, or as directed or consented by the individual, such as auditors, technical service providers or other service providers that require the processing of Personal Information, for: the specified purposes as set out in this Policy, as may be permitted or required by law, as provided for by any contractual arrangement, and in connection with Pahappa Limited’s business and its operations (including where disclosure is necessary in order to facilitate the conduct of the specific matter including transactions/cases). In such circumstances, we will inform or notify you in advance of us disclosing your Personal Information to that third party, unless it is not possible to do so or would involve disproportionate effort and which might not be technically or commercially feasible in all the circumstances.
5.4.7. Pahappa Limited may also disclose Personal Information to government, law enforcement or regulatory authorities or as otherwise required or permitted by applicable law and if Pahappa
Limited is contacted by any such authority, Pahappa Limited may be required to provide any requested Personal Information to the extent so required and as provided by law. Any such request received by a partner, counsel, associate or general staff should be referred to the Data Protection Officer and no Personal Information should be disclosed in this way without the consent of the Data Protection Partner.
5.5. Adequate, Relevant and Not Excessive
Personal Information held should be sufficient for the stated purposes but not more than sufficient for those purposes. Periodic audits will be carried out to ensure that no irrelevant or excessive information is held.
5.6. Accurate
5.6.1. Any Personal Information stored must be accurate and up to date. Periodic audits will be conducted to check Personal Information for accuracy and to ensure that out of date material is updated or discarded. The interval for such audits will be determined by reference to the nature of the Personal Information and the purpose for which it is being held or processed, including any legal or regulatory requirements to retain the Personal Information. This should be achieved by regularly reviewing Personal Information held to ensure compliance with applicable legal, operational and regulatory requirements.
5.6.2. Pahappa Limited will send annual reminders to its employees to remind them to update their Personal Information. All individuals should ensure that they notify Pahappa Limited of any material changes to their key Personal Information such as home address, name, emergency contacts, etc.
5.7. Not Kept Longer Than Necessary
5.7.1. Personal Information held by the Company for a specific purpose must not be held for longer than is necessary for that purpose and procedures should be in place to allow selective deletion of information. If during any periodic review, it is discovered that the purposes for which the Personal Information was gathered are no longer necessary purposes, i.e., the Personal Information is no longer in use (or relevant) and there is no legitimate reason for the personal information to be retained, the Personal Information must be destroyed.
5.7.2. All Personal Information should be disposed of at the end of any retention period that is required or permitted by the applicable law, in a manner appropriate to its sensitivity. All backup and archive copies should also be destroyed.
5.8. Processed in Accordance with the Individual’s Rights
5.8.1. Subject to the provisions of applicable law from time to time, individuals may be entitled to exercise certain individual rights provided for under local data protection laws. These may include: a right of access to, correction or deletion of Personal Information. Pahappa Limited recognizes that if individual rights exist and an individual makes a request to exercise such a right it will comply with its legal obligations in that regard. Any general staff wishing to exercise any such right should contact their Line Manager or the
Company’s Human Resources (other individuals should contact the Data Protection Officer).
5.9. Security
5.9.1. Pahappa Limited safeguards data through strict access control, encryption, secure coding, regular backups, employee training, incident response plans, and compliance with data protection laws, ensuring a secure environment for our clients.
5.9.2. Any personnel handling Personal Information are required to maintain, secure and protect the confidentiality of such information and take all necessary precautions to protect Personal Information from any unauthorized use, disclosure or potential loss.
5.9.3. Measures that are undertaken to secure Personal Information include, but are not limited to, the following: access to electronic databases or documents containing Personal Information is only provided to those personnel who have work-related reasons for access; records containing Personal Information are stored in a secure location.
5.9.4. Electronic databases and documents are safeguarded by password protection and/or other access limiting methods. Passwords are changed periodically; when an individual is no longer employed by Pahappa Limited, his/her access to Pahappa Limited’ computer systems will immediately be terminated; all computers are protected with multi-tier antivirus software.
5.9.5. Furthermore, personnel are subject to all restrictions, provisions and covenants contained in any confidentiality, non-solicitation and noncompetition agreement(s) and acknowledgment(s) executed in connection with their employment and any rules and policies implemented by Pahappa Limited. Under no circumstances shall personnel use Personal Information for their own personal use or otherwise outside of their employment with Pahappa Limited.
5.10. Not Transferred to Countries Without Adequate Protection
5.10.1. Pahappa Limited may work with international entities. In order to operate our business, we may need to transfer Personal Information to locations outside Uganda. Personal Information may therefore be controlled and processed by such foreign entities in these circumstances.
5.10.2. Data protection and privacy laws in other jurisdictions may not provide for the same level of protection of your Personal Information as exists in Uganda. Personal Information is not to be transferred outside of Uganda except in compliance with certain safeguards and requirements established by applicable law from time to time.
6. Individual Rights
6.1. An individual may have certain rights with regard to his/her Personal Information conferred by applicable law. These rights may include: rights of access to Personal Information held about him/her; and to have such information either corrected or erased. Subject to its legal obligations in each jurisdiction and to the application of any legal exemptions, Pahappa Limited will comply with any such individual rights. Any counsel, associate or general staff wishing to exercise any such right should contact their Office Manager; directors and other individuals should contact the Data Protection Partner.
6.2. Access Rights
6.2.1. Under applicable law, individuals may be entitled to make a formal request to access certain of their Personal Information which is held by Pahappa Limited. Where applicable law confers such a right on an individual, Pahappa Limited will comply with any such request provided that the individual meets the requirements within the relevant time periods provided. Any such request should be made to the Data Protection Partner who will be able to provide more details about rights of access in the relevant office concerned.
6.2.2. Any such request for access to Personal Information must comply with any applicable legal requirements and should be in writing and accompanied by the following information: reasonable information as to the individual’s identity, any other information required and payment of any fee, that may be permitted by applicable law; the individual’s contact details, and the date and signature; and any other information required to comply with any other access conditions/requirements under applicable law.
6.2.3. Applicable law may provide circumstances and/or categories of Personal Information which may not be or are not required to be disclosed by Pahappa
Limited under such an access request. In such circumstances, Pahappa Limited will comply with its legal obligations and will notify the individual if any information requested cannot be provided. Pahappa Limited will only provide access if permitted by applicable law, including obtaining any relevant consent.