GDPR Policy

1. Introduction

This GDPR Data Management Policy outlines the procedures and principles that our tech company follows when manually managing customer data in response to requests under the General Data Protection Regulation (GDPR). The policy aims to ensure compliance with GDPR requirements and safeguard the privacy and rights of our customers.

2. Scope

This policy applies to all employees and personnel involved in processing customer data when fulfilling GDPR-related requests. These requests may include data access requests, data rectification requests, data deletion requests, or any other requests covered by the GDPR.

3. Data Processing Principles

Our company adheres to the following principles when manually managing customer data:

• Lawfulness, Fairness, and Transparency: All data processing activities are conducted lawfully, fairly, and transparently, ensuring that customers are informed of the processing activities.
• Purpose Limitation: Customer data is only processed for the specific purposes for which the data was collected and in line with the customer's request.
• Data Minimization: Only the minimum necessary customer data required for fulfilling the request is processed.
• Accuracy: Reasonable steps are taken to ensure the accuracy of customer data. Inaccurate or incomplete data will be rectified promptly.
• Storage Limitation: Customer data is retained only for the duration necessary to fulfill the request, as specified in our data retention policy.
• Integrity and Confidentiality: Adequate security measures are in place to protect customer data from unauthorized access, alteration, disclosure, or destruction.

4. Request Handling Procedures

• Data Access Requests: When a customer requests access to their personal data, we will verify their identity to ensure the security of the data. Upon verification, we will provide a copy of the requested data in a commonly used electronic format within the specified time frame under GDPR guidelines.
• Data Rectification Requests: If a customer identifies inaccuracies in their personal data, we will rectify the data promptly and inform the customer once the corrections have been made.
• Data Deletion Requests: Upon receiving a valid request for data deletion, we will permanently delete the customer's data from our records, except where retention is necessary for legal or legitimate business purposes.
• Communication and Transparency: We will communicate with customers promptly, providing clear and transparent information about the actions taken in response to their requests.

5. Training and Awareness

All employees involved in processing customer data will receive training on GDPR compliance and the specific procedures outlined in this policy. Regular awareness programs will be conducted to keep employees informed about changes in data protection laws.

6. Data Protection Officer

Our appointed Data Protection Officer (DPO) is responsible for overseeing the implementation of this policy and ensuring ongoing compliance with GDPR requirements.

7. Review and Update

This policy will be reviewed regularly and updated as necessary to reflect changes in data processing practices, legal requirements, or business operations.

spokenote, Inc.
11671 Lantern Rd #300
Fishers, Indiana 46038
support@spokenote.com