GDPR Compliance

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on 25 May 2018. It strengthens data protection rights for individuals within the European Union and regulates how personal data is collected, processed, and stored. While BEESKUL operates primarily in Africa, we apply GDPR principles as a global best-practice standard across all our operations.

2.1 Data Controller

For our own business operations and marketing activities, BEESKUL acts as a Data Controller — we determine the purposes and means of processing personal data.

2.2 Data Processor

For school management services, BEESKUL acts as a Data Processor. Educational institutions (our customers) are the Data Controllers, and we process personal data strictly on their behalf and according to their documented instructions.

We adhere to all seven GDPR principles:

4.1 Technical Measures

• End-to-end encryption for all data in transit (TLS 1.3)
• Encryption of data at rest using AES-256
• Regular security patches and dependency updates
• Intrusion detection and prevention systems
• Automated secure backup with geographic redundancy
• Multi-factor authentication for all admin accounts

4.2 Organisational Measures

• Appointed Data Protection Officer (DPO)
• Mandatory staff training on data protection
• Data processing agreements with all sub-processors
• Regular Data Protection Impact Assessments (DPIAs)
• Documented incident response procedures
• Vendor risk assessments before onboarding third parties

We facilitate all data subject rights with a 30-day response commitment:

We enter into formal Data Processing Agreements (DPAs) with:

• Educational Institutions: Every school using our platform signs a DPA
• Sub-processors: All third-party service providers with data access
• Integration Partners: Business partners who access data via our APIs

Our DPAs incorporate standard contractual clauses where applicable and clearly define processing purposes, data categories, retention periods and security obligations.

Where data is transferred internationally, we ensure appropriate safeguards including:

• EU-approved standard contractual clauses
• Adequacy decisions where applicable
• Binding corporate rules for intra-group transfers
• Data localisation where required by local law

We maintain a documented breach response process:

• Detection: 24/7 monitoring systems with automated alerts
• Assessment: Impact classification completed within 24 hours
• Notification: Supervisory authority notified within 72 hours of discovery
• Communication: Affected data subjects notified without undue delay
• Documentation: All incidents recorded in our breach register
• Review: Post-incident analysis to prevent recurrence

We have appointed a Data Protection Officer (DPO) responsible for:

• Monitoring GDPR compliance across all operations
• Advising on Data Protection Impact Assessments
• Cooperating with supervisory authorities
• Serving as the primary contact for data subject requests
• Maintaining the register of processing activities

Contact our DPO at: [email protected]

We maintain detailed records of all processing activities as required by GDPR Article 30, including:

• Purposes and legal basis of processing
• Categories of data subjects and personal data processed
• Categories of recipients and any third-country transfers
• Data retention and deletion schedules
• Technical and organisational security measures

Privacy considerations are embedded into our development process from the outset:

• Data minimisation enforced at the data model level
• Pseudonymisation and encryption applied by default
• Privacy impact assessments conducted for new features
• Most restrictive privacy settings enabled by default for all users
• Regular privacy audits of all platform components

For GDPR-related enquiries, please contact our Data Protection Officer: