GDPR Policy

Policy statement

This General Data Protection Regulation (GDPR) Policy establishes the framework under which AuditProo Solutions Inc. ("AuditProo") collects, uses, stores, discloses, transfers and otherwise processes personal data in connection with the development, provision and support of the AuditProo cloud-based audit management and financial reporting platform.

AuditProo is committed to protecting the rights and freedoms of individuals whose personal data it processes and to meeting applicable data protection obligations. This policy is intended to guide employees, contractors, management and relevant service providers. It should be read together with the AuditProo Privacy Policy, Data Processing Agreement, Information Security Policy and applicable customer agreements.

This policy is a governance document. It does not, by itself, establish that AuditProo is subject to the GDPR in every circumstance or that every control described has already been implemented. Applicability and control implementation must be assessed against AuditProo's actual operations and verified before compliance claims are made.

1. Purpose and scope

The objectives of this policy are to establish requirements for lawful, fair and transparent processing; protect personal data against misuse, loss, unauthorised access or disclosure; define responsibilities for data protection; support the exercise of data subject rights; and provide a framework for managing privacy risks and demonstrating accountability.

This policy applies to personal data processed by or on behalf of AuditProo in connection with its products, services, employees, contractors, suppliers, website, customer relationships, technical support and business operations.

It applies to all employees, contractors, consultants, administrators and third-party service providers who process or can access personal data on behalf of AuditProo.

2. GDPR applicability and territorial scope

The GDPR applies to processing within its territorial scope, including where an organisation is established in the European Union or where an organisation outside the EU offers goods or services to individuals in the EU or monitors their behaviour within the EU, as described in Article 3.

AuditProo shall assess whether the GDPR applies to each relevant processing activity, taking account of its establishment, customer base, users, targeting activities, monitoring and contractual relationships. The fact that AuditProo is established outside the EU does not, by itself, exclude GDPR obligations.

Where the GDPR applies, AuditProo shall comply with the applicable requirements and shall identify any additional national or sector-specific rules that may apply in the relevant EU or EEA jurisdiction.

3. Definitions and roles

For purposes of this policy:

• Personal data means any information relating to an identified or identifiable natural person (data subject).
• Processing means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure or destruction.
• Data subject means the individual to whom personal data relates.
• Controller means the person or organisation that determines the purposes and means of processing personal data.
• Processor means the person or organisation that processes personal data on behalf of a controller.
• Personal data breach means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.

AuditProo's role shall be determined for each processing activity. In many customer engagements, the customer will act as controller and AuditProo will act as processor when hosting or processing audit files and customer records on the customer's instructions. AuditProo may act as an independent controller for its own activities, such as account administration, billing, website enquiries, marketing and employment administration. Roles must be documented rather than assumed.

4. Data protection principles

AuditProo shall process personal data in accordance with the principles in Article 5 of the GDPR:

• Lawfulness, fairness and transparency: process personal data on a valid legal basis, fairly and in a way individuals can understand.
• Purpose limitation: collect personal data for specified, explicit and legitimate purposes and not use it incompatibly with those purposes.
• Data minimisation: ensure personal data is adequate, relevant and limited to what is necessary.
• Accuracy: take reasonable steps to ensure personal data is accurate and kept up to date where necessary.
• Storage limitation: retain personal data in identifiable form only for as long as necessary for the relevant purposes, subject to lawful retention requirements.
• Integrity and confidentiality: use appropriate technical and organisational measures to protect personal data.
• Accountability: be able to demonstrate compliance with the GDPR principles and obligations.

5. Lawful basis for processing

AuditProo shall identify and document an appropriate legal basis under Article 6 before processing personal data as a controller. Depending on the activity, the legal basis may include performance of a contract, compliance with a legal obligation, legitimate interests, consent or another basis permitted by the GDPR.

Where AuditProo relies on legitimate interests, it shall identify the interest, assess necessity and balance that interest against the rights and freedoms of the individuals concerned. The assessment shall be documented.

Where consent is relied upon, consent shall be freely given, specific, informed and unambiguous, expressed through a clear affirmative action and capable of being withdrawn. Withdrawal shall be as easy as giving consent.

Where AuditProo acts as a processor, it shall process customer personal data only on documented instructions from the relevant controller, unless processing is required by applicable law.

6. Special category and criminal offence data

AuditProo shall not intentionally collect or process special category personal data unless the processing is necessary, an applicable Article 9 condition is satisfied and appropriate safeguards are in place. Special category data includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data and data concerning a person's sex life or sexual orientation.

Criminal offence data shall be processed only where permitted under Article 10 and applicable EU or Member State law, with required safeguards.

Customers remain responsible for ensuring that personal data uploaded to AuditProo is lawfully collected and that they have a valid legal basis and any required additional condition for processing.

7. Transparency and privacy information

Where AuditProo acts as a controller, it shall provide individuals with clear and accessible privacy information in accordance with Articles 12 to 14. Information shall explain, as applicable, the controller's identity and contact details, purposes and legal bases, categories of personal data, recipients, international transfers, retention periods, data subject rights, complaint rights, whether data is required by law or contract and relevant automated decision-making.

Where AuditProo acts as a processor, it shall provide reasonable information and assistance to enable the customer-controller to meet its transparency obligations.

Privacy notices shall be reviewed when processing purposes, data categories, recipients, technologies or legal bases materially change.

8. Data subject rights

AuditProo shall maintain procedures to recognise, record, route and respond to data subject requests where it acts as a controller. Rights under the GDPR may include:

• Right of access to personal data and related processing information.
• Right to rectification of inaccurate or incomplete personal data.
• Right to erasure, where the legal conditions are met.
• Right to restriction of processing, where the legal conditions are met.
• Right to data portability, where applicable.
• Right to object to processing based on legitimate interests or public task and to direct marketing.
• Rights relating to decisions based solely on automated processing, including profiling, where those decisions produce legal or similarly significant effects.

Requests shall generally be answered without undue delay and within one month of receipt. This period may be extended by up to two further months where permitted due to the complexity or number of requests, provided the individual is informed within the initial one-month period.

AuditProo shall verify the identity and authority of the requester proportionately before disclosing or changing personal data. Requests shall not be refused solely because they are inconvenient. Any refusal or restriction must be legally justified and explained.

Where AuditProo acts as a processor, it shall promptly refer requests to the relevant controller and provide reasonable assistance, taking account of the nature of processing and information available to AuditProo.

9. Data processing on behalf of customers

Where AuditProo acts as a processor, processing shall be governed by a written data processing agreement or other binding contract meeting Article 28 requirements. The agreement shall address, as applicable:

• The subject matter, duration, nature and purpose of processing.
• The types of personal data and categories of data subjects.
• The controller's rights and obligations and the processor's documented instructions.
• Confidentiality commitments for persons authorised to process personal data.
• Appropriate technical and organisational security measures.
• Conditions for engaging sub-processors and responsibility for their acts and omissions.
• Assistance with data subject requests, security, breach notifications, DPIAs and regulatory consultations.
• Deletion or return of personal data at the end of services, subject to legal retention requirements.
• Information and audit rights needed to demonstrate compliance.

AuditProo shall not appoint a sub-processor to process customer personal data without meeting the authorisation and flow-down requirements in the applicable data processing agreement.

10. Security of processing

AuditProo shall implement technical and organisational measures appropriate to the risk, taking account of the state of the art, implementation costs, nature, scope, context and purposes of processing and the likelihood and severity of risks to individuals.

Measures shall be informed by Article 32 and may include encryption and pseudonymisation, confidentiality, integrity, availability and resilience of systems and services, timely restoration of availability and access following an incident and regular testing and evaluation of security measures.

The AuditProo Information Security Policy provides further detail on access control, encryption, tenant isolation, logging, backups, vulnerability management, secure development, incident response and business continuity. The actual implementation of those controls shall be verified and documented.

11. Data protection by design and by default

AuditProo shall integrate data protection into product design, development, procurement and operational processes, in accordance with Article 25.

• Collect only personal data necessary for each specified purpose.
• Use privacy-protective default settings, including appropriate access restrictions.
• Limit the accessibility of personal data to authorised users and personnel.
• Consider privacy risks when introducing new features, integrations, AI capabilities or data uses.
• Apply pseudonymisation, encryption or other safeguards where appropriate.

Product teams shall consider privacy requirements during feature definition, design reviews, development, testing and release approval.

12. Data protection impact assessments

Before commencing processing likely to result in a high risk to individuals, AuditProo shall support or conduct a Data Protection Impact Assessment (DPIA), as appropriate to its role, in accordance with Article 35.

A DPIA shall describe the processing, assess its necessity and proportionality, identify risks to individuals and set out measures to address those risks.

A DPIA shall be considered for activities such as large-scale processing of special category data, systematic and extensive evaluation of individuals based on automated processing where decisions have significant effects, large-scale monitoring of publicly accessible areas and other processing identified as high risk by applicable supervisory authority guidance.

Where a DPIA identifies a high residual risk that cannot be sufficiently mitigated, prior consultation with the competent supervisory authority shall be considered as required by Article 36.

13. Personal data breach management

AuditProo shall maintain procedures to identify, assess, document, contain and respond to personal data breaches.

All personnel and relevant service providers shall report suspected or actual personal data breaches immediately through the designated incident reporting channel.

Where AuditProo acts as a processor, it shall notify the relevant controller without undue delay after becoming aware of a personal data breach and provide information reasonably available to support the controller's assessment and notification obligations.

Where AuditProo acts as a controller, it shall notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If notification is made after 72 hours, reasons for the delay shall be provided.

Where a breach is likely to result in a high risk to individuals, AuditProo shall communicate the breach to affected individuals without undue delay unless a GDPR exception applies.

All personal data breaches shall be documented, including facts, effects, remedial action and notification decisions, in accordance with Article 33(5).

14. International transfers of personal data

AuditProo shall not transfer personal data outside the European Economic Area where the GDPR applies unless the transfer complies with Chapter V of the GDPR.

Permitted transfer mechanisms may include an applicable European Commission adequacy decision, appropriate safeguards such as Standard Contractual Clauses (SCCs), or a valid derogation under Article 49 where its conditions are met.

Where appropriate safeguards are used, AuditProo shall assess the circumstances of the transfer and whether supplementary measures are necessary. Transfers shall be documented and limited to what is necessary.

The location of hosting, support access, AI processing, backups and sub-processors shall be considered when assessing international transfers.

15. Records of processing activities

AuditProo shall maintain records of processing activities where required by Article 30. Records shall include the relevant controller or processor details, purposes of processing, categories of data subjects and personal data, recipients, international transfers, envisaged erasure time limits where possible and a general description of security measures.

The GDPR's limited exemption for organisations employing fewer than 250 persons is not a blanket exemption. Records remain required where processing is likely to result in a risk, is not occasional or includes special category or criminal offence data.

16. Data retention and deletion

AuditProo shall establish retention periods for personal data based on purpose, contractual requirements, legal obligations and the rights of individuals.

Personal data shall be securely deleted or anonymised when it is no longer necessary for the purpose for which it was collected, unless continued retention is required or permitted by law.

For customer data processed as a processor, deletion or return shall follow the relevant data processing agreement and documented controller instructions. Backup copies shall be removed in accordance with defined backup cycles and secure deletion procedures.

Retention schedules shall identify data categories, purposes, retention periods or criteria and disposal methods.

17. Artificial intelligence and automated processing

Where AuditProo uses AI or automated processing to support audit procedures, financial reporting, document analysis or other platform functions, it shall assess the privacy implications and ensure a lawful basis and appropriate transparency.

• Use personal data for AI processing only for specified and authorised purposes.
• Ensure AI providers and other service providers are subject to appropriate data protection and confidentiality terms.
• Do not permit customer personal data to be used to train general-purpose or third-party models unless a valid legal basis, contractual authority and any required transparency are in place.
• Apply access controls so AI inputs and outputs are available only to authorised users in the relevant customer environment.
• Assess whether AI use involves profiling or solely automated decisions with legal or similarly significant effects and apply Article 22 requirements where relevant.
• Consider data minimisation, pseudonymisation, retention, accuracy and human review appropriate to the use case.

AI functionality shall not be represented as making decisions free from human oversight where meaningful human review is required.

18. Data protection officer and responsible personnel

AuditProo shall assess whether it is required to appoint a Data Protection Officer (DPO) under Article 37. A DPO is required in specified circumstances, including where core activities consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale or processing special category data or criminal offence data on a large scale.

Where a DPO is appointed, the DPO shall be involved properly and in a timely manner in data protection matters, have access to management and the resources necessary to perform the role, operate independently and report to the highest management level. The DPO's contact details shall be published and communicated to the relevant supervisory authority as required.

If a formal DPO appointment is not required, AuditProo shall designate a responsible person or function to coordinate data protection compliance. This designation shall not be described as a statutory DPO unless the applicable requirements are met.

19. Training and confidentiality

Personnel who process personal data shall receive appropriate data protection and security guidance relevant to their roles.

AuditProo shall ensure that persons authorised to process personal data are subject to confidentiality obligations and understand the limits of their access and authority.

Training shall cover data handling, customer confidentiality, phishing and credential security, incident reporting, data subject requests and the safe use of AI and third-party services.

20. Third-party and sub-processor management

Before engaging a third party that processes personal data for AuditProo, the company shall conduct proportionate due diligence on its technical and organisational measures, privacy practices, security, processing locations, sub-processors, incident response and business continuity.

Appropriate written contracts shall be entered into. Where AuditProo is a processor, sub-processor arrangements shall meet Article 28. Where AuditProo is a controller, provider arrangements shall allocate responsibilities and protect personal data appropriately.

Third-party access shall be limited to what is necessary and reviewed periodically.

21. Complaints and regulatory cooperation

Individuals shall be informed of their right to lodge a complaint with a competent supervisory authority where the GDPR applies.

AuditProo shall maintain a process for receiving and investigating privacy complaints and shall cooperate with competent supervisory authorities in accordance with applicable law.

Regulatory enquiries shall be escalated promptly to the designated data protection lead and senior management. Responses shall be accurate, complete and appropriately documented.

22. Policy violations

Failure to comply with this policy may result in access restrictions, mandatory retraining, disciplinary action, contractual remedies or other appropriate measures. Suspected violations shall be escalated and investigated proportionately.

23. Policy ownership, review and approval

AuditProo management is responsible for approving this policy, assigning implementation responsibilities, providing appropriate resources and overseeing periodic review.

The policy shall be reviewed at least annually and whenever material changes occur in the platform, processing activities, customer base, service providers, applicable law or risk environment.