Internal Data Processing Policy

1. Policy Objective

To ensure personal data is handled lawfully, fairly, securely, and consistently with Uganda’s Data Protection and Privacy framework and international best practices for technology enterprises.

2. Roles

• Data Controller: REAGAN INDUSTRIES SMC LIMITED.
• Data Protection Officer (DPO): Appointed by the Governing Director (Interim: Founder).
• Data Handlers: All employees and contractors authorized to access processing environments.

3. Core Principles (Mandatory)

All data processing follows these non-negotiable principles:

• Accountability: Demonstrable compliance with the Law.
• Lawful & Fair Processing: Data is obtained by legal means.
• Data Minimization: We collect only what is strictly necessary.
• Retention Limits: We do not keep data longer than required.
• Transparency: Data subjects know why their data is being processed.
• Security Safeguards: Application of industry-leading technical and organizational measures.

4. Collection Standards

• Collect personal data directly from the data subject whenever possible.
• Ensure all collection methods are non-intrusive and respect the subject's privacy.
• Verify the accuracy of data at the point of entry.

5. Security Measures & Processor Controls

Handlers establish and comply with:

• Strict access controls based on the principle of least privilege.
• Mandatory Multi-Factor Authentication (MFA) for all administrative/admin accounts.
• Encryption of data in transit and at rest.
• Encrypted, geographically distributed backups and secure key management.
• Continuous logging and monitoring of access to sensitive datasets.

6. Breach Response & Notification

If personal data is accessed or acquired by an unauthorized person, the Company notifies the Personal Data Protection Office (PDPO) immediately and initiates the documented incident response protocol to mitigate potential harm.

7. Registration with PDPO

Reagan Industries maintains active registration with the Personal Data Protection Office (PDPO) of Uganda and submits annual compliance reports as required by the Data Protection and Privacy Act.

8. Data Retention & Disposal

We dispose of personal data securely using industry-standard destruction methods (cryptographic erasure or physical destruction) when the retention period expires or the purpose for processing is concluded.

9. Cross-Border Transfers

Data is not moved outside of Uganda unless verified safeguards are in place and the transfer complies with documented PDPO conditions and undertakings.

10. Enforcement

Violations of this policy trigger disciplinary action, immediate termination of contracts, and legal reporting obligations to the relevant authorities.

11. Legal Inquiries

For legal inquiries regarding this policy, contact:
legal@reagantechindustries.com