GDPR

Introduction

This Privacy and Data Protection Policy outlines the commitment of AJA Bangladesh Ltd to protecting the privacy and personal data of individuals in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This policy sets out how we collect, use, store, and protect personal data and the rights of individuals regarding their personal data.

Scope

This policy applies to all personal data collected, processed, stored, or transmitted by AJA Bangladesh Ltd in its operations. It applies to all employees, contractors, and third-party service providers who handle personal data on behalf of the company.

Principles of Data Protection:

AJA Bangladesh Ltd is committed to upholding the following principles in relation to personal data:

• Lawfulness, Fairness, and Transparency: We will process personal data lawfully, fairly, and transparently, ensuring that individuals are aware of the purposes and legal basis for processing their data.
• Purpose Limitation: We will collect and process personal data only for specified, explicit, and legitimate purposes and will not further process it in a manner incompatible with those purposes.
• Data Minimization: We will ensure that personal data collected is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
• Accuracy: We will take reasonable steps to ensure that personal data is accurate, kept up to date, and corrected when necessary.
• Storage Limitation: We will retain personal data for no longer than is necessary for the purposes for which it is processed, and in compliance with applicable legal requirements.
• Integrity and Confidentiality: We will implement appropriate technical and organizational measures to ensure the security, integrity, and confidentiality of personal data.
• Accountability: We will demonstrate compliance with data protection laws and regulations and maintain appropriate records of our data processing activities.

Data Collection and Processing

• Lawful Basis: We will collect and process personal data only when there is a lawful basis for doing so, such as with the data subject’s consent, to fulfill a contract, to comply with legal obligations, or based on legitimate interests pursued by the company.
• Consent: When relying on consent as the lawful basis for processing personal data, we will obtain explicit, freely given, and informed consent from individuals. Individuals have the right to withdraw their consent at any time.
• Purpose Specification: We will inform individuals of the purposes for which their personal data is collected and processed and will not use the data for any other incompatible purposes.
• Data Accuracy: We will take reasonable steps to ensure that personal data is accurate, complete, and up to date. Individuals have the right to request the rectification of inaccurate or incomplete data.
• Data Minimization: We will only collect and retain personal data that is necessary and relevant for the purposes for which it is processed. We will avoid collecting excessive or unnecessary personal data.
• Data Retention: Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations.
• Data Security: We will implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. We will regularly review and update our security measures to ensure the ongoing confidentiality, integrity, and availability of personal data.
• Data Transfers: When transferring personal data to countries outside the European Economic Area (EEA), we will ensure appropriate safeguards are in place to protect the data, such as using Standard Contractual Clauses or relying on the recipients’ adequacy status.

Data Subject Rights

• Right to Access: Individuals have the right to access their personal data held by AJA Bangladesh Ltd and receive information about how their data is being processed.
• Right to Rectification: Individuals have the right to request the correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to Be Forgotten): Individuals have the right to request the deletion of their personal data when it is no longer necessary for the purposes for which it was collected, when consent is withdrawn, or when there is no overriding legitimate interest for its retention.
• Right to Restriction of Processing: Individuals have the right to request the restriction of processing of their personal data in certain circumstances, such as when its accuracy is contested or when the processing is unlawful.
• Right to Data Portability: Individuals have the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller.
• Right to Object: Individuals have the right to object, on grounds relating to their particular situation, to the processing of their personal data based on legitimate interests or for direct marketing purposes.
• Automated Decision Making and Profiling: AJA Bangladesh Ltd will not make automated decisions based solely on automated processing, including profiling, that produce significant effects on individuals unless necessary for a contract, authorized by law, or based on explicit consent.

Privacy Notices

We provide clear, transparent, and easily accessible privacy notices to individuals that explain how we collect, use, store, and protect their personal data, their rights in relation to their data, and how to exercise those rights.

Training and Awareness

We provide regular training and awareness programs to employees, contractors, and third-party service providers on data protection and privacy practices to ensure compliance with this policy and relevant data protection laws.

Privacy by Design and Data Protection Impact Assessments

We implement privacy by design principles and conduct Data Protection Impact Assessments (DPIAs) to identify and mitigate privacy risks associated with our data processing activities, particularly when introducing new technologies or engaging in high-risk processing.

Data Breach Response

In the event of a personal data breach, we will promptly assess the breach, take appropriate remedial actions, and notify the relevant supervisory authorities and affected individuals, as required by applicable data protection laws.

Compliance and Accountability

AJA Bangladesh Ltd is committed to ensuring compliance with this Privacy and Data Protection Policy and relevant data protection laws. We will maintain documentation of our data processing activities and conduct periodic audits to assess compliance and identify areas for improvement.

Contact Information

For any questions, concerns, or requests related to privacy and data protection or this policy, individuals can contact the AJA Bangladesh Ltd Data Protection Officer at [hello@aja-bd.com].

Last updated: June 2023