1. Introduction

Our Company Data Protection Policy refers to our commitment to treat information of employees, customers, stakeholders, partners, and other interested parties with the utmost care and confidentiality. With this policy, we ensure that we gather, store, and handle data fairly, transparently, and with respect towards individual rights. Glyde acknowledges that information technology should be at the service of every citizen and shall not violate human identity, human rights, privacy, or individual or public liberties. The Data Protection Policy ensures the adequate data protection as prescribed by relevant legal frameworks, and the Glyde data protection policy is meant to be a practical and easy-to-understand document to which all Glyde employees, partners, and stakeholders can refer.

2. Scope

This Data Protection Policy applies to all entities of Glyde, including networks and partners in all countries of operation. The policy applies to all Glyde staff and governance members. The provision of this policy may also be applied to any person employed by an entity that carries out missions for Glyde. Glyde’s Data Protection Policy applies to all personal data that Glyde holds, relating to identifiable businesses, meaning any information relating to an identified or identifiable business.

3. Definitions

Before diving into the specific elements of a data protection policy, it is essential to establish clear definitions for key terms and concepts. This will ensure that all stakeholders understand the scope and requirements of the policy. Some important terms to define include:

• Personal Data: Information relating to an identified or identifiable business, a natural person who is or can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural, or social identity. This can include in particular:
  • Names of individuals
  • Postal or living addresses
  • Email addresses
  • Telephone numbers
  • Identity cards and passports
  • Date and place of birth
  • Identification of relatives
  • Fingerprints
  • Business references
  • Geo-referencing
• Processing: Operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, destruction, etc.
• Data Controller: The entity that determines the purposes and means of the processing of personal data, in this case, Glyde.
• Data Processor: The entity that processes personal data on behalf of the data controller.
• Data Subject: The individual whose personal data is being processed, in this case, our customers, and every other person whose personal data we collect.
• Consent: A freely given, specific, informed, and unambiguous indication of the data subject’s agreement to the processing of their personal data.

Glyde’s Data Protection Policy applies to all sets of personal data, currently stored, maintained, and handled by Glyde, and more specifically to the following identified sets of personal data:

• Glyde’s personnel, including national and international staff, interns, and volunteers.
• Glyde’s direct and indirect beneficiaries, including interviewees.
• Glyde’s contractors, vendors, partners, and consultants, currently under contract with Glyde.

Personal data herein referred to, Processing of personal data means any operation or set of operations concerning such data, whatever the mechanism used, especially the obtaining, recording, organisation, retention, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, deletion, or destruction.

4. Policy Elements

As part of our operations, we need to obtain and process information. This information includes any offline or online data that makes a person identifiable such as names, addresses, usernames and passwords, digital footprints, photographs, social security numbers, financial data, etc.

Our company transparently collects this information and only with the full cooperation and knowledge of interested parties. Once this information is available to us, the following rules apply.

Our data will be:

• Accurate and kept up to date.
• Collected fairly and for lawful purposes only.
• Processed by the company within its legal and moral boundaries.
• Protected against any unauthorized or illegal access by internal or external parties.

Our data will not be:

• Communicated informally.
• Stored for more than a specified amount of time.
• Transferred to organizations, states, or countries that do not have adequate data protection policies.
• Distributed to any party other than the ones agreed upon by the data’s owner (exempting legitimate requests from law enforcement authorities).

In addition to ways of handling the data, the company has direct obligations towards people to whom the data belongs. Specifically, we must:

• Let people know which of their data is collected.
• Inform people about how we’ll process their data.
• Inform people about who has access to their information.
• Have provisions in cases of lost, corrupted, or compromised data.
• Allow people to request that we modify, erase, reduce, or correct data contained in our databases.

5. Principles for Processing Data

Glyde shall ensure that it collects and processes personal data in accordance with the NDPR. Personal data will be handled with the greatest care and used only for legitimate and specified business purposes.

The company will be guided by the following principles when handling personal data:

• Lawfulness, Fairness, and Transparency: Personal data must be processed in a lawful, fair, and transparent manner, with clear communication to data subjects about how their data is being used. Collected data shall be adequate, relevant, and not excessive concerning the purposes for which they are obtained and their further processing. Individual data can be processed upon the voluntary consent of the person concerned.
• Purpose Limitation: Personal data should only be collected and processed for specific, explicit, and legitimate purposes. Individual data can be processed upon the voluntary consent of the person concerned.
• Data Minimisation: The collection of personal data should be limited to what is necessary for the intended purpose, and no more.
• Accuracy: Personal data must be accurate and, where necessary, kept up to date.
• Storage Limitation: Personal data should not be stored for longer than necessary for the intended purpose. They will be kept in a form that permits their identification for no longer than is necessary and for the purposes for which the personal data are being processed.
• Integrity and Confidentiality: Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage.
• Accountability: Glyde holds itself accountable to demonstrate compliance with the applicable legal and regulatory requirements and best data privacy standards, including having appropriate policies and procedures in place. Any staff who is entrusted with the personal data of a data subject or who has the personal data of a data subject shall be accountable for their acts and omissions in respect of data processing.

6. Consent Management

The NDPR mandates that consent provided by data subjects must be:

• For a specific and unambiguous purpose.
• In accordance with supporting information provided to the data subject so that they can make an informed decision about whether to provide their consent for the processing.
• Confirmed by positive action; an act of silence, pre-ticked boxes, or inactivity do not apply.
• Able to be withdrawn at any time, in a manner not more complex than it was originally provided.

To effectively manage consent, Glyde shall:

• Ensure that the consent request is prominent, concise, easy to understand, and separate from other terms and conditions.
• Ensure that all consent obtained is voluntary, specific, and informed. The specific purpose of personal data collection will be made known to data subjects.
• Operate an established and effective means of obtaining and managing the specific consent of data subjects (e.g., the addition of a consent clause on all its data collection mediums).
• Obtain the consent of data subjects only in respect of one or more specific data processing activities and ensure that given consent is not applied to other activities for which the data subject’s approval has not been provided.
• Obtain and record the explicit consent required from data subjects for data processing activities which involve their sensitive personal data.
• Retain records to support the granting of consent by data subjects.
• Communicate to data subjects their right to amend or withdraw their consent at any time, the process for doing so, including any reference to statutory or legal obligations that may still apply even after the data subject has withdrawn their consent.
• Act promptly to identify all personal data for which consent for processing has been withdrawn and, unless another valid reason for its processing is communicated to the data subject, ensure that this is no longer processed for the purpose for which consent had been withdrawn.
• Explain to data subjects that the withdrawal of consent does not affect the processing of personal data which had already taken place before the withdrawal.
• Retain records to support the withdrawal of consent by data subjects.