Privacy Policy

Lawfulness, Fairness and Transparency

1. We ensure to provide all necessary information required for an individual to understand how their personal data will be collected and used, throughout their engagement with our services, including when a new product or activity is being developed that will involve personal data.
2. We provide notice when we collect personal data directly from an individual at the time of collection.
3. When we collect data from another source, we provide notice within a reasonable period, but no later than a month, after the data was obtained by us. If we intend to communicate with an individual, or disclose data to a third party, then the information is provided no later than the date of that communication or disclosure. Annex 1 outlines the information contained in the Privacy Notice.
4. We ensure that privacy notices are: concise, intelligible, use clear and plain language, which is suitable for the audience; easily accessible; and provided in writing (which can include electronic means), unless the individual asks for the information to be provided orally.
5. If the purposes for processing personal data change, we provide a further privacy notice before the new processing takes place – please contact us if you think that a purpose for which you process personal data is not already covered by the applicable privacy notice, as we take your data serious and want to ensure that we take all reasonable steps to ensure that our data protection policies take your individual needs in consideration.

Justification

We only process personal data where we can meet one of the grounds for processing in the legislation. These include:

1. The individual has given consent to the processing;
2. The processing is necessary to perform a contract with the individual, or to take steps at the request of the individual before entering into a contract;
3. The processing is necessary for compliance with a legal obligation to which we are subject to; or
4. The processing is necessary for legitimate interests or those of a third party, unless the interests of the individual override those interests.

We only process sensitive personal data if it can satisfy one of the additional sensitive data grounds. See the Annexes of this Privacy Policy for further guidance on the relevant grounds for each of our processing activities.

Purpose limitation

We only process personal data for purposes which are legitimate and which we have told the individual about, as part of the Transparency principle and in the Record of Processing. We do not process personal data for any incompatible purpose.

Data minimisation and accuracy

1. We make sure that personal data is adequate and relevant for the purposes for which it is processed and limited to what is necessary for the purpose of processing. We do not collect more personal data than what is needed just because it may turn out to be useful later.
2. We also make sure that personal data is accurate and, where necessary, kept up to date; and takes all reasonable steps to correct or delete inaccurate personal data.

Storage limitation

1. Specific time periods have been determined for how long it is needed to process personal data for a particular purpose and we only keep personal data for these periods. At the end of these periods, we erase the personal data, or ensure that the data doesn’t allow individuals to be identified.
2. Specific details about the retention periods that we have adopted for their different purposes and processing activities are set out in our Data Retention Policy. Some examples are::
   
   a. User Profiles: Retained for the duration of the user’s active account and for 6 years after account deactivation to comply with the statute of limitations for contractual claims.
   
   b. Interaction Logs: Retained for 2 years to support user experience improvements and for audit purposes.
   
   c. Anonymized Data: May be retained indefinitely for research and development purposes, provided it cannot be re-identified.  

Integrity and confidentiality

1. We keep all the personal data we process secure, and protected against ‘unauthorised or unlawful processing and accidental loss, destruction or damage’. We do this by implementing various security measures as listed in our terms and conditions; and also implementing the measures which we impose on our data processors (See “Sharing personal data with third parties and international transfers).
2. We also implement a data breach response programme so that it can log, remediate and report any data breaches as required by law. The process which we have implemented is described in our Data Breach Policy.

Accountability

1. Access: to obtain (i) confirmation whether we process their personal data; (ii) a copy of the personal data (in a commonly-used electronic form, if the request is made electronically); and (iii) provision of supporting explanatory information.
2. Portability: to request that their personal data is “ported” (i.e. transferred) to a specified third party, or to the individual him or herself, in a machine-readable and structured format (e.g. CSV files). There are exemptions – for example, this only applies to personal data which has been provided by the individual or collected automatically from the individual, which is held in digital format, and which we process with the individual’s consent or to fulfil a contract with that individual.
3. Rectification: to request correction of inaccurate personal data.
4. Objection: to object to: (i) processing for direct marketing purposes; (ii) profiling based on direct marketing; and/or (iii) processing based on our legitimate interests.
5. Erasure (a.k.a. the “right to be forgotten”): to request that personal data is erased in certain situations, for example, where: (i) the processing is based on consent and the consent is later withdrawn; or (ii) the individual has validly exercised a right to object and wishes the data to be erased.
6. Restriction: to request that personal data is “restricted” (i.e. block/pause) whilst complaints (for example, about accuracy) are resolved, or if the processing is unlawful but the individual objects to erasure.

Individuals also have rights not to be subject to decisions taken solely on the basis of automated processing of personal data of an individual (i.e. no human involvement in the decision) which produce legal effects, or have similarly significant effects, unless taking such decisions is permitted by law. There are limited exceptions to this. We do not use automated individual decision-making technology.

We use  Natural Language Models that use:

• Understanding User Input: The ability to accurately interpret and respond to user queries in natural language.
• Context Awareness: Maintaining context over multiple interactions to provide coherent and relevant responses.

Human intervention only for monitoring purposes and to improve the process. Assigned responsibilities and access.

Sharing personal data with third parties and international transfers.

1. Other than for accounting and transaction purposes, only employees of Mindbay Technologies Ltd control and process personal data. This is done through the use of cloud computing platforms and natural language models (specifically Azure and Google Analytics) that can only be accessed by authorised Mindbay Technology employees, that adhere to the following policies:
   
   a. Data Ownership and Control: You retain ownership of your data. We process your data only with your agreement and do not share it with advertiser-supported services or mine it for marketing purposes.
   
   b. Data Processing: We process data to provide services, troubleshoot, maintain, and improve its offerings. This includes Customer Data, Personal Data, and Professional Services Data.
   
   c. Data Security: We focus on securing your data both at rest and in transit using state-of-the-art software with encryption methods, that include 256-bit AES encryption for data at rest.
   
   d. Privacy Commitments: We ensure that we use third party software that adheres to strict privacy policies and procedures, including third-party audits and certifications like ISO 27018 and ISO 277012.
   
   Regardless, below is an outline of the process that we would follow incase we need to share personal data with a third party for legitimate interests and/or lawful purposes, for which you will be notified as per this policy and our terms and conditions.
2. When appointing any data processor to collect, store or use personal data on our behalf, we:
   
   a. Before Engagement: Ensure that the data processor provides satisfactory assurances about their data protection practices – We have drafted a Supplier Due Diligence Checklist which must be checked for every data processor contracts; and
   
   b. On Engagement: Sign the data processor up to specified data processing terms – We have drafted template terms which must be entered into with all data processors; and
   
   c. Post Engagement: Confirm on an appropriate periodic basis (as determined by [IT]) that the assurances provided before engagement about their data protection practices remain valid – the Supplier Due Diligence Checklist is also sent out to all data processors on an annual basis.
3. Where we transfer personal data to data processors or data controllers which are based outside the EEA (which includes data processors accessing the personal data from outside the EEA e.g. in order to provide IT support services), a data transfer mechanism is put in place unless that country has been deemed adequate by the European Commission.

Training

We provide training on this Policy and on other data protection-related policies, procedures and obligations to all employees and contractors when they join us, and then on an annual basis.

Audits and monitoring

We audit compliance with this Policy and other data protection-related policies; and will implement appropriate corrective actions to rectify any non-compliance. If you think that this Policy is not being complied with in any way, please bring this to our attention by contacting us at contact@mindbay.ai.

Updates of the policy

Any changes to this policy will be communicated to you based on our terms and conditions, which will also include a brief explanation of the reasons for any notified changes to this Policy.

Publication and final provisions

This Policy and any other amendments to it will be published on this website. Please ensure to review it on a periodic basis to stay up to date with our policies and procedures.

Effective date

This Policy takes effect as of 10 OCT 2024.  

You can raise any questions or concerns in relation to this Policy by contacting: contact@mindbay.ai.
You should also contact us if you think you need an exception to a rule in this Policy.