OBJECTIVE

The objective of this policy is to protect Consilium’s information assets from threats, whether internal or external, deliberate or accidental, to ensure business continuation, minimise business damage and maximise business opportunities.

This policy establishes a general standard on the appropriate protection of personal information within Consilium as it provides principles regarding the rights of individuals to privacy and to reasonable safeguards of their personal information.

SCOPE

This policy applies to key individuals, representatives and staff of Consilium. The Company and key individuals (or management) are ultimately responsible for ensuring that information security is properly managed. The Information Officer of Consilium is responsible for:

• The development and upkeep of this policy;
• Ensuring this policy is supported by appropriate documentation, such as procedural instructions; 
• Ensuring that documentation is relevant and kept up to date; 
• Ensuring this policy and subsequent updates are communicated to relevant managers, representatives, staff and associates, where applicable.

The Company and all key individuals, representatives and staff are responsible for adhering to this policy, and for reporting any security breaches or incidents to the Information Officer.

The external individual(s) who is (are) contracted to handle the information technology of Consilium, must adhere to the same information security as that of Consilium, and will confirm by separate agreement that they have such security measures in place in respect of processing of personal information. By way of example, this includes any cloud storage service providers utilised by Consilium.

KEY PRINCIPLES

The Company and each key individual, representative and staff member of Consilium, is committed to the following principles: 

• To be transparent with regards to the standard operating procedures governing the collection and processing of personal information.
• To comply with all applicable regulatory requirements regarding the collection and processing of personal information.
• To collect personal information only by lawful and fair means and to process personal information in a manner compatible with the purpose for which it was collected. 
• Where required by regulatory provisions, to inform individuals when personal information is collected about them. 
• To treat sensitive personal information that is collected or processed with the highest of care as prescribed by regulation. 
• Where required by regulatory provisions or guidelines, to obtain individuals’ consent to process their personal information.
• To strive to keep personal information accurate, complete and up to date and reliable for their intended use.
• To develop reasonable security safeguards against risks such as loss, unauthorized access, destruction, use, amendment or disclosure of personal information.
• To provide individuals with the opportunity to access the personal information relating to them and, where applicable, to comply with the requests to correct, amend or delete personal information.
• To share personal information, such as permitting access, transmission or publication, with third parties only with a reasonable assurance that the recipient has suitable privacy and security protection controls in place regarding personal information. 
• To comply with any restriction and/or requirement that applies to the transfer of personal information internationally.

MONITORING

The management and Information Officer of Consilium, are responsible for administering and overseeing the implementation of this policy and, as applicable, supporting guidelines, standard operating procedures, notices, consents and appropriate related documents and processes.

The Company and key individuals, representatives and staff of Consilium are to trained according to their functions in regulatory requirements, policies and guidelines that govern the protection of personal information and Consilium will conduct periodic reviews and audits, where appropriate, to demonstrate compliance with privacy regulation, policy and guidelines.

OPERATING CONTROLS

Consilium, shall establish appropriate privacy standard operating controls that are consistent with this policy and regulatory requirements.

This will include:

• Allocation of information security responsibilities.
• Incident reporting and management.
• User ID addition or removal.
• Information security training and education.
• Data backup.

IMPLEMENTATION

This policy is implemented by Consilium, and will be adhered to by the Company and all key individuals, representatives and staff who are tasked with collecting and processing of personal information. Noncompliance with this policy may result in disciplinary action and possible termination of employment or mandate, where applicable.