The Brooker Group PCL

Privacy Policy​

The Company respects the privacy of its customers, shareholders, employees and everyone connected with the Company. To ensure that their rights are fully protected under personal data protection law, the Board of Directors of The Brooker Group Public Company Limited has approved this Company Privacy Policy, so that the Company has clear and appropriate rules, mechanisms, supervisory measures and management for personal data.

  1. Scope
    • This Privacy Policy applies to the Company, the Company's employees, and any person who processes personal data on the Company's instructions or on its behalf.
  2. Definitions
    1. Company means The Brooker Group Public Company Limited and its subsidiaries.
    2. Processing means any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, use, disclosure, transmission, dissemination, transfer, combination, erasure or destruction.
    3. Personal Data means information relating to a natural person which makes that person identifiable, directly or indirectly, such as name, surname, e-mail address, telephone number, IP address, photographs, race, religion, political opinions, genetic data and biometric data.
    4. Data Subject means the natural person whom personal data identifies, directly or indirectly.
    5. Data Controller means a natural or juristic person with the power and duty to make decisions about the processing of personal data.
    6. Data Processor means a natural or juristic person who processes personal data on the instructions or on behalf of a data controller.
  3. Privacy Policy: Personal Data Protection Governance
    1. The Company will put in place a personal data governance structure that sets appropriate methods and measures for complying with the law, as follows:
      1. Define an organisational structure, including the roles, missions and responsibilities of the relevant units and staff, so that there are clear mechanisms for the supervision, control, accountability, operation, enforcement and monitoring of personal data protection measures in line with the law and this Policy.
      2. Appoint a Brooker Data Protection Officer, with the roles and duties set out in this Policy.
    2. The Company will prepare policies, standards, guidelines, procedures and other documents relating to personal data protection in line with the law and this Policy.
    3. The Company will maintain a policy management process to ensure that this Policy is followed.
    4. The Company will train its employees regularly so that they understand the importance of personal data protection, and to ensure that every employee concerned has been trained, understands personal data protection and complies with this Policy.
  4. Privacy Policy: Personal Data Processing
    1. The Company will process personal data, whether as a data controller or a data processor, lawfully, fairly and transparently, with regard to the accuracy of the data. The purposes of processing and the retention period will be limited to what is necessary for lawful purposes and the Company's way of doing business, and the Company will adequately maintain the confidentiality, integrity and security of personal data.
    2. The Company will maintain processes and controls to manage personal data at every stage in line with the law and this Policy.
    3. The Company will prepare and keep records of processing covering the items and activities involved in the processing of personal data as required by law, and will update them whenever those items or activities change.
    4. The Company will maintain clear processes to ensure that privacy notices stating the purposes of collection and the details of processing, and requests for the data subject's consent, comply with the law, together with measures to supervise and audit them.
    5. The Company will maintain mechanisms to verify the accuracy of personal data and to correct it.
    6. Where the Company sends, transfers or allows another party to use personal data, the Company will enter into an agreement with the recipient or user setting out rights and duties in line with the law and this Policy.
    7. Where the Company sends or transfers personal data abroad, the Company will comply with the law.
    8. The Company will destroy personal data at the end of its retention period, in line with the law and the Company's way of doing business.
    9. The Company will assess risks and put in place measures to mitigate them and to reduce the impact on the processing of personal data.
  5. Privacy Policy: Data Subject Rights
    • The Company will provide measures, channels and methods for data subjects to exercise their rights as provided by law, and will record and evaluate its responses to data subjects' requests.
  6. Privacy Policy: Personal Data Security
    1. The Company will maintain adequate security measures for personal data and will act to prevent leaks of personal data and its unauthorised use.
    2. The Company will maintain a Privacy Incident Management Policy and an Incident Response Program so that incidents involving personal data can be identified and handled promptly.
    3. The Company will maintain processes for notifying data subjects, government officials, the data controller (where the Company is a data processor or a joint controller) and other persons, as required by law.
  7. Privacy Policy: Compliance with Personal Data Protection Measures
    1. The Company will maintain a process for monitoring changes in the law and will keep its personal data protection measures up to date and compliant.
    2. The Company will regularly review and update its policies, standards, guidelines, procedures and other documents relating to personal data protection so that they stay current and in line with the law and the circumstances of the time.
  8. Roles, Duties and Responsibilities
    1. The Board of Directors has the following roles, duties and responsibilities:
      1. Oversee the establishment of the Company's personal data governance structure and related internal controls, so that the law and this Policy are complied with.
      2. Supervise and support the Company in protecting personal data effectively and in line with the law.
    2. Privacy Committee: the Company's Risk Management Committee acts as the Privacy Committee, with the following roles, duties and responsibilities:
      1. Establish the personal data governance structure and related internal controls, including the Privacy Incident Management Policy and the Incident Response Program, so that incidents involving personal data can be identified and handled at once.
      2. Assess how effectively this Policy is complied with and report the assessment to the Board of Directors at least once a year, and ensure that risks relating to personal data are managed and have appropriate risk management guidelines.
      3. Set and review standards and guidelines so that the Company's operations comply with the law and this Policy.
      4. Appoint the Company's Data Protection Officer.
    3. Management is responsible for monitoring and ensuring that the units under its supervision comply with this Policy, and for promoting awareness among the Company's employees.
    4. The Company's Data Protection Officer has the roles, duties and responsibilities set by law, including the following:
      1. Report the state of personal data protection to the Privacy Committee regularly and make recommendations to keep the Company's personal data protection current and compliant with the law.
      2. Advise the Company's employees on compliance with the law and this Policy.
      3. Audit the operations of the Company's units for compliance with the law and this Policy.
    5. The Company's employees have the following roles, duties and responsibilities:
      1. Comply with this Policy and the standards, guidelines, procedures and other documents relating to personal data protection.
      2. Report incidents relating to personal data protection, and any non-compliance with the law or this Policy, to their supervisor.
  9. Penalties for Non-compliance with this Policy
    • Failure to comply with this Policy may constitute an offence subject to disciplinary action and to the penalties provided by law.

Cookies and website analytics

Our website uses cookies. Necessary cookies keep the site working. With your consent, given in the cookie notice on your first visit, we also use analytics cookies to understand how the site is used: a visitor counter hosted on our own servers, and Google Analytics, a service of Google LLC. Analytics data is collected in aggregate and is not used to identify you. You can withdraw your consent at any time under “Cookie Settings”; Google describes its handling of data in the Google Privacy Policy.

This Privacy Policy takes effect from 1 May 2020 by resolution of the Board of Directors of The Brooker Group Public Company Limited.