GCMI Privacy Policy

Last updated: August 29, 2024

Greater Cincinnati Microenterprise Initiative (GCMI) is committed to safeguarding the privacy and security of personal information in compliance with the General Data Protection Regulation (GDPR) and other applicable laws. This Privacy Policy outlines our practices regarding the collection, use, and disclosure of personal information. By using our services and website, you agree to the terms outlined in this Privacy Policy.

1. Notice

GCMI is transparent about our data collection practices. We provide clear and accessible information at the point of data collection, including:

• The types of personal data we collect.
• The purposes for which the data is collected and processed.
• The legal basis for processing (for example consent or legitimate interest).
• The recipients or categories of recipients of the personal data.
• Information on transfers of data to third countries and the safeguards in place.
• The retention period for the data or criteria used to determine that period.
• The rights of individuals concerning their data (for example access, rectification, erasure).

2. Choice and Consent

Where required, GCMI obtains explicit consent from individuals before collecting or processing their personal data. Individuals have the right to withdraw their consent at any time. Additionally, we provide options to opt in or opt out of certain data processing activities, ensuring that individuals have control over their personal information.

3. Onward Transfer

GCMI will only transfer personal data to third parties, including partners and service providers, in compliance with GDPR. When transferring personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), to protect the data.

4. Data Security

GCMI implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where applicable.
• Regular testing and evaluation of security measures.
• Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.

5. Data Integrity and Accuracy

GCMI ensures that personal data is accurate, complete, and kept up to date. We only collect and process data that is necessary for the purposes for which it was collected. We encourage individuals to update their personal information to help us maintain accurate records.

6. Individual Rights

Under GDPR, individuals have specific rights regarding their personal data:

• Right of Access: The right to obtain confirmation as to whether or not personal data is being processed and, if so, access to the data.
• Right to Rectification: The right to request correction of inaccurate personal data.
• Right to Erasure (“Right to be Forgotten”): The right to request the deletion of personal data when it is no longer necessary for the purposes for which it was collected or if the data has been unlawfully processed.
• Right to Restriction of Processing: The right to request the restriction of processing under certain conditions.
• Right to Data Portability: The right to receive personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
• Right to Object: The right to object to the processing of personal data based on legitimate interests or direct marketing.

To exercise any of these rights, please contact us using the information below.

7. Enforcement and Accountability

GCMI enforces this Privacy Policy through internal policies and procedures, ensuring compliance with GDPR and other applicable laws. We regularly monitor our data protection practices and maintain records of processing activities as required by GDPR. We take corrective action when necessary to address any potential breaches or non-compliance issues.

8. Data Protection Officer (DPO)

GCMI has appointed a Data Protection Officer (DPO) responsible for overseeing data protection strategy and compliance with GDPR. The DPO can be contacted at:

9. Consent

By using GCMI's services or providing us with your personal information, you consent to the collection, use, and disclosure of your data as described in this Privacy Policy. We may update this policy from time to time, and any changes will be communicated through our website. Continued use of our services following the posting of changes constitutes acceptance of those changes.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Conclusion

GCMI is dedicated to protecting your privacy and ensuring the responsible handling of personal data in compliance with GDPR. We appreciate your trust and are committed to maintaining the highest standards of data protection.