Personal Data Protection Policy

Purpose

This Policy sets how Tidewell IT protects personal data and respects the rights of the people it concerns, as Regulation (EU) 2016/679 requires.

Scope

This Policy covers all personal data that Tidewell IT processes, whether about staff, applicants, customer contacts, or the users of our customers' systems, and everyone who handles it.

Policy statements

Roles

1. Tidewell IT is controller for the data of its staff and of customer contacts, and processor for customer data that it holds on a customer's behalf.

Principles

1. We follow the seven principles of Article 5: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

Lawful basis and transparency

1. We process personal data only on a lawful basis that is recorded before processing starts, and we tell people in plain language what we do with their data.
2. Consent is used only where no other basis fits, and it can be withdrawn as easily as it was given.

Records of processing

1. The Data Protection Officer keeps the record of processing activities, as controller and as processor, and updates it when a process changes.

Data subject rights

1. Requests are acknowledged within 3 working days and answered within one month.
2. Requests that reach a colleague are forwarded the same day to privacy@tidewell-it.example.

Data protection by design

1. New systems, services, and changes that process personal data are assessed for privacy before they go live. The default settings collect and expose as little data as possible.
2. A data protection impact assessment is carried out when processing is likely to cause a high risk to people.

Processors and transfers

1. A processor is engaged only under a data processing agreement. Personal data stays inside the EEA unless the Data Protection Officer confirms a lawful transfer mechanism.

Breaches

1. The Data Protection Officer assesses a breach within 24 hours of detection.
2. As controller, Tidewell IT notifies the Autoriteit Persoonsgegevens within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights.
3. As processor, it tells the affected customer without undue delay and within 24 hours.

Special categories

1. Special-category data is limited to HR and occupational health data and is accessible only to those who need it for that purpose.

Data Protection Officer

1. The Data Protection Officer is independent, takes no instructions on the advice given, and reports to the Management Board.
2. People can reach the Data Protection Officer at privacy@tidewell-it.example.

Roles and responsibilities

The Data Protection Officer owns this Policy and advises on its use. The Management Board is accountable for compliance. The Service Desk Lead and the HR Lead make sure that requests and staff data are handled as written. Everyone who handles personal data follows this Policy.

Exceptions

An exception needs a written request to the Data Protection Officer that states the reason, the risk, and an end date. No exception can lower a right that the Regulation gives to a person.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. The Data Protection Officer reports on compliance to the Management Board at every management review.

Related documents

• Data Subject Request Handling Procedure
• Personal Data Breach Notification Procedure
• Information Classification and Retention Policy
• Supplier Security Policy
• Incident Response Policy

Review

The Data Protection Officer reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.