Privacy policy.

1. About this policy

This policy explains what personal information we collect when you use cortex.gov.gy, why we collect it, and the rights you have. It is written to meet the requirements of the Data Protection Act 2023 (Act No. 18 of 2023) of Guyana.

[Legal review: confirm which provisions of the Act are in force on the date of publication, and adjust wording to match.]

2. Who we are

This website is published by [Publishing entity legal name], Government of Guyana (“CORTEX”, “we”, “us”). For the purposes of the Data Protection Act 2023, we are the data controller for personal information collected through this website.

Address: [Street address, city].
Data protection officer: [Title], dpo@cortex.gov.gy.

[Registration number in the Register of Data Controllers, once registered.]

3. What this policy covers

This policy covers the public website at cortex.gov.gy only. It does not cover:

• the CORTEX staff system at cortex.health.gov.gy, which has its own privacy notice: [link]
• CORA at cora.gov.gy, which has its own privacy notice: [link]
• other websites we link to.

4. Information we collect

When you visit this website

Our hosting and security providers automatically record technical information about each request, such as your IP address, browser type, the page you asked for and the time. [Name the hosting and security providers.]

When you email us

If you email one of the addresses on this website, we receive your name, email address and anything you include in your message.

What we do not collect

This website has no accounts, forms or sign-in. Staff sign in takes place on cortex.health.gov.gy, which is covered by its own privacy notice.

5. Cookies and tracking

This website does not set cookies, does not use analytics or advertising trackers, and does not load fonts or scripts from other websites.

[Confirm against the live hosting configuration. If the hosting or security provider sets strictly necessary cookies, list each one here with its purpose and duration.]

6. How we use information

• To run this website and keep it secure, including detecting and blocking attacks.
• To answer your enquiry and keep a record of our reply.
• [Any other purpose, for example handling a security report.]

We do not sell personal information or use it for marketing.

7. Legal basis

[Legal review: state the lawful basis under the Data Protection Act 2023 for each purpose in section 6, for example performance of a function in the public interest, compliance with a legal obligation, or consent.]

8. Who we share information with

We share personal information only when we need to:

• with service providers who host this website and our email, under written agreements that require them to protect it: [list providers]
• with the Ministry of Health, if your enquiry concerns a matter they handle: [confirm]
• when the law requires it.

9. Where information is stored

[State where website logs and email are stored, including any country outside Guyana.]

[Legal review: describe the safeguards used for any transfer of personal data outside Guyana, as required by the Act.]

10. How long we keep information

• Technical request logs: [number] days.
• Emails and our replies: [period, and the records rule it follows].

After that, we delete the information or make it anonymous.

11. How we protect information

This website is served only over encrypted connections (HTTPS). Access to logs and mailboxes is limited to staff who need it. [Summarise other organisational and technical measures.]

If a personal data breach puts your rights at risk, we will tell you and the Data Protection Commissioner as the Act requires.

12. Your rights

Under the Data Protection Act 2023 you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use your information
• receive your information in a format you can take elsewhere
• object to how we use your information.

To use any of these rights, email dpo@cortex.gov.gy. We will reply within [time period required by the Act]. [Legal review: confirm the full list of rights, any exemptions, and how identity is verified.]

13. Children

This website is not aimed at children and does not knowingly collect information from them. [Legal review: confirm wording, including the age the Act uses to define a child.]

14. Contact and complaints

For questions about this policy or how we handle your information, contact our data protection officer at dpo@cortex.gov.gy or write to [postal address].

If you are not satisfied with our response, you can complain to the Data Protection Commissioner: [contact details of the Data Protection Commissioner’s office].

15. Changes to this policy

We will update this policy when the way we handle information changes. The date at the top shows when it was last updated. [Describe how significant changes will be announced.]