1. Purpose and scope
Galaxy Backbone Limited is committed to conducting its business in accordance with all applicable Data Protection laws and regulations and in line with the highest standards of ethical conduct.
This policy sets forth the expected behaviors of The Galaxy Backbone Limited Employees and Third Parties in relation to the collection, use, retention, transfer, disclosure and destruction of any Personally Identifiable Information. Galaxy Backbone, as a Data controller, is responsible for ensuring compliance with the Data Protection requirements outlined in this policy. Non-compliance may expose the company to complaints, regulatory action, fines and/or reputational damage.
This policy applies to all Galaxy Backbone employees, managers and Third Parties who handle, process, control, access document, records, or information technology (IT) systems that contain PII or privacy information.
2. Reference documents
Information Security Policy
Privacy Policy for Personally Identifiable Information (PII)
Acceptable Use of Information Resources Policy
Procedure for Document and Record Control
3. Legal Framework
· Nigeria Data Protection Regulation (NDPR)
· ISO 27001:2013 Standards
· Iso 20000-1:2018 Standards
· PCI DSS Version 3.2.1
4. Policy Requirements
4.1.Governance
4.1.1. Data Stewards
The following are the Data stewards who will administer this policy in their respective areas of Galaxy Backbone operations. They will resolve the responsibility for the data, if any data elements overlap more than one area.
A. Management Team
B. Data Protection Officer
C. Chief Information Security Officer (CISO)
D. Human Resources
E. Legal Services
4.1.2. Data Protection by Design
To ensure that all Data Protection requirements are identified and addressed when designing new systems or processes and/or when reviewing or expanding existing systems or processes, each of them must go through an approval process before continuing. Each Galaxy Backbone Service/Entity must ensure that a Data Protection Impact Assessment (DPIA) is conducted, in cooperation with the Data Stewards, for all new and/or revised systems or processes for which it has responsibility. The subsequent findings of the DPIA must then be submitted to the Management for review and approval. Where applicable, the Technical Services (TS) department, as part of its IT system and application design review process, will cooperate with the Network Security team to assess the impact of any new technology uses on the security of Personal Data.
4.1.3. Compliance Monitoring
To confirm that an adequate level of compliance is being achieved by Galaxy Backbone Limited in relation to this policy, the Internal Audit unit will carry out Data Protection compliance audit from time to time.
Each audit will, as a minimum, assess:
• Compliance with Policy in relation to the protection of Personal Data, including:
• The assignment of responsibilities.
• Raising awareness.
• Training of Employees.
• The effectiveness of Data Protection related operational practices, including:
• Data Subject rights.
• Personal Data transfers.
• Personal Data incident management.
• Personal Data complaints handling.
• The level of understanding of Data Protection policies and Privacy Notices.
• The currency of Data Protection policies and Privacy Notices.
• The accuracy of Personal Data being stored.
4.2. Data Protection Principles
Galaxy Backbone Limited has adopted the following principles to govern its collection, use, retention, transfer, disclosure and destruction of Personal Data:
Principle 1: Lawfulness, Fairness and Transparency
Personal Data shall be processed lawfully, fairly and in a transparent manner in relation to the Data Subject. This means, Galaxy Backbone Limited must tell the Data Subject what processing will occur (transparency), the processing must match the description given to the Data Subject (fairness), and it must be for one of the purposes specified in the applicable Data Protection Regulation (lawfulness).
Principle 2: Purpose Limitation
Personal Data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. This means that Galaxy Backbone Limited must specify exactly what the Personal Data collected will be used for and limit the Processing of that Personal Data to only what is necessary to meet the specified purpose. Galaxy Backbone shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Principle 3: Data Minimization
Personal Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. This means that Galaxy Backbone Limited must not store any Personal Data beyond what is strictly required.
Principle 4: Accuracy
Personal Data shall be accurate and, kept up to date. This means Galaxy Backbone Limited must have in place processes for identifying and addressing out-of-date, incorrect and redundant Personal Data.
Principle 5: Storage Limitation
Personal Data shall be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data is processed. This means that Galaxy backbone Limited must, wherever possible, store Personal Data in a way that limits or prevents identification of the Data Subject.
Principle 6: Integrity & Confidentiality
Personal Data shall be processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorized or unlawful processing, and against accidental loss, destruction or damage. Galaxy Backbone Limited will ensure the use of appropriate technical and organizational measures to ensure the integrity and confidentiality of Personal Data is maintained at all times.
Principle 7: Accountability
The Data Controller shall be responsible for, and be able to demonstrate compliance. This means Galaxy Backbone Limited must demonstrate that the six Data Protection Principles (outlined above) are met for all Personal Data for which it is responsible.
4.3. Data Collection
4.3.1. Data Sources
Personal Data shall be collected only from the Data Subject unless one of the following apply:
• The nature of the business purpose necessitates collection of the Personal Data from other persons or bodies.
• The collection must be carried out under emergency circumstances in order to protect the vital interests of the Data Subject or to prevent serious loss or injury to another person.
4.3.2. Data Subject Consent
No data shall be obtained except the specific purpose of collection is made known to the Data Subject. Galaxy Backbone Limited will obtain Personal Data only by lawful and fair means and, where appropriate with the knowledge and consent of the individual concerned. Where a need exists to request and receive the consent of an individual prior to the collection, use or disclosure of their Personal Data, Galaxy Backbone Limited is committed to seeking such consent. Data Stewards in cooperation with other relevant business representatives, shall establish a system for obtaining and documenting Data Subject Consent for the collection, Processing, and/or transfer of their Personal Data.
4.3.3. Data Subject Notification
Galaxy Backbone Limited will, when required by applicable law, contract, or where it considers that it is reasonably appropriate to do so, provide Data Subjects with information as to the purpose of the processing of their Personal Data. When the Data Subject is asked to give consent to the processing of Personal Data and when any Personal Data is collected from the Data Subject, all appropriate disclosures will be made, in a manner that draws attention to them, unless the Data Subject already has the information or a legal exemption applies to the requirements for disclosure and/or consent.
4.3.4. External Privacy Notices
Each external website provided by Galaxy Backbone Limited will include an online ‘Privacy Notice’ and an online ‘Cookie Notice’ fulfilling the requirements of applicable law.
4.4. Data Use
4.4.1. Data Processing
Galaxy Backbone Limited uses the Personal Data of its contacts for the following broad purposes:
· The general running and business administration of Galaxy Backbone services.
· To provide services to Galaxy Backbone stakeholders.
· The ongoing administration and management of customers’ services.
· To contact the Data Subject in furtherance of previous deliberations at our events or meetings.
· In compliance with statutory requirements including but not limited to financial and official audit.
The use of a contact’s information shall be considered from their perspective and whether the use will be within their expectations or if they are likely to object.
Galaxy Backbone Limited will process Personal Data in accordance with all applicable laws and applicable contractual obligations. More specifically, Galaxy Backbone Limited will not process Personal Data unless at least one of the following requirements are met:
• The Data Subject has given consent to the processing of their Personal Data for one or more specific purposes.
• Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract.
• Processing is necessary for compliance with a legal obligation to which the Data Controller is subject.
• Processing is necessary in order to protect the vital interests of the Data Subject or of another natural person.
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.
4.4.2. Special Categories of Data
Galaxy Backbone Limited will only process sensitive data where the Data Subject expressly consents to such processing or where one of the following conditions apply:
· The processing relates to Personal Data which has already been made public by the Data Subject.
· The processing is necessary for the establishment, exercise or defense of legal claims.
· The processing is specifically authorized or required by law.
· The Processing is necessary to protect the vital interests of the Data Subject or of another natural person where the Data Subject is physically or legally incapable of giving consent.
4.4.3. Data Quality
Galaxy Backbone Limited will adopt all necessary measures to ensure that the Personal Data it collects and processes is complete and accurate in the first instance, and is updated to reflect the current situation of the Data Subject. The measures adopted by Galaxy Backbone Limited to ensure data quality include:
· Correcting Personal Data known to be incorrect, inaccurate, incomplete, ambiguous, misleading or outdated, even if the Data Subject does not request rectification.
· Keeping Personal Data only for the period necessary to satisfy the permitted uses or applicable statutory retention period.
· The removal of Personal Data if in violation of any of the Data Protection principles or if the
· Personal Data is no longer required.
· Restriction, rather than deletion of Personal Data, if the law prohibits erasure.
4.4.4. Digital Marketing
As a general rule, Galaxy Backbone Limited will not send promotional or direct marketing material to a Galaxy Contact through digital channels such as mobile phones, email and the Internet, without first obtaining their consent. Galaxy Backbone Limited shall first obtain prior consent of the Data Subject before carrying out digital marketing using Personal Data and must first be approved for such by Galaxy’s Management. Where Personal Data processing is approved for digital marketing purposes, the Data Subject must be informed at the point of first contact that they have the right to object, at any stage, to having their data processed for such purposes. If the Data Subject puts forward an objection, digital marketing related processing of their Personal Data must cease immediately and their details should be kept on a suppression list with a record of their opt-out decision, rather than being completely deleted.
4.5. Data Retention
To ensure fair processing, Personal Data will not be retained by Galaxy Backbone for longer than necessary in relation to the purposes for which it was originally collected, or for which it was further processed. The length of time for which Galaxy Backbone Limited need to retain Personal Data is set out in the Procedure for Document and Record Control. All Personal Data should be deleted or destroyed as soon as possible where it has been confirmed that there is no longer a need to retain it.
4.6. Data Protection
Galaxy Backbone Limited will adopt physical, environmental, technical, and administrative measures to ensure the security of Personal Data. This includes the prevention of loss or damage, unauthorized alteration, access or processing, and other risks to which it may be exposed by virtue of human action or the physical or natural environment. A summary of the Personal Data related security measures is provided below:
· Prevent unauthorized persons from gaining access to data processing systems in which Personal Data are processed.
· Prevent persons entitled to use a data processing system from accessing Personal Data beyond their needs and authorizations.
· Ensure that Personal Data in the course of electronic transmission during transport cannot be read, copied, modified or removed without authorization.
· Ensure that access logs are in place to establish whether, and by whom, the Personal Data was entered into, modified on or removed from a data processing system.
· Ensure that in the case where processing is carried out by a Data Processor, the data can be processed in accordance with the instructions of the Data Controller.
· Ensure that Personal Data is protected against undesired destruction or loss.
· Ensure that Personal Data collected for different purposes can and is processed separately.
· Ensure that Personal Data is not kept longer than necessary
4.7. Data Subject Requests
Galaxy Backbone Management will establish a system to enable and facilitate the exercise of Data Subject rights related to:
· Information access.
· Objection to processing.
· Restriction of processing.
· Data portability.
· Data rectification.
· Data erasure. If an individual makes a request relating to any of the rights listed above
Galaxy Backbone Limited will consider each of such requests in accordance with all applicable Data Protection laws and regulations.
4.8.Protecting the Rights of Data Subject
Individuals have rights when it comes to our handling of their Personal Data.
Those rights include:
· the right to request for access to their Personal Data where those requests are reasonable and permitted by law or regulation. GBB shall provide reasonable and accessible means for Individuals to submit their requests, which do not have to take any specific form and can be submitted by any method. GBB shall take appropriate measures to provide the requested information in writing, through electronic means or orally, in line with request of the Data Subject, provided that the identity of the Data Subject has been verified. GBB shall provide such information free of charge, except where it has been demonstrated that the requests are unfounded and excessive. In the event of unfounded and excessive request by the Data Subjects, GBB may either charge a reasonable fee for the administrative costs or write a letter to the Data Subject stating refusal act on the request and copy the Relevant Authorities on every such occasion. Where GBB has reasonable doubts concerning individual making the request, GBB may request the provision of additional information necessary to confirm the identity of the Data Subject. Within 30 days of validating the identity of any Individual submitting a request for access to their Personal Data, GBB shall provide the requested information, or provide legitimate reasons for not complying with their request.
· the right to request that GBB erase their Personal Data if it is no longer valid or necessary for the purposes for which it was collected or if it is incomplete or inaccurate. GBB shall delete such Personal Data based on request from the Data Subject and shall take reasonable steps to notify all Third Parties to delete such Personal Data.
· the right to rectify or amend inaccurate or incomplete Personal Data.
· the right to withdraw their Consent at any time.
· the right to object to GBB’s processing of their Personal Data if there are compelling legitimate grounds to do so and to the extent permitted by law or regulation. Individuals have the right to object to GBB’s processing of their Personal Data for direct marketing purposes.
· the right to obtain restriction of GBB’s processing of their Personal Data if one of the following applies: (i) the accuracy of the Personal Data is contested, (ii) the processing is unlawful, (iii) the Controller no longer needs the Personal Data for the purposes of processing, and (iv) the Individual has objected to the processing as set out above.
· the right to receive their Personal Data in a commonly used and machine-readable format and the right to transmit these data to another Data Controller when the processing is based on (explicit) consent or when the processing is necessary for the performance of a contract
4.9. Law Enforcement Requests & Disclosures
In certain circumstances, it is permitted that Personal Data be shared without the knowledge or consent of a Data Subject. This is the case where the disclosure of the Personal Data is necessary for any of the following purposes:
• The prevention or detection of crime.
• The apprehension or prosecution of offenders.
• The assessment or collection of a tax or duty.
• By the order of a court or by any rule of law.
If Galaxy Backbone Limited processes Personal Data for one of these purposes, then it may apply an exception to the processing rules outlined in this policy but only to the extent that not doing so would be likely to prejudice the case in question. If Galaxy Backbone Limited receives a request from a court or any regulatory or law enforcement authority for information relating to the company’s contact, it must be notified to the Legal services department who will provide comprehensive guidance and assistance.
4.10. Data Protection Training
All Galaxy Backbone Limited Employees that have access to Personal Data will have their responsibilities under this policy outlined to them as part of their staff induction training. In addition, each Galaxy Backbone Limited will provide regular Data Protection training and procedural guidance for their staff.
4.11. Third Party Data Processing Contract
Data processing by a third party shall be governed by a written contract between the third party and the Galaxy Backbone Limited. Accordingly, any person engaging a third party to process the data obtained from Data Subjects shall ensure adherence to this policy.
4.12. Data Transfers
Galaxy Backbone Limited may transfer Personal Data to internal or Third Party recipients located in another country where that country is recognized as having an adequate level of legal protection for the rights and freedoms of the relevant Data Subjects. Where transfers need to be made to countries lacking an adequate level of legal protection (i.e. Third Countries), they must be made in compliance with an approved transfer mechanism. Galaxy Backbone Limited may only transfer Personal Data where one of the transfer scenarios list below applies:
· The Data Subject has given consent to the proposed transfer
· The transfer is necessary for the performance of a contract with the Data Subject.
· The transfer is necessary for the implementation of pre-contractual measures taken in response to the Data Subject’s request.
· The transfer is necessary for the conclusion or performance of a contract concluded with a Third Party in the interest of the Data Subject
· The transfer is legally required on important public interest grounds.
· The transfer is necessary for the establishment, exercise or defense of legal claims.
· The transfer is necessary in order to protect the vital interests of the Data Subject
4.12.1. Transfers to Third Parties
Galaxy Backbone Limited will only transfer Personal Data to, or allow access by, Third Parties when it is assured that the information will be processed legitimately and protected appropriately by the recipient.
4.13. Complaints Handling
Data Subjects with a complaint about the processing of their Personal Data, should put forward the matter in writing to the Managing Director, Galaxy Backbone Limited. An investigation of the complaint will be carried out to the extent that is appropriate based on the merits of the specific case.
4.14. Breach Reporting
Any individual who suspects that a Personal Data breach has occurred due to the theft or exposure of Personal Data must immediately notify the company providing a description of what occurred. Notification of the incident can be addressed to the Managing Director, Galaxy Backbone Limited, 61, Adetokunbo Ademola Crescent, Wuse 2, Abuja.
Where Personal Data is involved GBB Personnel should immediately report it through dpo@galaxybackbone.com.ng.
GBB Personnel will not attempt to investigate any suspected/proven breach themselves, nor discuss the case with any third parties, unless they are instructed or authorized to do so by the Legal Department.
GBB shall maintain a Personal Data Breach Register. Any Personal Data Breach will be recorded in the Personal Data Breach Register.
5. Roles & Responsibilities
5.1.Implementation
Management team of Galaxy Backbone Limited shall ensure all Galaxy Backbone employees responsible for the processing of Personal Data are aware of and comply with this policy. In addition, Galaxy Backbone Limited will make sure all Third Parties engaged to process Personal Data on their behalf are aware of and comply with the contents of this policy. Assurance of such compliance must be obtained from all Third Parties, whether companies or individuals, prior to granting them access to Personal Data controlled by Galaxy Backbone Limited.
6. Data Protection Impact Assessment (DPIA)
GBB shall perform periodic DPIAs in order to identify, analyse and mitigate the risks associated with processing Personal Data. These risks include unlawful processing as well as any compromise of the confidentiality, integrity and accuracy of such data.
In addition to the periodic DPIAs, an assessment would be necessary prior to any the following events:
· The introduction of a new processing technology
· Significant changes to business processes and technology solutions that have touchpoints with Personal Data
· Where GBB intends to collect a new type of Personal Data in order to perform business operations.
· Whenever the Relevant Authorities communicate issues a list of processing operations for which a DPIA is required.
· Where Personal Data will be transferred to a Third Party or a foreign country
The Assessment shall cover the following:
· a description of the envisaged processing operations and the purposes of the processing
· an assessment of the necessity and proportionality of the processing operations in relation to the purposes
· an assessment of the risks to the rights and freedoms of data subjects
· Description of measures to mitigate the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data and to demonstrate compliance with this Regulation.
GBB shall consult the Relevant Authority before starting the processing operation, if it appears that the processing will result in a high risk for the rights of individuals and no effective measures are in place to mitigate the risk.
7. Data Privacy Audits
GBB shall engage the services of a Data Protection Compliance Organization (DPCO) on an annual basis to perform an audit of its data privacy and protection practice. The primary objective of this audit is to assess compliance to the Data Protection Regulation and provide attestation of such compliance to the Relevant Authorities and other stakeholders.
· The Data Privacy and Protection Audit report would state the following:
· personally identifiable information that GBB collects on employees of the organization and members of the public
· any purpose for which the personally identifiable information is collected
· any notice given to individuals regarding the collection and use of personal information relating to that individual
· any access given to individuals to review, amend, correct, supplement, or delete personal information relating to that individual
· whether or not consent is obtained from an individual before personally identifiable information is collected, used, transferred, or disclosed and any method used to obtain consent
· the policies and practices of the organization for the security of personally identifiable information
· the policies and practices of the organization for the proper use of personally identifiable information
· organization policies and procedures for privacy and data protection
· the policies and procedures of the organization for monitoring and reporting violations of privacy and data protection policies
· the policies and procedures of the organization for assessing the impact of technologies on the stated privacy and security policies.
The DPO will serve as the primary liaison with the DPCO for the purpose of the audit and will drive the remediation of any exceptions identified from the audit in order to achieve full compliance with regulatory requirements.
8. Contact Us
For any questions, comments or clarifications about this policy, kindly contact our Data Protection Officer (DPO):
By Email: dpo@galaxybackbone.com.ng
By Phone: +234 94 621500 Ext. 80035