GDPR Readiness Statement

The General Data Protection Regulation (GDPR) is the European Union's data protection framework. For clients who operate internationally, serve EU users, or handle cross-border data, Noko Mohoto Technologies can structure systems with GDPR principles in consideration.

GDPR-aware system architecture

• Lawful-basis thinking: systems are planned around why data is collected, not just what is collected
• Data minimisation: collect and store only what the system genuinely needs
• Consent capture and privacy notice support where consent is the applicable basis
• Access controls and role-based permissions over personal data
• Retention planning and deletion capability, so data subject erasure requests can be honoured
• Data subject request readiness: the ability to locate, export, correct, or delete a person's records
• Cross-border data consideration, including where data is hosted and which processors are involved

US privacy — CCPA / CPRA

For clients with users in the United States, and California in particular, systems can be structured with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) in consideration. This includes supporting consumer rights such as knowing what personal information is collected, requesting access or deletion, and opting out of the sale or sharing of personal information.

As with GDPR, CCPA/CPRA obligations depend on how a business actually operates. We build the technical capabilities that support these rights; the legal determination of what applies to a given business rests with the client and its advisers.

What this statement is not

GDPR and CCPA/CPRA compliance are determined by how an organisation processes data in practice, including its legal bases, contracts, and internal procedures. We do not claim that any system is automatically compliant with any of these frameworks. We build privacy-aware architecture and can support clients with the technical measures and documentation their own compliance work requires.

More information is available from the European Commission's data protection resources and the California Privacy Protection Agency (cppa.ca.gov).