FunMap Data Sharing Policy

Purpose

This Data Sharing Policy establishes the principles and procedures governing the sharing, transfer, disclosure, access, and use of data collected, generated, stored, or managed by FunMap.

The purpose of this policy is to ensure that data is shared responsibly, securely, lawfully, and ethically while protecting the privacy, confidentiality, rights, and interests of individuals and other stakeholders.

Scope

This policy applies to all employees, management, consultants, contractors, partners, service providers, researchers, and any other third parties who collect, access, process, store, receive, or share data on behalf of FunMap.

It applies to data shared internally and externally, including personal data, business information, research data, financial information, operational data, and other confidential or sensitive information.

Principles Of Data Sharing

All data sharing activities shall be guided by the following principles.

• Lawfulness: Data shall only be shared where there is a lawful, legitimate, contractual, regulatory, research, operational, or other appropriate basis for doing so.
• Purpose Limitation: Data shall only be shared for a clearly defined and legitimate purpose. Recipients shall not use the data for purposes that are incompatible with the original purpose for which it was collected.
• Data Minimisation: Only the minimum amount of data necessary to achieve the intended purpose shall be shared.
• Confidentiality and Security: Appropriate technical and organisational measures shall be implemented to protect data against unauthorised access, disclosure, alteration, loss, destruction, or misuse.
• Transparency: Where appropriate, individuals and relevant stakeholders shall be informed about how and why their data may be shared.
• Accountability: All persons and organisations involved in data sharing shall be responsible for complying with this policy and any applicable laws, regulations, agreements, and internal procedures.

Categories Of Data That May Be Shared

Depending on the purpose and applicable requirements, the organisation may share personal information, contact information, demographic information, research and survey data, aggregated and anonymised data, financial and transactional information, operational and administrative information, monitoring, evaluation, accountability, and learning data, statistical and analytical data, and other information necessary for legitimate organisational purposes.

Sensitive or confidential data shall receive additional protection and shall only be shared where appropriate safeguards are in place.

Circumstances Under Which Data May Be Shared

Data may be shared under the following circumstances.

• With authorised employees or departments for legitimate organisational purposes;
• With service providers and contractors performing services on behalf of the organisation;
• With government authorities, regulators, or law enforcement agencies where legally required;
• With research institutions, development partners, or collaborating organisations;
• Where the individual has provided appropriate consent, where consent is required;
• To protect the rights, safety, security, or property of the organisation or other persons;
• In connection with audits, investigations, legal proceedings, or regulatory requirements; or
• Where data has been anonymised or aggregated to prevent identification of individuals.

Data Sharing With Third Parties

Before sharing data with a third party, FunMap shall, where appropriate: assess the purpose and necessity of the proposed data sharing; confirm that there is an appropriate legal or legitimate basis for sharing the data; ensure that only relevant and necessary data is shared; conduct appropriate due diligence on the receiving organisation; establish appropriate security and confidentiality requirements; and enter into a Data Sharing Agreement, Non-Disclosure Agreement, Data Processing Agreement, Memorandum of Understanding, or other appropriate arrangement.

Third parties receiving data shall be required to use the information only for the agreed purpose and to maintain appropriate safeguards.

Data Sharing Agreements

Where necessary, a written data sharing agreement shall define the parties involved, the purpose of the data sharing, the categories of data being shared, the legal or other basis for sharing, the permitted uses of the data, security and confidentiality requirements, restrictions on further sharing, data retention periods, procedures for reporting data breaches or security incidents, responsibilities of each party, and procedures for the return, deletion, or destruction of data.

International Or Cross-Border Data Transfers

Where data is transferred outside the country in which it was collected or stored, FunMap shall take reasonable steps to ensure that the transfer is lawful and that appropriate safeguards are in place to protect the data.

Such safeguards may include contractual obligations, security measures, data transfer agreements, or other legally recognised mechanisms.

Data Security

Data shared under this policy shall be protected through appropriate measures, which may include access controls and user authentication, password protection, encryption where appropriate, secure file transfer methods, restricted access based on job responsibilities, secure storage and backup procedures, confidentiality agreements, monitoring and logging of access where appropriate, and staff training on privacy and information security.

Restrictions On Further Disclosure

Recipients of shared data shall not disclose, sell, distribute, publish, transfer, or otherwise make the data available to another party without prior authorisation from FunMap, unless required by law or expressly permitted under an applicable agreement.

Data Breaches And Security Incidents

Any actual or suspected unauthorised access, loss, disclosure, alteration, or misuse of shared data must be reported immediately to the Data Protection Officer or Information Security Officer.

The organisation shall investigate the incident and take appropriate measures to contain, assess, mitigate, and address the impact of the breach. Incidents may also be reported to support@funmap.ckayesera.com.

Roles And Responsibilities

Management is responsible for ensuring that appropriate systems, procedures, and resources are available to support compliance with this policy.

Employees and authorised personnel must only access data necessary for their responsibilities, share data only through authorised channels, follow applicable security procedures, protect confidential information, and immediately report suspected data breaches or misuse.

Third parties receiving data must comply with applicable contractual, legal, privacy, confidentiality, and security obligations.

Compliance And Enforcement

Failure to comply with this policy may result in disciplinary action, termination of contracts or agreements, withdrawal of data access privileges, and, where applicable, legal action.

Policy Review

This policy shall be reviewed periodically and updated when necessary to reflect changes in organisational operations, technology, risks, and applicable legal or regulatory requirements.

Approval

• Approved by: __________________________
• Name/Title: __________________________
• Effective Date: _______________________
• Next Review Date: ____________________
• Version: 1.0