Data Protection Policy

Roles

For client campaign data, the client is the controller and Akontec is the processor. Partner delivery centres act as sub-processors under written agreement. For Akontec's own employee, candidate and prospect data, Akontec is the controller.

This distinction governs everything: as a processor, Akontec acts only on the client's documented instructions and does not decide the purpose of processing.

Principles

Collect only what is needed · use it only for the stated purpose · keep it accurate · keep it only as long as required (06_Document_Retention.md) · secure it · be able to demonstrate all of the above.

Handling rules — operational floor

1. Customer data is accessed only through approved systems, only for the assigned task.
2. No customer data on personal devices, personal email, personal cloud storage, or personal messaging.
3. No screenshots or photographs of screens containing customer data. No mobile phones at workstations on data-handling campaigns.
4. No personal storage media. USB ports disabled where the campaign requires it.
5. No shared logins, ever. Every action must be attributable to one identified person.
6. Clean desk at shift end; no paper leaves the floor.
7. Data is transferred only through approved encrypted channels, never as an unprotected email attachment.
8. Access is role-based and least-privilege, reviewed when anyone changes role and revoked the same day on exit.

Recording and consent

Calls are recorded where the campaign requires it, with the notification the law and the client's process require. Recordings are stored per the retention schedule, access-controlled, and released only to the client or a regulator through the authorised route.

Data subject requests

Where a data subject contacts Akontec about client data, we do not answer the request ourselves — we are the processor. The request is logged, forwarded to the client controller without delay, and we assist the client in responding within their statutory timeline. For Akontec's own controller data (employees, candidates), requests go to Finance & Compliance and are answered within the applicable statutory period.

Cross-border transfer

International campaign data is transferred only where the client's agreement and the applicable law permit it, with the required contractual protections in place. Where a client's data may not leave a jurisdiction, that restriction is written into the campaign SOW and enforced at the partner site.

Sub-processors

No partner processes client data without a signed DPA and the client's permission where their contract requires approval of sub-processors. Undisclosed subcontracting is a termination event (18_Vendors/03_Vendor_Agreement_Terms.md) because it breaks the entire chain of accountability.

Breach response

A suspected breach is always P1 regardless of apparent size.

Reporting a suspected breach immediately is mandatory and is never penalised. Concealing one is a terminable offence. The instinct to check whether it is really a breach before telling anyone is exactly what turns a contained incident into a regulatory event.

Training

Every employee completes data protection training at induction and re-certifies periodically. Records are retained and are the first item a client requests after any incident.