The SayPro Data Privacy Policy defines how SayPro collects, uses, manages, and protects personal data in compliance with relevant data protection laws and regulations, including the General Data Protection Regulation (GDPR), the Protection of Personal Information Act (POPIA), and other applicable regional data privacy laws. The policy sets forth SayPro’s commitment to maintaining the privacy and security of individuals’ personal data and outlines the rights of data subjects, the responsibilities of employees and contractors, and the measures in place to ensure that personal data is processed in a lawful, fair, and transparent manner.

The policy applies to all personal data collected by SayPro, whether from employees, customers, business partners, or any other individuals whose data is processed by SayPro.

---

1. Purpose of the Data Privacy Policy

The SayPro Data Privacy Policy has several key objectives:

• Protecting Personal Data: To ensure that personal data is handled responsibly and securely, reducing the risk of unauthorized access, misuse, or data breaches.
• Compliance: To ensure compliance with international and local data privacy laws, such as GDPR, POPIA, and other relevant data protection regulations.
• Transparency: To provide clear, transparent information to individuals about how their personal data is collected, used, and protected by SayPro.
• Empowering Data Subjects: To inform individuals of their rights regarding their personal data and the mechanisms available to exercise those rights.

---

2. Scope of the Policy

This policy applies to all personal data processed by SayPro, including:

• Personal Data: Any information that can identify an individual, either directly or indirectly, such as names, contact details, identification numbers, location data, and online identifiers.
• Sensitive Personal Data: Special categories of personal data, including but not limited to racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, health information, and sexual orientation.
• Business Data: While this policy mainly focuses on personal data, SayPro may also manage business data related to company operations, provided it contains personal data.
• Data from Various Sources: Personal data collected through websites, mobile applications, customer service interactions, contracts, and third-party data processors.

This policy covers both electronic data (e.g., data stored in cloud systems, databases, and servers) and physical records (e.g., paper files) containing personal data.

---

3. Key Principles of Data Privacy

SayPro’s Data Privacy Policy is guided by several core principles, which are derived from leading data privacy regulations such as GDPR. These principles ensure that personal data is processed in a manner that respects individuals’ privacy and aligns with ethical and legal standards.

1. Lawfulness, Fairness, and Transparency

• Personal data must be processed lawfully, fairly, and transparently.
• SayPro will inform individuals about the processing of their personal data through clear privacy notices and communications.

2. Purpose Limitation

• Personal data will only be collected for specific, legitimate purposes and will not be further processed in a manner incompatible with those purposes.
• SayPro will define the purpose for which personal data is being collected and used before processing begins.

3. Data Minimization

• SayPro will only collect personal data that is necessary for the intended purpose and avoid excessive or irrelevant data collection.

4. Accuracy

• Personal data must be accurate and kept up-to-date. Reasonable steps will be taken to correct or delete any inaccurate personal data without delay.

5. Storage Limitation

• Personal data will not be kept longer than necessary for the purposes for which it was collected. Once the data is no longer needed, it will be securely deleted or anonymized.

6. Integrity and Confidentiality

• Personal data will be processed securely using appropriate technical and organizational measures to protect it from unauthorized access, loss, alteration, or destruction.

7. Accountability

• SayPro takes responsibility for the processing of personal data and will ensure that the organization complies with this policy and applicable data privacy laws.

---

4. Roles and Responsibilities

1. Data Protection Officer (DPO)

• The Data Protection Officer (DPO) is responsible for overseeing SayPro’s data privacy strategy and ensuring compliance with this policy and applicable laws.
• Responsibilities:
• Providing guidance on privacy risks and mitigation measures.
• Conducting Data Protection Impact Assessments (DPIAs).
• Managing data subject rights requests.
• Monitoring compliance with the Data Privacy Policy.

2. Data Controllers

• Data Controllers are responsible for determining the purposes and means of processing personal data. In SayPro, data controllers may include departments such as HR, marketing, and customer service.
• Responsibilities:
• Ensuring that personal data is processed in compliance with the policy.
• Coordinating with the DPO to assess data privacy risks.
• Implementing appropriate privacy measures in their departments.

3. Data Processors

• Data Processors are third parties or internal teams that process personal data on behalf of SayPro. These may include external service providers, cloud providers, or software vendors.
• Responsibilities:
• Processing personal data in accordance with SayPro’s instructions and the terms of the Data Processor Agreement.
• Implementing appropriate security and privacy measures to protect the personal data they process.

4. Employees and Contractors

• Employees and Contractors are responsible for complying with the Data Privacy Policy when handling personal data.
• Responsibilities:
• Ensuring that personal data is collected, stored, and processed securely.
• Reporting any suspected data breaches or privacy incidents to the DPO.

---

5. Data Collection and Usage

SayPro collects personal data for specific business purposes, and all data collection activities are designed to be transparent, lawful, and fair. The types of personal data collected may include:

• Personal Identification Information: Name, email address, phone number, address, job title, and similar contact details.
• Financial Information: Credit card details, payment information, billing information.
• Transactional Data: Data related to product purchases, service interactions, or contract agreements.
• Online Activity Data: Data collected through cookies, web analytics, and user behavior tracking (subject to separate consent under cookie policies).
• Employee and HR Data: Personal and professional information related to SayPro’s employees, including employment history, payroll data, and benefits information.

SayPro processes this data for purposes such as:

• Providing services and products to customers.
• Managing internal operations, including HR functions.
• Marketing and communications.
• Legal and regulatory compliance.
• Customer support and feedback collection.

---

6. Data Subject Rights

Under privacy laws like GDPR and POPIA, individuals (data subjects) have specific rights regarding their personal data. SayPro is committed to upholding these rights and provides individuals with the following options:

1. Right to Access

• Data subjects can request access to the personal data SayPro holds about them. SayPro will provide a copy of the data and details about how it is processed.

2. Right to Rectification

• Individuals can request the correction of inaccurate or incomplete personal data held by SayPro.

3. Right to Erasure (Right to be Forgotten)

• Data subjects can request the deletion of their personal data under certain circumstances, such as when it is no longer needed for the purpose for which it was collected.

4. Right to Restrict Processing

• In some cases, individuals can request the restriction of processing their personal data, for example, if the accuracy of the data is contested.

5. Right to Data Portability

• Data subjects can request to receive their personal data in a structured, commonly used, and machine-readable format, and have the option to transfer it to another organization.

6. Right to Object

• Individuals have the right to object to the processing of their personal data, including for marketing purposes. SayPro will comply with such requests unless there is a legitimate reason to continue processing the data.

7. Right to Withdraw Consent

• Where processing is based on consent, individuals can withdraw their consent at any time without affecting the legality of processing before the withdrawal.

---

7. Data Security Measures

SayPro implements various technical and organizational measures to ensure the protection and security of personal data:

• Encryption: Personal data is encrypted during transmission and storage to ensure its confidentiality and integrity.
• Access Controls: Strict access controls ensure that only authorized personnel have access to personal data.
• Data Minimization: SayPro collects and processes only the data necessary for the specific purpose.
• Regular Security Audits: Periodic audits are conducted to assess the effectiveness of SayPro’s data security measures.
• Incident Response: SayPro has a robust data breach response plan to address any security incidents and notify affected individuals when required by law.

---

8. Data Transfers and International Processing

SayPro may transfer personal data outside of the country or region where it was collected. In such cases, SayPro ensures that appropriate safeguards are in place to protect the data, such as:

• Adequacy Decisions: Transfers may occur to countries or regions that the relevant data protection authority considers to offer an adequate level of protection for personal data.
• Standard Contractual Clauses (SCCs): SayPro may use SCCs to govern transfers of personal data to countries that do not have adequate protection in place.

---

9. Data Retention and Disposal

SayPro retains personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and resolve disputes. Once the data is no longer needed, it will be securely deleted or

anonymized to ensure that it cannot be recovered or misused.

---

10. Policy Review and Updates

SayPro’s Data Privacy Policy is reviewed periodically to ensure it remains up to date with changes in laws, regulations, and best practices. Updates to the policy will be communicated to stakeholders, and changes will be clearly documented.

---

Conclusion

The SayPro Data Privacy Policy reflects SayPro’s commitment to safeguarding the personal data of its customers, employees, and other stakeholders. By adhering to the principles outlined in this policy, SayPro ensures that personal data is processed securely, responsibly, and in compliance with applicable data protection laws. Through continuous monitoring, risk management, and proactive transparency, SayPro aims to protect privacy, build trust, and foster long-term relationships with all parties involved.