DATA PROTECTION POLICY
Business List South Sudan.
Effective Date: 9th September 2026
Last Updated: 9th September 2026
1. Introduction
This Data Protection Policy establishes the principles and procedures used by Summit Works Africa Ltd to protect personal information processed through Business List South Sudan
The Company recognizes the importance of protecting personal information and is committed to responsible data management.
This Policy applies to employees, contractors, service providers and other persons who process personal information on behalf of the Company.
2. Objectives
The objectives of this Policy are to:
- Protect personal information;
- Promote responsible data processing;
- Reduce privacy and cybersecurity risks;
- Establish accountability for data handling;
- Protect users and businesses using the Platform;
- Support compliance with applicable data protection requirements; and
- Establish procedures for responding to data incidents.
3. Data Protection Principles
The Company shall seek to ensure that personal information is:
- Lawfully Processed: Personal information shall be collected and processed for legitimate and lawful purposes.
- Fairly Processed: Information shall be handled fairly and transparently.
- Purpose Limited: Personal information shall be collected for specific and legitimate purposes and not used for unrelated purposes without an appropriate legal basis.
- Data Minimized: Only information reasonably necessary for the intended purpose should be collected.
- Accurate: Reasonable steps shall be taken to maintain accurate and current information.
- Secure: Appropriate technical and organizational safeguards shall be implemented.
- Retained Appropriately: Personal information should not be retained longer than reasonably necessary.
Accountable: The Company shall maintain appropriate procedures demonstrating responsible data protection practices.
4. Categories of Data
The Platform may process:
- Identity information;
- Contact information;
- Business information;
- Account information;
- Transaction information;
- Technical information;
- Communication records;
- Location-related information;
- Website usage information; and
- Other information necessary to provide Platform services.
The Company shall exercise additional caution when handling sensitive or high-risk personal information.
5. Collection of Information
Personal information should normally be collected directly from the individual.
Where information is obtained from another source, the Company shall assess whether the collection and use of that information is lawful and appropriate.
6. Consent
Where consent is required, the Company shall seek consent through a clear and understandable process.
Consent records should be maintained where appropriate.
Individuals should be able to withdraw consent where legally applicable.
7. Access Controls
Access to personal information shall be restricted according to job responsibilities.
Employees and contractors should only access information necessary to perform their duties.
Administrative access shall be controlled and monitored.
8. Password and Authentication Security
Users and personnel shall be encouraged or required to use:
- Strong passwords;
- Multi-factor authentication where available;
- Secure authentication mechanisms; and
- Appropriate password management practices.
- Passwords must not be stored in plain text.
9. Data Encryption
Appropriate encryption should be used to protect information:
- During transmission;
- During storage where appropriate; and
- During backups where appropriate.
10. Data Storage
Personal information shall be stored using systems with reasonable security controls.
The Company shall take reasonable measures to prevent unauthorized access, modification, disclosure or destruction.
11. Third-Party Service Providers
Third parties that process personal information on behalf of the Company should be appropriately assessed before engagement.
Where appropriate, contracts should establish requirements concerning:
- Confidentiality;
- Security;
- Data use;
- Data retention;
- Incident reporting;
- Access controls; and
- Data deletion or return.
12. Data Sharing
Personal information shall only be shared where there is an appropriate legal, contractual or operational basis.
Employees must not disclose personal information to unauthorized persons.
13. Public Business Listings
Businesses may voluntarily publish information intended for public discovery.
Before publishing personal information within a business listing, the business owner or authorized representative should ensure that appropriate authorization exists.
The Platform may remove information that creates an unreasonable privacy, safety or security risk.
14. Data Subject Requests
The Company shall establish procedures for responding to requests relating to personal information.
Requests may include:
- Access;
- Correction;
- Deletion;
- Objection;
- Restriction;
- Withdrawal of consent; and
- Other rights provided by applicable law.
Requests should be reviewed and responded to within applicable legal timeframes.
15. Data Breach Management
A personal data breach may include:
- Unauthorized access;
- Unauthorized disclosure;
- Accidental deletion;
- Loss of equipment containing personal information;
- Cyberattacks;
- Malware or ransomware incidents;
- Compromised accounts; or
- Accidental publication of personal information.
Employees must report suspected breaches immediately to the designated data protection or security contact.
The Company shall:
- Identify and contain the incident;
- Assess the nature and scope of the breach;
- Determine affected information and individuals;
- Take measures to reduce potential harm;
- Preserve relevant evidence;
- Notify relevant authorities where legally required;
- Notify affected individuals where legally required or appropriate;
- Document the incident; and
- Implement measures to prevent recurrence.
16. Data Retention and Disposal
The Company shall establish retention periods appropriate to different categories of information.
When information is no longer required, it should be:
- Securely deleted;
- Destroyed; or
- Anonymized where appropriate.
17. Employee Responsibilities
Employees and contractors who handle personal information must:
- Keep information confidential;
- Follow security procedures;
- Use information only for authorized purposes;
- Avoid unauthorized copying;
- Report security incidents;
- Protect login credentials; and
- Complete required privacy and security training.
18. Data Protection by Design
Privacy and security considerations should be incorporated into new Platform features and systems from the design stage.
Examples include:
- Collecting only necessary information;
- Implementing appropriate access controls;
- Minimizing public exposure of personal information;
- Providing privacy settings;
- Using secure authentication; and
- Designing appropriate deletion mechanisms.
19. Privacy Impact Assessments
Where a proposed activity is likely to create significant privacy risks, the Company may conduct a Data Protection or Privacy Impact Assessment before implementation.
Examples may include:
- Large-scale personal information processing;
- New identity verification systems;
- Extensive location tracking;
- Automated profiling;
- Significant data sharing; or
- New technologies involving sensitive information.
20. Data Protection Officer / Responsible Person
The Company shall designate an appropriate person or function responsible for coordinating data protection matters.
Data Protection Contact:
Email: legal@summitworks.africa
21. Training and Awareness
Personnel handling personal information should receive appropriate privacy and information-security awareness training.
Training should cover:
- Data protection principles;
- Password security;
- Phishing;
- Social engineering;
- Data handling;
- Incident reporting;
- Confidentiality; and
- Secure use of company systems.
22. Auditing and Review
The Company may periodically review its data protection controls to identify weaknesses and improve compliance.
This Policy should be reviewed periodically and whenever significant changes occur to:
- Applicable laws;
- Platform architecture;
- Data processing activities;
- Security threats; or
- Business operations.
23. Compliance
The Company shall seek to comply with applicable data protection, cybersecurity, electronic communications and other relevant laws and regulatory requirements applicable to its operations.
Where there is a conflict between this Policy and applicable law, the applicable legal requirement shall prevail.
24. Contact
Questions concerning this Data Protection Policy should be directed to:
Summit Works Africa Ltd
Plot No. 496 Block No. 3K-South.
2nd Class Residential Area, Tongping,
Juba, South Sudan.
Email: legal@summitworks.africa
End of Data Protection Policy