Data Protection, Cybersecurity and Records

1 Purpose

The purpose of this Policy is to reduce privacy, fraud, cyber, confidentiality and recordkeeping risk while allowing information to be used for legitimate business. Data should be collected, accessed, shared, retained and deleted in a controlled and proportionate way.

2 Scope and information principles

This Policy applies to directors, employees, consultants, devices, systems and service providers used for DE Trading business. It covers personal information, KYC records, contracts, pricing, banking data, communications, credentials and other confidential or regulated information.

Processing must have a lawful and legitimate purpose, use no more information than necessary, be accurate where material, remain secure and be retained only as long as required. Privacy notices, consent and individual rights must be handled according to the law applicable to the relevant entity and person.

3 Access use and sharing

Access should be limited to people who need the information for authorised work. Confidential information must not be discussed, copied or forwarded for personal use or disclosed outside DE Trading without authority, a legitimate purpose and appropriate safeguards.

Sensitive personal information, identity documents, beneficial-ownership records and bank details require additional care. Cross-border transfers and disclosures to service providers must comply with applicable law and use suitable contractual, technical or organisational protections.

• Verify recipients before sending confidential information and use an approved secure channel where available.
• Do not use personal cloud storage, shared credentials or unapproved public tools for confidential business information.
• Service providers with material access should be assessed for security, confidentiality, location and incident-response capability.

4 Cybersecurity baseline

DE Trading should maintain practical safeguards appropriate to its size, systems and information risk. Devices and accounts used for business must be protected against unauthorised access, malware, phishing and loss.

• Use unique strong passwords and multi-factor authentication wherever supported, especially for email, banking, cloud storage and administrator accounts.
• Keep operating systems, applications, browsers and security software supported and updated.
• Lock devices when unattended, use encryption where available and report lost or stolen devices immediately.
• Treat payment instructions, password-reset requests, unusual links and urgent requests as potential fraud and verify them independently.
• Back up critical records and periodically confirm that important information can be restored.
• Remove access promptly when a person's role changes or engagement ends.

5 Records and retention

Business records must be complete, accurate, searchable and stored in the approved location. The final contract, deal recap, due diligence, approvals, inspection documents, invoices, payment evidence and material correspondence should be retained together or linked through a reliable index.

A retention schedule should define periods by record type and jurisdiction. Records subject to a legal hold, investigation, audit, claim or regulatory request must not be altered or destroyed. At the end of the approved period, records should be securely deleted or destroyed unless another lawful reason requires retention.

• Personal information should not be kept indefinitely merely because storage is available.
• Versions and approvals of material policies and corporate records should be preserved.
• Messaging-platform communications that form part of a transaction or decision should be captured in the deal record.

6 Incidents and individual requests

Suspected phishing, unauthorised access, malware, misdirected email, lost devices, data leakage or payment fraud must be reported immediately to a Director or designated responsible person. The response should contain the event, preserve evidence, assess affected information and seek technical or legal advice where needed.

Regulatory and individual notification deadlines can be short. The relevant entity must determine notification duties under applicable law. Requests from individuals to access, correct, delete, restrict or object to use of their information should be logged and handled within applicable requirements.

7 Roles awareness and breaches

The Directors should approve this Policy and material exceptions. A Director or designated responsible person should coordinate access reviews, service-provider assessments, incident response, retention decisions and privacy requests. Each user is responsible for protecting credentials and information under their control.

Awareness should address phishing, payment fraud, confidential information, personal data and incident reporting. Deliberate misuse, concealment, unauthorised disclosure or repeated disregard of safeguards may result in withdrawal of access, contractual or disciplinary action and legal or regulatory escalation.

8 Review

This Policy should be reviewed at least annually and after a material incident, system change, new service provider, new jurisdiction or significant legal development.

Implementation note. This policy should be read with the other DE Trading corporate policies, transaction-specific approvals and the law applicable to the relevant contracting entity and transaction.