Privacy Principles

We honour data subjects’ choices about their personal information, support their desire to control their personal information and are responsive to their requests within bounds of technical feasibility and reasonability.

We recognise that data subjects’ expectations about fair and ethical use of their personal information are informed by the context in which their data was first collected. Where legally required (or practical, if there is no legal requirement), we seek permission before using personal information for new purposes that are incompatible with the original context in which it was collected.

We limit unnecessary sharing of personal information with third parties. We only allow sharing under controlled circumstances. Specifically, we only share with third parties if the personal information will be protected to the same standards that we use and where the sharing is consistent with the data subjects’ reasonable expectations.

We retain personal information only for as long as we need it. We have a defined time period in place that is tied to the purposes for which the personal information has been collected.

We ensure appropriate security. Although no systems can ever be rendered invulnerable to attack, we ensure that known threats are accounted for and that we implement administrative, technical, personnel and physical measures to safeguard personal information against loss, theft and unauthorised use or modification.

We engage with government responsibly. We ensure that we have procedures in place to handle government requests to access personal information in a consistent and lawful manner. We implement these principles in accordance with applicable data protection laws, in a manner consistent with our Group Legal Compliance Policy. Our Human Resources functions, through the full lifecycle of employee management, is accountable to our employees to uphold these same principles when they process employee personal information.