Data Protection, Retention & Incident Management Policy

This Policy establishes OMIYO's internal approach to:

• personal-data protection;
• data governance;
• data retention;
• secure deletion;
• data breaches;
• privacy incidents; and
• responses to individual data requests.

This Policy applies to personal information processed by OMIYO in its capacity as:

• data controller; or
• data processor.

Where OMIYO acts as a processor for a client, the applicable client agreement and Data Processing Agreement will also apply.

OMIYO will seek to ensure that personal information is:

• processed lawfully, fairly and transparently;
• collected for specified purposes;
• adequate, relevant and limited;
• accurate;
• retained only as necessary;
• protected appropriately; and
• processed in accordance with applicable data-protection requirements.

OMIYO will determine its role based on the actual processing activity.

When OMIYO determines the purposes and means of processing, it may act as controller.

When OMIYO processes personal information on a client's documented instructions, it may act as processor.

Where OMIYO acts as a processor, processing must be governed by an appropriate written agreement.

OMIYO will seek to collect and process only information reasonably necessary for the relevant business purpose.

Personnel should not request or retain information merely because it may be useful in the future.

Special-category personal data and other highly sensitive information should not be collected or processed unless there is a clear lawful basis, business requirement and appropriate safeguards.

Where high-risk processing is proposed, OMIYO will consider whether a Data Protection Impact Assessment (DPIA) is appropriate.

OMIYO will establish appropriate retention periods based on:

• legal requirements;
• contractual obligations;
• business requirements;
• security requirements;
• accounting requirements; and
• potential disputes.

At the end of the relevant retention period, information should be securely deleted, anonymised or otherwise disposed of.

Unless a different period is required by law, contract or business necessity:

These periods may be adjusted where a documented reason exists.

Requests concerning personal-data rights should be referred promptly to the person responsible for data protection.

OMIYO will assess the request and respond within applicable legal timeframes.

Personnel must not independently delete, alter or disclose personal information in response to a data-subject request without following the appropriate process.

A personal-data breach may include:

• unauthorised disclosure;
• loss;
• theft;
• unauthorised access;
• accidental transmission;
• destruction; or
• compromise of personal information.

All suspected breaches must be reported immediately.

OMIYO will:

1. 1. identify and contain the incident;
2. 2. preserve relevant evidence;
3. 3. assess the information affected;
4. 4. assess the potential impact;
5. 5. determine whether notification is required;
6. 6. notify clients or regulators where required;
7. 7. take corrective action; and
8. 8. record lessons learned.

Where OMIYO acts as processor and experiences a personal-data breach affecting client data, OMIYO will notify the relevant client without undue delay in accordance with the applicable contract/DPA.

Where a personal-data breach presents a risk to individuals' rights and freedoms, OMIYO will assess whether notification to the ICO is required.

Where notification is required, OMIYO will seek to comply with the applicable statutory deadline.

Where an incident affects client information, OMIYO will follow contractual notification requirements and communicate material information to the client appropriately.

OMIYO will maintain an incident record containing, where appropriate:

• date;
• nature of incident;
• systems/data affected;
• individuals or clients affected;
• risk assessment;
• actions taken;
• notifications;
• resolution; and
• lessons learned.

Personal information and confidential business information must be disposed of securely.

Digital information should be securely deleted where technically appropriate.

Physical records should be securely destroyed.

Where a new service, technology, AI system or processing activity presents significant privacy or security risks, OMIYO will assess those risks before implementation where reasonably practicable.

This Policy will be reviewed at least annually and following significant changes or incidents.