Data Protection Policy

Scope and accountability

Professional Agile Certification — Africa (PACA) is the data controller for the personal data described in this notice.

This policy applies to everyone who processes personal data on PACA's behalf, including board members, staff, reviewers and contractors.

Principles we apply

Personal data held by PACA is:

• •Processed lawfully, fairly and transparently.
• •Collected only for the specified purposes set out in our Privacy Policy.
• •Limited to what is necessary — we do not ask for documents a membership type does not require.
• •Kept accurate and up to date, with a route for members to correct it themselves.
• •Retained no longer than the periods published in our Privacy Policy.
• •Protected by appropriate technical and organisational measures.

Sensitive documents

Membership applications require identity and qualification documents. These are treated as the highest-risk data we hold.

They are stored in private object storage that is never publicly addressable, retrieved only through short-lived signed links, scanned for malware on upload, and visible only to reviewers handling that application.

Access control

Access follows least privilege. Reviewers see only what an application requires. Administrator accounts must use two-factor authentication. Every privileged action — approving an application, publishing a question, granting an additional assessment attempt — is written to an append-only audit log recording who did it, when, and from where.

Data subject requests

Requests for access, correction, deletion or restriction are logged as tracked work items with a statutory deadline recorded at the point of creation, so that overdue requests are visible rather than forgotten in an inbox.

Breach response

Suspected breaches must be reported internally without delay. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Data Protection Commission within 72 hours of becoming aware of it, and notify affected members where the risk is high.