Data Protection Policy

1. Our Commitment

BoostEval is committed to protecting the personal data entrusted to it. This policy describes the principles we apply, the roles we assume, the lawful bases on which we rely, and the measures we maintain to safeguard personal data processed through our website, platform, and related services (the "Service"). It applies to users in Mali and, where relevant, to international users under applicable frameworks.

2. Data Protection Principles

We process personal data in accordance with the following principles: Lawfulness & Transparency — We process personal data only where we have a lawful basis, and we are transparent about our processing. Purpose Limitation — Personal data collected to operate the Service is not used for unrelated purposes such as advertising. Data Minimisation — We collect only the personal data necessary for the relevant purpose. Accuracy — We provide tools that enable users to keep their data accurate and up to date. Storage Limitation — We retain personal data only for as long as necessary, after which it is securely deleted. Integrity & Confidentiality — We protect personal data through appropriate technical and organisational measures. Accountability — We document our processing activities and are able to demonstrate compliance.

3. Our Roles

3.1 Controller

In respect of personal data we collect for our own purposes — such as account credentials, billing contacts, and website usage — BoostEval acts as the data controller and determines the purposes and means of processing.

3.2 Processor

Where an organisation uses the Service to administer its employees' evaluations, that organisation acts as the controller of the related personal data. BoostEval processes such data as a processor, acting solely on the organisation's documented instructions. Accordingly, where an employee has a query regarding their evaluation data, the employing organisation is the primary point of contact. BoostEval will provide reasonable assistance as appropriate. Organisations requiring a formal Data Processing Agreement (DPA) may request one from contact@boosteval.com.

4. Lawful Bases for Processing

We rely on the following lawful bases for processing personal data: • Performance of a contract — to provide the Service, for example using your email address to confirm account activation; • Legitimate interests — to secure the Service, resolve issues, and improve functionality, where such interests are not overridden by your rights; • Legal obligation — where applicable law requires us to retain certain records; • Consent — for marketing communications and non-essential cookies, which you may withdraw at any time.

5. Data Subject Rights

Subject to applicable law, individuals may exercise the following rights: Access — Obtain a copy of the personal data we hold about you. Rectification — Request correction of inaccurate or incomplete data. Erasure — Request deletion of your data where permitted by law. Portability — Receive your data in a structured, machine-readable format. Restriction & Objection — Request that we restrict or cease certain processing. Withdrawal of Consent — Withdraw consent to marketing or non-essential cookies at any time. Automated Decisions — BoostEval does not make decisions producing legal or similarly significant effects solely by automated means; human oversight is maintained in the evaluation process. To exercise any of these rights, contact us at contact@boosteval.com. We will respond promptly and within the timeframe required by applicable law.

6. Retention

We retain personal data only for as long as necessary for the relevant purpose: • Account and profile data — retained while the account remains active, with a limited period thereafter to permit data export; • Evaluation and performance records — retained for a reasonable period to support the controlling organisation's record-keeping requirements; • Billing information — retained as required by applicable accounting and tax law; • Security and access logs — retained for a period sufficient to investigate incidents; • Marketing contacts — retained until you unsubscribe or cease engagement. You may request earlier deletion by contacting contact@boosteval.com.

7. Security Measures

7.1 Technical measures

• encryption of personal data in transit and at rest; • secure, one-way hashing of passwords; • role-based access controls; • logical separation of data between organisations; • availability of multi-factor authentication for administrator accounts; • regular backups with tested recovery procedures.

7.2 Organisational measures

• access to production systems limited to personnel with a legitimate need; • data protection training for personnel who handle personal data; • data processing agreements with all third-party providers; • a documented incident response plan.

7.3 Breach response

In the event of a personal data breach, we will investigate without delay, notify the relevant authorities where required, and inform affected individuals without undue delay.

8. Third-Party Processors

We engage trusted service providers, each bound by a data processing agreement, to support the operation of the Service. These providers are not permitted to use personal data for their own purposes. A current list is available on request from contact@boosteval.com.

9. International Data Transfers

BoostEval primarily serves users in Mali. Where personal data is transferred internationally — for example, to cloud hosting infrastructure — we ensure that appropriate safeguards are in place to keep it protected. Details of the safeguards we apply are available on request from contact@boosteval.com.

10. Contact

Email: contact@boosteval.com Response: we acknowledge requests within a few business days and resolve them within the timeframe required by law.

11. Changes to this Policy

We review this policy periodically and update it when our practices change or applicable law requires. Where changes are material, we will provide advance notice.