Details
Template of an Internal Privacy Policy/ Personal Data Protection Policy for a company’s internal use. The policy aims to protect the fundamental right of privacy and act as a guidance for the employees to use the data they have collected
Internal Privacy Policy/ Personal Data Protection Policy
A. General Purpose
(the “Company”) acknowledges privacy is the fundamental right of an individual and shall be protected by the Company in our best endeavors. The Company is dedicated to treating the information of our employees, customers, clients, and all relevant parties with the utmost care and confidentiality. The Company is committed to creating a safe and confidential environment for all parties to freely share their information by ensuring that we gather, store, and utilize all collected information fairly and transparently.
The purpose of this policy is:
To set out policies and procedures implemented by the Company for protecting the privacy of our employees, customers, and clients;
To provide guidance for our employees to ensure all information to which they have access in the course of their work are collected, handled and stored safely
This policy applies to all levels of employees who are currently under a fixed-term contract, permanent contract, part-time contract, interns, and casual workers, subject to the eligibility as stated below. This policy is endorsed and fully supported by the Company and its senior management. The Company reserves all rights to amend the content of the policy at any time.
B. Interpretation
Unless the context otherwise requires,
Data Controller means all and any people who decide the purpose and means of a certain kind of processing personal information.
Data Processors means all and any people who process Personal Information.
Data Subjects means the people to whom the Personal Information relates.
Personal Data means any information relating to an identifiable individual. Such information includes, but is not limited to:
- Name, date of birth, identity document number, and photography;
- Contact information such as an address, email address, IP address and phone number;
- Financial account information;
- Health or medical information;
- Information collected during the application and hiring process; and
- Information related to employee benefits, including all personal information of data subjects’ dependents, beneficiaries, and insurance policy information.
Process means any actions performed on the Personal Data. Such actions include but are not limited to: collecting, recording, organizing, modifying, gathering, handling, transferring, retaining, and deleting.
C. The Company's Procedures
General Principles
The Company will only process Personal Data with the purpose or a reasonably related purpose for which they were collected. The Company will not process such Personal Data in a manner that is incompatible with such purposes unless the relevant Data Subject has provided consent upon such action. In addition, the Company will perform at its best endeavor to ensure Personal Data being processed is accurate and up-to-date. Purposes for processing Personal Data must be legal and reasonable, which includes and not limited to:
- Performance of legitimate business interests of the Company; Performance of - - legitimate operational interests of the Company; and
- Compliance with legal obligations.
The Company will document records of processing and such documentation will be stored with full security in the Company’s database. They will be reviewed and accessed on a need-to-know basis.
The Company will not retain Personal Data for a period longer than necessary for the purpose for which they were collected unless they are necessary to be retained to comply with legal or regulatory obligations. The period will be determined on a case-to-case basis.
The Company will not sell, transfer, or disclose any Personal Data to other third-parties without Data Subjects’ consent. However, the Company may share the Personal Data with its corporate affiliates provided that all procedures are complied with.
The Company will organize regular training to ensure all employees have sufficient knowledge about this policy and the correct procedure in processing Personal Data. The Company’s management and/or Human Resources Department is responsible for designing and conducting appropriate training sessions.
Obtaining Data Subjects' Consent
The Company must obtain consent from Data Subjects in an appropriate manner before any processing conducts are performed by any employees in the Company as we acknowledge Data Subjects has the right to receive information about the conducts performed on their Personal Information. Such information includes:
- Identity of Data Controller;
- Purpose and methods of processing Personal Data;
- Scope of Personal Information is processed; and
- Any third parties involved for which the Personal Data might be transferred or disclosed to.
In order to reduce potential disputes, Data Subjects’ consent must be provided orally, in writing, or electronically. The Company will not take any actions of Data Subject as implied consent. For Data Subjects who are not capable of providing their consent, such as children, elderlies, and patients with mental disorders, the Company will obtain consent from their legal guardian(s). However, the Company need not obtain Data Subject’s consent under the following special circumstances:
- When the Personal Data can be publicly accessed and collected
- When the processing is necessary for the Company’s legitimate business interest; and
- When the processing is necessary for the public interest.
The Company hereby acknowledges privacy as a fundamental right and respects decisions made by Data
Subjects to withdraw their consent by giving legal and reasonable notice to the Company. However, Data Subjects might not receive benefits and services prior to their withdrawal of consent after the Company accepts their withdrawal.
Data Subjects' Rights
Data Subjects have the following rights and these rights can be exercised through giving legal and reasonable notice to the Company:
- Right to Access: The Company will grant permission for Data Subjects to check about details of their Personal Data being processed upon request. The Company will provide legitimate reasons if we wish to reject such requests.
- Right to Correct: Data Subjects have the right to make requests for the correction of any incorrect or misleading Personal Data about themselves. Evidence should be supplemented with such requests.
- Right of Erasure: Data Subjects have the right to request their Personal Data to be erased from the Company’s database.
Confidentiality and Security
The Company will perform at its best endeavour to protect the confidentiality and security of personal data and such a duty extends to all interactions with third parties such as employees and clients. All terms and conditions stated in the Confidentiality Agreement signed by employees upon their employment applies.
We take all breaches of this policy very seriously and we hereby promise all allegations of breach will be thoroughly investigated by the Human Resources Department confidentially and fairly.
D. Policy Violations
This Privacy Policy applies to all employees and your compliance is mandatory. All employees are required to carefully read and understand the Policy upon their employment. We take all breaches of this policy very seriously and we hereby promise all allegations of breach will be thoroughly investigated by the Human Resources Department confidentially and fairly.
Employees should contact the Human Resources Department as soon as possible shall you wish to raise an allegation of a breach under the policy. Any allegations made in good faith will be fully supported by the Company with all appropriate measures and investigation being taken out, regardless of the conclusion of the allegation and the subjective view of any senior management. There will never be any reprisals against employees who raise allegations of a breach under the policy. Nevertheless, allegations or attempts to make allegations in bad faith, for whatever reasons, will be classified as misconduct and may lead to dismissal upon the discretion of the Company.
Anyone who breached this policy will be subject to discipline depending on the severity of the breach. The Company reserves all right to dismiss employees without notice and with no payment in lieu of that notice shall the breach is so severe that amounts to gross misconduct according to the discretion of the Company’s senior management.
E. For more information
If you have any questions or need further guidance, please contact your human resources representative at
F. Revision Date
This Agreement was last updated on ("Revision Date"). If you were a user before the Revision Date, it replaces the existing Equal Opportunities Policy.
