Data Protection Policy

I. Aim of the Data Protection Policy

YANGA COLLECTIVE SHOP ITEMZ is committed to international compliance with data protection laws. This Data Protection Policy applies worldwide to YANGA COLLECTIVE SHOP ITEMZ, and it is based on globally accepted, basic principles of data protection.

• Ensuring data protection is the foundation of trustworthy business relationships and the reputation of YANGA COLLECTIVE SHOP ITEMZ as an attractive employer.

• The Policy ensures the adequate level of data protection prescribed by Nigerian data protection laws.

---

II. Scope and Amendment of the Data Protection Policy

This Policy applies to YANGA COLLECTIVE SHOP ITEMZ and its employees. The Policy extends to all processing of personal data.

• Anonymised data, e.g., for statistical evaluations or studies, is not subject to this Policy.

• This Policy can be amended in coordination with the Data Protection Officer and the Chief Executive Officer under the defined procedure for amending policies. Amendments will be reported immediately using the process for amending policies.

---

III. Application of National Laws

This Data Protection Policy comprises the internationally accepted data protection principles without replacing the existing national laws; it supplements them.

• The relevant national law will take precedence if it conflicts with this Policy or has stricter requirements.

• The content of this Policy must also be observed in the absence of corresponding national legislation.

• The reporting requirements for data processing under national laws must be observed.

• YANGA COLLECTIVE SHOP ITEMZ is responsible for compliance. If legal obligations contradict duties under this Policy, the Data Protection Officer (DPO) should be informed. In the event of conflicts, YANGA COLLECTIVE SHOP ITEMZ will work to find a practical solution that meets the Policy’s purpose.

---

IV. Principles for Processing Personal Data

a. Fairness and Lawfulness

When processing personal data, the individual rights of the data subjects must be protected. Personal data must be collected and processed legally and fairly.

b. Purpose Limitation

Personal data can be processed only for the purpose that was defined before the data was collected. Subsequent changes to the purpose are only possible to a limited extent and require substantiation.

c. Transparency

The data subject must be informed of how their data is being handled. When the data is collected, the data subject must either be aware of or informed of:

• The identity of the Data Controller.

• The purpose of data processing.

• Third parties or categories of third parties to whom the data might be transmitted.

d. Data Minimisation

Before processing, you must determine whether and to what extent the processing of personal data is necessary to achieve the intended purpose.

• Where the purpose allows, anonymized or statistical data must be used.

• Personal data may not be collected in advance and stored for potential future purposes unless required or permitted by national law.

e. Storage Limitation

Personal data should only be stored for as long as they are needed. Data that is no longer needed after the expiration of legal or business process-related periods must be deleted.

• Exceptions exist for data that merit protection or historical significance, in which case the data must remain on file until interests have been clarified.

f. Accuracy

Personal data on file must be correct, complete, and kept up to date. Appropriate measures must be in place to ensure that inaccurate or incomplete data are deleted, corrected, supplemented, or updated.

g. Confidentiality and Integrity of Data

Personal data must be secured with appropriate organisational and technical measures to prevent unauthorised access, illegal processing, or sharing, as well as accidental loss, modification, or destruction.

h. Lawfulness

Processing of personal data is permitted only when there is a legal basis. This is also required if the purpose of collecting, processing, and using the personal data is to be changed from the original purpose.

---

V. Legal Bases and Reliability of Data Processing

Collecting, processing, and using personal data is permitted only under the following legal bases. One of these legal bases is also required if the purpose of data processing is changed.

1. Customer and Partner Data

1.1. Data processing for a contractual relationship

Personal data of relevant prospects, customers, and partners can be processed to establish, execute, and terminate a contract.

• This includes processing data before a contract (contract initiation phase) to prepare bids, purchase orders, or fulfil other prospect requests.

1.2. Data processing for advertising purposes

Data processing is permitted to meet a request for information (e.g., request for information material).

• Personal data can be processed for advertising purposes or market and opinion research if consistent with the original purpose.

• The data subject must be informed and consent shall be obtained for advertising use, which must be voluntary.

• If the data subject refuses the use of data for advertising purposes, it can no longer be used and must be blocked from these uses.

1.3. Consent to data processing

Data can be processed if the consent of the data subject is validly obtained.

• The data subject must be informed before giving consent.

• The declaration of consent must be obtained in writing or electronically for documentation, or verbally and documented in certain circumstances.

1.4. Legal obligation

The processing is permitted if national legislation requests, requires, or allows this. The type and extent of data processing must be necessary for the legally authorised activity.

1.5. Performance of contract

Personal data can be processed to fulfil the performance of a contract between YANGA COLLECTIVE SHOP ITEMZ and a customer or partner.

• Such a contract must contain a data processing clause or be accompanied by a Data Processing Agreement (DPA). Existing contracts should have an addendum.

1.6. Legitimate interest

Personal data can also be processed if it is necessary for a legitimate interest of YANGA COLLECTIVE SHOP ITEMZ (e.g., collection of outstanding receivables, avoiding breaches of contract).

• Data may not be processed if the interests of the data subject merit protection and take precedence.

• Before relying on legitimate interest, YANGA COLLECTIVE SHOP ITEMZ must conduct and document a Legitimate Impact Assessment (LIA).

1.7. Processing of highly sensitive data

Sensitive personal data can be processed only if the law requires this or the data subject has given express consent.

• It is also permitted if mandatory for asserting, exercising, or defending legal claims.

• The Data Protection Officer must be informed in advance of plans to process sensitive data.

1.8. Automated individual decisions

Automated processing used to evaluate certain aspects (e.g., creditworthiness) cannot be the sole basis for decisions that have adverse legal consequences or could significantly impair the data subject.

• The data subject must be informed and given the possibility to respond.

• To avoid erroneous decisions, a test and plausibility check must be made by an employee.

1.9. User data and internet

If personal data is processed on websites or in apps, data subjects must be informed via a privacy notice and, if applicable, a cookie information notice.

• The notices must be easy to identify, directly accessible, and consistently available.

• If user profiles (tracking) are created, the data subjects must be informed. Personal tracking requires lawfulness or consent.

• If tracking uses a pseudonym, the data subject should be given a chance to opt-out in the privacy notice.

2. Employee Data

2.1. Data processing for the employment relationship

Personal data can be processed if needed to initiate, carry out, and terminate the employment agreement.

• If an applicant is rejected, their data must be deleted, unless they consent to remain on file.

• During the existing employment relationship, data processing must relate to the purpose of the employment agreement.

• If collecting information on an applicant from a third party, national laws must be observed, and consent should be obtained in cases of doubt.

2.2. Legal Obligation

The processing is permitted if national legislation requests, requires, or authorises this. If there is legal flexibility, the interests of the employee that merit protection must be taken into consideration.

2.3. Collective agreements on data processing

Data processing that exceeds contract fulfillment may be permissible if authorised through a collective agreement (e.g., pay scale agreements or agreements with employee representatives).

• The agreements must cover the specific purpose and comply with national data protection legislation.

2.4. Consent to data processing

Employee data can be processed upon the consent of the person concerned.

• Consent must be submitted voluntarily (involuntary consent is void) and documented (in writing, electronically, or verbally).

2.5. Legitimate Interest

Processing is permitted if necessary to enforce a legitimate interest of YANGA COLLECTIVE SHOP ITEMZ (e.g., filing, enforcing, or defending against legal claims).

• Processing may not occur if the interests of the employee merit protection and take precedence.

• Control measures that require processing employee data can be taken only if there is a legal obligation or a legitimate reason, and the proportionality must be examined and documented.

2.6. Processing of sensitive data

Sensitive personal data can be processed only under certain conditions:

• The processing must be expressly permitted or prescribed under national law.

• It is permitted if the responsible authority must fulfil its rights and duties in the area of employment law.

• The employee can also expressly consent to the processing.

• The Data Protection Officer must be informed in advance.

2.7. Automated decisions

Automated processing that evaluates specific personal details (e.g., personnel selection) cannot be the sole basis for decisions that would have negative consequences for the employee.

• A natural person must evaluate the content of the situation, and this evaluation must be the basis for the decision.

2.8. Telecommunications and internet

Telephone equipment, email, intranet, and the internet are provided primarily for work-related assignments and are company resources.

• There will be no general monitoring of communications.

• For security reasons, use can be logged for a temporary period.

• Evaluations of this data from a specific person can be made only in a concrete, justified case of suspected violations of laws or policies, conducted only by investigating departments while ensuring proportionality.

---

VI. Transmission of Personal Data

Transmission of personal data to recipients outside or inside YANGA COLLECTIVE SHOP ITEMZ is subject to the authorisation requirements under Section V. The recipient must use the data only for the defined purposes.

• Third Countries: If data is transmitted to a recipient outside YANGA COLLECTIVE SHOP ITEMZ to a third country, that country must maintain a data protection level equivalent to this Policy, unless the transmission is based on a legal obligation.

• Liability: In the case of personal data being transmitted from YANGA COLLECTIVE SHOP ITEMZ to an entity in a third country, the data controller transmitting the data shall be held liable for any violations committed by the entity in the third country concerning the data subject whose data was collected in Nigeria.

---

VII. Contract Data Processing

When a provider is hired to process personal data without being assigned responsibility for the business process (Data Processing on behalf), an agreement on Data Processing on behalf must be concluded. The client retains full responsibility.

The following requirements must be complied with:

• The provider must be chosen based on its ability to cover the required technical and organisational protective measures.

• The order must be placed in writing.

• The contractual standards for data protection provided by the DPO must be considered.

• Compliance must be verified before data processing begins and repeated regularly during the term.

• Cross-border processing requires meeting relevant national requirements.

---

VIII. Rights of the Data Subject

Every data subject has the following rights. Their assertion is to be handled immediately by the responsible unit and cannot pose any disadvantage:

• Right to Information: May request information on which personal data has been stored, how it was collected, and for what purpose.

• Information on Recipients: If data is transmitted to third parties, information must be given about the identity or categories of recipients.

• Correction and Supplementation: Can demand that incorrect or incomplete data be corrected or supplemented.

• Objection to Specific Use: Can object to the processing of data for purposes of advertising or market/opinion research, and the data must be blocked.

• Deletion: May request data to be deleted if the processing has no legal basis, or if the legal basis or purpose has ceased to apply. Existing retention periods must be observed.

• General Objection: Generally has a right to object to processing if the protection of their interests takes precedence over the data controller’s interest due to a particular personal situation.

(Refer to procedure on data subject rights)

---

IX. Confidentiality of Processing

Any unauthorised collection, processing, or use of such data by employees is prohibited.

• The “need to know” principle applies: Employees may have access only as is appropriate for the type and scope of the task.

• Employees are forbidden to use personal data for private or commercial purposes, to disclose it to unauthorized persons, or to make it available in any other way.

• Supervisors must inform employees about the obligation to protect data secrecy at the start of employment. This obligation remains in force even after employment has ended.

---

X. Processing Security

Personal data must be safeguarded from unauthorised access and unlawful processing or disclosure, as well as accidental loss, modification, or destruction.

• Before new methods of data processing (particularly new IT systems) are introduced, technical and organisational measures must be defined and implemented based on the state of the art, the risks of processing, and the need to protect the data.

• The responsible department should consult with the Information Security Officer (ISO) or a similar function and the Data Protection Officer (DPO).

• Measures must be adjusted continuously to technical developments and organisational changes.

---

XI. Data Protection Control

Compliance with the Policy and applicable laws is checked regularly with data protection audits, assessments, and other controls.

• The DPO and other company units with audit rights or external auditors are responsible for controls.

• The results must be reported to the Board.

• On request, results will be made available to the responsible data protection authority, which can also perform its controls.

---

XII. Data Protection Incidents

All employees must inform their supervisor or the Data Protection Officer immediately about cases of violations against this Policy or other regulations on data protection (data protection incidents).

• The manager is required to inform the DPO immediately about incidents.

• In cases of improper transmission, access, or loss of personal data, the required company reports (Information Security Incident Management/Incident Management Form) must be made immediately so that any reporting duties under national law can be complied with. (Refer to Data Breach Management Policy)

---

XIII. Responsibilities and Sanctions

• Executive Body: Responsible for data processing in their area and ensuring legal and Policy requirements are met (e.g., national reporting duties).

• Management Staff: Responsible for ensuring that organisational, HR, and technical measures are in place for lawful data processing.

• Data Protection Officer (DPO) Designation: The relevant executive body must designate the DPO, who is the contact person, performs checks, and familiarises employees with policies.

• New Processing: Departments responsible for business processes and projects must inform the DPO in good time about new processing, especially for data processing plans that may pose unique risks or involve sensitive personal data.

• Training: Managers must ensure their employees are sufficiently trained in data protection.

• Sanctions: Improper processing can be criminally prosecuted and result in claims for compensation. Violations for which individual employees are responsible can lead to sanctions under employment law.

---

XIV. Data Protection Officer

The Data Protection Officer, being internally independent of professional orders, works towards compliance with national and international data protection regulations.

• Appointment: YANGA COLLECTIVE SHOP ITEMZ’s Board of Management appoints the DPO.

• Reporting: The DPO shall promptly inform the Management of any data protection risks.

• Contact: Data subjects may approach the DPO at any time to raise concerns, ask questions, or make complaints relating to data protection via yanga4all@gmail.com.

• Authority: Decisions made by the DPO to remedy data protection breaches must be upheld by the Management.

• Supervisory Inquiries: Inquiries by supervisory authorities must always be reported to the DPO.

---

XV. Definitions