Data Protection Policy

This policy describes how Panim Holdings collects, processes, stores, and protects personal data in line with applicable data protection law and good practice, including (where relevant) GDPR and local African data protection regimes.

It covers personal data processed through our website and business operations (e.g., institutional engagement, service delivery, and support).

We aim to process personal data in a way that is:

• Lawful, fair, and transparent.
• Limited to specified purposes.
• Adequate, relevant, and minimised.
• Accurate and kept up to date where reasonable.
• Protected with appropriate security.
• Retained only as long as necessary.

We use a layered approach to security, which may include:

• Access controls and least-privilege permissions.
• Encryption in transit and, where appropriate, at rest.
• Monitoring and logging for abuse detection.
• Secure development and change management practices.
• Incident response procedures.

No system is perfectly secure, but we work to reduce risk and to respond quickly if issues arise.

We may use service providers (for example, hosting and communications tools). Where we do, we aim to ensure appropriate contractual safeguards and security measures are in place.

We may disclose personal data where required by law, or to protect rights, safety, and security.

Depending on your location and the type of processing, you may have rights to request access, correction, deletion, restriction, objection, or portability.

To exercise rights or raise concerns, contact us via Contact. You may also have the right to complain to a relevant supervisory authority.