Windmills Property Valuation Services Data Protection Policy

Introduction:
Windmills Property Valuation Services (hereinafter referred to as “the Company”) is committed to protecting the personal data of its clients, employees, and other stakeholders. This Data Protection Policy outlines the Company’s approach to data protection and ensures compliance with ISO 27001, GDPR, and UAE data protection laws and regulations by defining clear security controls for data collection, processing, access, storage, and disposal.

Scope:

This policy applies to all personal data processed by the Company, including but not limited to:
– Client data (e.g. names, addresses, contact details, property information)
– Employee data (e.g. personnel files, payroll information)
– Vendor data (e.g. supplier information, contract details)
– Property data (e.g. property addresses, valuation reports)

Data Protection Principles:

The Company follows the ISO 27001 Annex A controls and GDPR principles:
1. Lawfulness: Personal data will be processed in accordance with applicable laws and regulations.
2. Fairness: Personal data will be processed fairly and transparently.
3. Transparency: The Company will provide clear and concise information about its data processing activities.
4. Purpose Limitation: Personal data will be collected for specified, explicit, and legitimate purposes.
5. Data Minimization: Personal data will be adequate, relevant, and limited to what is necessary for the purposes of processing.
6. Accuracy: Personal data will be accurate and up-to-date.
7. Storage Limitation: Personal data will be kept for no longer than is necessary for the purposes of processing.
8. Security: Personal data will be processed in a manner that ensures its security, using appropriate technical and organizational measures.
9. Accountability: The Company will be responsible for and demonstrate compliance with this Data Protection Policy.

Data Protection Procedures:
Data Collection:
1. Client Data: Client data will be collected through various means, including but not limited to, client onboarding forms, email, and phone.
2. Employee Data: Employee data will be collected through various means, including but not limited to, employee onboarding forms, payroll information, and performance
evaluations.

Data Storage:
1. Physical Records: Physical records will be stored in secure, locked cabinets, with access restricted to authorized personnel.
2. Electronic Records: Electronic records will be stored on secure servers, with access restricted to authorized personnel.

Data Processing:
1. Purpose: Personal data will be processed for the purposes of providing real estate valuation services, managing employee relationships, and complying with regulatory requirements.
2. Lawfulness: Personal data will be processed in accordance with applicable laws and regulations.

Data Sharing:
1. Third-Party Service Providers: The Company may share personal data with third-party service providers, such as IT vendors, auditors, and legal advisors.
2. Regulatory Bodies: The Company may share personal data with regulatory bodies, such as government agencies, in compliance with applicable laws and regulations.

Data Subject Rights:
1. Access: Data subjects have the right to access their personal data.
2. Rectification: Data subjects have the right to rectify inaccurate or incomplete personal data.
3. Erasure: Data subjects have the right to request erasure of their personal data.
4. Restriction: Data subjects have the right to restrict processing of their personal data.
5. Portability: Data subjects have the right to request transfer of their personal data to another organization.

Data Breach:

1. Notification: In the event of a data breach, the Company will notify affected data subjects and regulatory bodies, as required by applicable laws and regulations.
2. Investigation: The Company will investigate the data breach and take remedial action to prevent future breaches.

Training and Awareness:

1. Employee Training: Employees will receive training on data protection policies and procedures.
2. Awareness: The Company will raise awareness about data protection among employees, clients, and vendors.

Monitoring and Review:
1. Monitoring: The Company will monitor its data protection policies and procedures to ensure compliance with applicable laws and regulations.
2. Review: The Company will review its data protection policies and procedures regularly to ensure they remain effective and up-to-date.

Policy Updates:
This Data Protection Policy will be reviewed and updated regularly to ensure it remains compliant with applicable laws and regulations.

Acknowledgement:
By using the Company’s services, clients acknowledge that they have read, understood, and agree to the terms of this Data Protection Policy.

Contact:
For any questions or concerns about this Data Protection Policy, please contact: serviceteam@windmillsgroup.com

Conclusion:
Windmills Real Estate Valuation Services is committed to protecting the personal data of its clients, employees, and other stakeholders. This Data Protection Policy and Procedure outlines the Company’s approach to data protection and ensures compliance with relevant data protection laws and regulations.