Data Protection Policy

1. Introduction

MHFAI needs to gather and use certain information about individuals to provide its services effectively. These can include among other things individuals' personal information or other personally identifiable or identified information.

This policy describes how this personal data must be collected, handled, and stored to meet the MHFAI data protection standards.

2. Definitions

• MHFA India or MHFAI means Mental Health First Aid India a registered MSME in India.
• GDPR means the General Data Protection Regulation, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and the free movement of such data and repealing Directive 95/46/EC.
• Responsible Person(s) means directors, employees, contractors, suppliers, and other people working on behalf of MHFAI who may require access to Personal Data or who come in contact with Personal Data. To avoid any doubt, a Responsible Person includes an LMS Admin within the MHFA India and Training operation in charge and any other person as appointed from time to time from MHFA I management.
• Register of Systems means a register of all systems or contexts in which Personal Data is processed by the MHFA India.
• Services means the services provided by MHFAI to its Users through its website.
• User(s) means the individuals who avail of the Services from MHFAI.
• User Data means data provided by or on behalf of Users while obtaining the Services.
• Personal Data means any User Data relating to an identified or identifiable natural person; an identifiable natural person can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

3. Data protection principles

GDPR is aimed at guiding and regulating the way companies across the world handle their customers' personal information and MHFA India is committed to processing Personal Data by its responsibilities under the GDPR. Under MHFAI's commitment Article 5 of GDPR is incorporated into this policy, Article 5 requires that Personal Data shall be:

• processed lawfully, fairly, and in a transparent manner about individuals;
• collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered to be incompatible with the initial purposes;
• adequate, relevant, and limited to what is necessary about the purposes for which they are processed;
• accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that inaccurate personal data, having regard to the purposes for which they are processed, are erased or rectified without delay;
• kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes subject to the implementation of the appropriate technical and organizational measures required by the GDPR to safeguard the rights and freedoms of individuals; and
• processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organizational measures.

4. General provisions

• This policy applies to all Personal Data processed by MHFA India.
• The Responsible Persons shall take responsibility for MHFA India's ongoing compliance with this policy.
• This policy shall be reviewed at least annually.

5. Lawful, fair, and transparent processing

• To ensure its processing of Personal Data is lawful, fair, and transparent, MHFA India shall maintain a Register of Systems.
• The Register of Systems shall be reviewed at least annually.
• Users have the right to access their Data and any such requests made to the MHFA India shall be dealt with promptly by the appropriate Responsible Person.

6. Lawful purposes

• All Personal Data processed by the MHFA India must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
• The MHFA India shall note the appropriate lawful basis in the Register of Systems.
• Where consent is relied upon as a lawful basis for processing Personal Data, evidence of opt-in consent must be kept with the Personal Data.
• Where communications are sent to Users based on their consent, the option for the User to revoke their consent should be available and systems should be in place to ensure such revocation is reflected accurately in the MHFA India's systems.

7. Responsibilities

The responsible Person of each team that handles Personal Data must ensure that they handle and process Personal Data in line with this policy and data protection principles. However, the following Responsible Persons have key areas of responsibility:

• Data Protection Officer - who will be responsible for:
  • keeping the Register of Systems updated about Personal Data protection responsibilities, risks, and issues;
  • reviewing all data protection procedures and related policies;
  • arranging data protection training and advice for all the people covered by this policy;
  • handling issues related to breach of data protection, questions from Responsible Person and anyone else covered by this policy;
  • dealing with requests from Users to see their Data with MHFAI; &
  • checking and approving any contracts or agreements with third parties that may require or access Personal Data.
• IT Manager - who will be responsible for:
  • ensuring all Register of Systems, other systems, services, and equipment used for storing Personal Data meet acceptable security standards;
  • performing regular checks and scans to ensure security hardware and software are functioning properly; &
  • evaluating any third-party services MHFAI is considering using to store or process Personal Data. For instance, cloud computing services.
• Data manager - who will be responsible for:
  • Design, develop, and modify data management infrastructure to expedite data analysis and reporting.
  • Review presentations, manuscripts, tables, and graphs for accuracy and quality.
  • Develop standard operating procedures for data handling and archiving.
  • Maintain data management plans and operating instructions for complex business systems and architectures.
  • Guide in identifying and defining data requirements.
  • Provide technical oversight for integrating new technology or new initiatives into data standards and structures.
  • Evaluate the design, selection, implementation, and support of database changes using associated business requirements and design documents.
  • Maintain internal data asset library.
  • Train junior data managers when needed.
  • Assist in setting milestones and timelines.
  • Ensure the integrity, confidentiality, and security of all datasets.
  • inform third parties on training outcomes through data anonymization and masking to protect personal information.
  • Get approval from the data protection officer before implementing all data-related procedures and processes.

8. Data minimisation & Usage

• MHFA India shall ensure that Personal Data is adequate, relevant, and limited to what is necessary for the purposes for which they are processed.
• Add considerations relevant to the MHFA India's particular systems
• When working with Personal Data, Responsible Persons should ensure the screens of their computers are always locked when left unattended.
• Personal Data should not be shared informally. In particular, it should never be sent by a source of communication that is not secure.
• Personal Data must be encrypted before being transferred electronically. The IT manager can explain how to send data to authorized external contacts.

9. Accuracy

• MHFA India shall take reasonable steps to ensure Personal Data is accurate.
• Where necessary for the lawful basis on which the Personal Data is processed, steps shall be put in place to ensure that Personal Data is kept up to date.
• [Add considerations relevant to the MHFA India's particular systems]
• Personal Data will be held in as few places as necessary. Responsible Persons should not create any unnecessary additional data sets.
• Concerned Responsible Person should take every opportunity to ensure that the Personal Data is updated. For instance, by confirming a User's details when they call.
• MHFAI will make it easy for users to update the Personal Data that MHFAI holds about them.

10. Archiving/removal

• To ensure that Personal Data is kept for no longer than necessary, MHFA India shall put in place an archiving policy for each area in which Personal Data is processed and review this process annually.
• The archiving policy shall consider what Personal Data should/must be retained, for how long, and why.

11. Security

• MHFA India shall ensure that Personal Data is stored securely using modern software that is kept up-to-date.
• Access to Personal Data shall be limited to Responsible Persons who need access and appropriate security should be in place to avoid unauthorized sharing of information.
• When Personal Data is deleted, this should be done safely such that the data is irrecoverable.
• Appropriate backup and disaster recovery solutions shall be in place.

12. Breach

All principles described in this policy must be strictly followed. A breach of data protection guidelines will invoke disciplinary and possibly legal action. In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, the concerned Responsible Person must without any undue delay inform the Data Protection Officer about any breach (report the breach to the mhfaindia@mhfaindia.com) so that MHFA India can promptly assess the risk to concerned User's rights and freedoms and take the necessary remedial actions.

END OF POLICY.