Collection and purpose limitation
We seek to collect information for specific, legitimate purposes and limit collection to what is reasonably necessary. Personal data should not be reused for unrelated purposes without an appropriate basis, notice or permission. Project-specific confidentiality and data requirements may apply in addition to this statement.
Access and security
Access to personal, confidential or project-restricted information should be limited to people who need it for authorized work. TTI aims to use appropriate measures such as account permissions, strong authentication, secure transfer and storage, device protection, backups and staff confidentiality obligations, depending on the system and sensitivity involved.
Research datasets and sharing
Where possible, datasets used for analysis and reporting should be de-identified or aggregated. Identifiable data should be shared only when necessary, authorized and supported by proportionate contractual, technical or organizational controls. Third-party processors and collaborators are expected to respect applicable confidentiality and security requirements.
Retention and secure disposal
Retention periods depend on project needs, contractual terms and applicable legal requirements. Information no longer needed should be deleted, securely disposed of or anonymized, subject to legitimate preservation and audit obligations. Backups and archived records may follow defined operational deletion cycles.
Incidents and individual requests
Suspected unauthorized access, loss or disclosure should be reported promptly through internal channels, assessed and addressed according to severity and applicable obligations. Individuals may request information about how their data is handled and seek correction or deletion where appropriate; some requests may be limited by legal, contractual or research-integrity obligations.
For data protection questions or concerns, contact info@tti.org.pk. This statement describes TTI’s intended practices and does not claim certification against a particular data-protection standard.