This Document is aligned with the General Data Protection Regulation (EU) 2016/679
Introduction
Kartoza is committed to ensuring the privacy and protection of personal data in accordance with the General Data Protection Regulation (GDPR). This policy outlines our approach to data protection and privacy, including the rights of data subjects, the responsibilities of data handlers and the processes we implement to maintain GDPR compliance.See also the related ‘Kartoza POPIA policy’ document that covers Kartoza’s compliance with the South Africa Protection of Personal Information Act.
Principles of Data Protection
- Lawfulness, Fairness and Transparency: Personal data shall be processed lawfully, fairly and in a transparent manner.
- Purpose Limitation : Data is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Data Minimisation: We collect only the personal data that is necessary for the intended purpose.
- Accuracy: We take steps to ensure personal data is accurate and up to date.
- Storage Limitation : Personal data is kept for no longer than necessary.
- Integrity and Confidentiality: Data is processed securely to protect against unauthorised or unlawful processing, accidental loss or damage.
- Accountability: Kartoza takes responsibility for demonstrating compliance with these principles.
Rights of Data Subjects
Kartoza ensures the rights of individuals are upheld, including:
- The right to access their personal data.
- The right to rectify inaccurate data.
- The right to erasure (‘right to be forgotten’).
- The right to restrict processing.
- The right to data portability.
- The right to object to processing.
- Rights in relation to automated decision-making and profiling.
Lawful Basis for Processing
Kartoza processes personal data only when a lawful basis applies, such as:
- The data subject has given consent.
- Processing is necessary for the performance of a contract.
- Processing is required to comply with a legal obligation.
- It is necessary to protect vital interests.
- It is carried out in the public interest or under official authority.
- It is necessary for legitimate interests pursued by Kartoza or a third party.
Data Security and Breach Response
We implement appropriate technical and organisational measures to protect personal data. In the event of a data breach, Kartoza will assess the risk to data subjects and, if necessary, notify the supervisory authority within 72 hours, as well as affected individuals where applicable.
Data Processing Agreements
Kartoza ensures that data processing agreements are in place with all third-party processors, defining clear roles and responsibilities to ensure GDPR compliance.
Training and Awareness
All Kartoza employees and contractors receive regular training on data protection principles and practices. Awareness campaigns are run to ensure GDPR compliance remains a shared responsibility.
Data Protection Officer (DPO)
Kartoza has a Data Protection Officer to oversee GDPR compliance, advise on obligations, monitor activities and act as a point of contact with supervisory authorities.
Review and Continuous Improvement
This GDPR Compliance Policy is reviewed regularly to reflect changes in legal requirements, business operations and industry best practices. Continuous improvement is central to our approach to data protection.