Data Protection Policy

This Data Protection Policy sets out how BITS College protects personal data in connection with the operation of www.bitscollege.edu.et. It is intended for internal governance purposes and for transparency to visitors, and complements the Privacy Policy.

This Policy is based on Ethiopia's Personal Data Protection Proclamation No. 1321/2024 and reflects BITS College's commitment to lawful, fair, transparent, and secure processing of personal data. Where applicable, BITS College follows the rights, obligations, safeguards, and requirements established under the Proclamation.

Given the current design of the Site (a static/informational website with no on-site forms or user accounts), the only data processed through www.bitscollege.edu.et is:

• Standard web server access logs (IP address, requested page, timestamp, referrer, user agent), collected automatically for security and operations
• A single locally-stored display preference (light/dark mode) that never reaches BITS College's servers

No sensitive personal data (as defined by the Proclamation — e.g., health, biometric, religious, or political data) is knowingly collected through this Site.

BITS College is the data controller for information processed through this Site. For this Site, BITS College acts as the data controller only for limited processing activities directly under its control, such as managing website-related inquiries received through external communication channels. Any hosting or infrastructure provider used to serve the Site acts as a data processor on our behalf and is expected to process data only on our instructions and to maintain appropriate security safeguards.

• Lawfulness, fairness, and transparency: this Policy and the Privacy Policy describe what is collected and why
• Purpose limitation: server logs are used only for security and Site operation
• Data minimization: the Site is designed to avoid collecting personal data wherever possible (no forms, no accounts, no analytics)
• Storage limitation: logs are retained only as long as reasonably necessary for security and operational purposes
• Integrity and confidentiality: see Section 6 below

• All traffic is served over HTTPS, with HTTP Strict Transport Security (HSTS) enforced in production
• Standard security headers are applied (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) to reduce common web attack surfaces
• The application runs as a non-root user in its deployment environment, following standard containerization security practice
• Hosting backups and infrastructure-level recovery mechanisms are provided according to the hosting services supplied by Yegara Host. BITS College relies on the hosting provider's available backup mechanisms and does not represent that backups eliminate all risk of data loss.

• Embedded YouTube content is provided by Google LLC/YouTube, which independently processes data according to its own privacy practices when its embedded player is loaded.
• BITS College may use third-party technology and infrastructure providers to support its digital services. The processing arrangements with such providers may vary depending on service requirements.

No other third parties are intentionally provided with personal data collected through this Site. Any processing performed by third-party infrastructure providers is limited to the operation, security, and availability of the hosting environment.

Consistent with the Personal Data Protection Proclamation No. 1321/2024, individuals may request information about, access to, correction of, or deletion of any personal data BITS College holds about them in connection with this Site, and may object to processing. Requests can be made using the contact details in Section 10. Because the Site collects minimal, largely non-identifying technical data, most requests can be resolved quickly; where server logs cannot be tied to a specific individual, we will explain this in our response.

In the event of a data breach affecting personal data processed through this Site, BITS College will assess the risk to affected individuals and, where required, notify the Ethiopian Communications Authority and any affected individuals in accordance with applicable law and required timeframes.

For any data protection inquiry, request, or concern related to this Site:

BITS College, Yeka Sub-City, Woreda 05, Next To Yeka Park, Addis Ababa, Ethiopia
Phone: +251-982-363636
Email: info@bitscollege.edu.et

BITS College manages privacy and data protection matters through appropriate institutional processes and communication channels.

This Policy will be reviewed periodically and updated as the Site's functionality changes (for example, if forms, accounts, or analytics are added in the future, this Policy and the Privacy Policy must be updated accordingly before launch).