Purpose

This SOP outlines the procedures for handling customer data by Minnovation, an IoT integrator that collects and aggregates data from various sensors and systems. It aims to ensure compliance with data protection laws, maintain data integrity, and safeguard customer privacy.

Scope

This SOP applies to all employees, contractors, and third-party partners of Minnovation who access, process, or handle customer data.

Definitions

– Customer Data: Any information collected from customer IoT devices, sensors, and systems, including but not limited to, personal data, usage data, and technical data.
– Data Processing: Any operation performed on customer data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, and destruction.

Responsibilities

– Data Protection Officer (DPO): Ensures compliance with data protection laws and internal policies.
– IT Department: Implements and maintains technical measures for data security.
– Employees: Comply with this SOP and report any data breaches or inconsistencies.

Procedures

1. Data Collection
  • 1.1. Collect data only for specified, explicit, and legitimate purposes.
  • 1.2. Ensure customers are informed about what data is being collected, how it will be used, and whom it will be shared with.
  • 1.3. Obtain explicit consent from customers before collecting any personal or sensitive data.
2. Data Processing and Storage
  • 2.1. Store data securely using encryption and other appropriate security measures.
  • 2.2. Access to customer data should be restricted to authorized personnel only.
  • 2.3. Regularly update and patch systems to protect against security vulnerabilities.
3. Data Usage
  • 3.1. Use customer data only for the purposes for which it was collected.
  • 3.2. Do not share customer data with third parties without explicit consent, unless required by law.
  • 3.3. Anonymise or pseudonymise data where possible to minimise identification risk.
4. Data Retention and Disposal
  • 4.1. Retain customer data no longer than necessary for the purposes for which it was collected.
  • 4.2. Dispose of data securely when it is no longer needed.
  • 4.3. Maintain a data retention schedule in accordance with legal and regulatory requirements.
5. Data Access and Correction
  • 5.1. Provide customers with access to their data upon request.
  • 5.2. Correct any inaccuracies in customer data promptly upon discovery or request.
6. Data Breach Response
  • 6.1. Report any data breaches to the DPO immediately.
  • 6.2. Follow the data breach response plan, including notifying affected customers and relevant authorities as required by law.
7. Training and Awareness
  • 7.1. Provide regular training to all employees on data protection and privacy.
  • 7.2. Update employees on changes in data protection laws and internal policies.

Compliance

Failure to comply with this SOP may result in disciplinary action, up to and including termination of employment or contract.

Documentation and Records

Maintain records of all data processing activities, including consent forms, data access logs, and training records.

Revision History

Document revisions must be reviewed and approved by the DPO.

This SOP must be reviewed annually or as required by changes in law or company policy. Any amendments must be approved by the DPO and communicated to all relevant parties.