Introduction and Purpose

Island Energies (Holdings Limited and its affiliated and/or subsidiary companies (together, “Island Energies”, the “Group”, “we”, “us” or “our”) process personal data in the course of our business activities, including in relation to employees, customers, suppliers, business contacts, shareholders and visitors to our websites.

This Policy sets out the framework by which the Group ensures that personal data is collected, used, stored, shared and disposed of in compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the Cyprus Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of Such Data, and any other applicable data protection legislation in the jurisdictions in which the Group operates (together, “Data Protection Law”).

Compliance with Data Protection Law is a Board-level responsibility. This Policy is binding on all directors, officers, employees, workers, contractors, consultants and any third party engaged by the Group who process personal data on the Group’s behalf.

Scope

This Policy applies to all personal data processed by the Group, in any format (electronic, paper or otherwise), including personal data relating to:

• current, former and prospective employees, directors and officers;
• customers, clients and their representatives;
• suppliers, contractors and other business partners;
• shareholders and other stakeholders; and
• visitors to, and users of, the Group’s websites and digital platforms.

This Policy applies across all Group companies, functions and geographic locations. Where local law imposes stricter requirements than this Policy, the stricter requirement applies.

Key Definitions

Personal data means any information relating to an identified or identifiable natural person (a “data subject”).

Special category data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person’s sex life or sexual orientation.

Processing means any operation performed on personal data, such as collection, recording, storage, use, disclosure, or erasure.

Data controller means the entity that determines the purposes and means of processing personal data. The relevant Group entity is generally the data controller in respect of the personal data described in this Policy.

Data processor means a third party that processes personal data on behalf of, and under the instructions of, a data controller.

Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Data Protection Principles

The Group and all staff must comply with the following principles when processing personal data. Personal data must be:

• processed lawfully, fairly and in a transparent manner (“lawfulness, fairness and transparency”);
• collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes (“purpose limitation”);
• adequate, relevant and limited to what is necessary for the purposes for which it is processed (“data minimisation”);
• accurate and, where necessary, kept up to date (“accuracy”);
• kept in a form which permits identification of data subjects for no longer than is necessary (“storage limitation”);
• processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (“integrity and confidentiality”); and
• processed in a manner that allows the Group to demonstrate compliance with the above principles (“accountability”).

Lawful Basis for Processing

Before processing any personal data, the relevant Group entity must identify and document a lawful basis under Article 6 GDPR, being one of the following:

• the data subject has given consent;
• processing is necessary for the performance of a contract with the data subject, or to take steps at the data subject’s request prior to entering into a contract;
• processing is necessary for compliance with a legal obligation;
• processing is necessary to protect the vital interests of the data subject or another person;
• processing is necessary for the performance of a task carried out in the public interest; or
• processing is necessary for the purposes of legitimate interests pursued by the Group or a third party, except where such interests are overridden by the interests or fundamental rights of the data subject.

Where special category data is processed, an additional condition under Article 9 GDPR must also be identified and documented (for example, explicit consent, employment law obligations, or legal claims).

Roles and Responsibilities

Board of Directors
The Board has overall accountability for the Group’s compliance with Data Protection Law and for the adoption and resourcing of this Policy.

Data Protection Officer
The Group’s Data Protection Officer (“DPO”) is responsible for monitoring compliance with this Policy and Data Protection Law, advising on data protection obligations and Data Protection Impact Assessments, acting as the primary contact point for data subjects and the Office of the Commissioner for Personal Data Protection, and maintaining the Group’s Record of Processing Activities. The DPO can be contacted at dpo@islandenergies.com.

Department Heads and Data Owners
Department heads are responsible for ensuring that personal data processed within their function complies with this Policy, that processing activities under their control are recorded, and that appropriate contracts are in place with any third-party processors they engage.

All Staff
All directors, employees, workers and contractors must process personal data in accordance with this Policy, complete data protection training as required, and report any actual or suspected personal data breach to the DPO immediately and in any event within 24 hours of becoming aware of it.

Rights of Data Subjects

The Group must be able to facilitate the following rights, which data subjects may exercise free of charge (save in limited circumstances permitted by Data Protection Law):

• Right to be informed — to receive clear, transparent information about how personal data is used.
• Right of access — to obtain confirmation that data is being processed and a copy of that data.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure (“right to be forgotten”) — to have data deleted in certain circumstances.
• Right to restrict processing — to limit the way data is used in certain circumstances.
• Right to data portability — to receive certain data in a structured, machine-readable format.
• Right to object — to object to processing based on legitimate interests, direct marketing, or profiling.
• Rights related to automated decision-making and profiling — including the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects.

Requests should be directed to the DPO at dpo@islandenergies.com. The Group will respond within one calendar month of receipt, extendable by a further two months where the request is complex or numerous, in which case the data subject will be informed of the extension and the reasons for it within the first month. Identity verification may be required before a request is actioned.

Right of Rectification or Erasure

If we hold incorrect information about you, you have the right to have the data amended. You also have the right to have any information you have sent to us erased. To request your right to rectification and/or erasure please send your request to dpo@islandenergies.com. If you request erasure of your personal data all your data will be erased subject to the following important notice: We are not required to rectify or erase your data where to do so would prevent you from meeting your contractual obligations to us or where we are required to process (including retaining) your personal data for a lawful purpose in accordance with the Regulation.

Consent

Where consent is relied upon as the lawful basis for processing, it must be freely given, specific, informed and unambiguous, given by way of a clear affirmative act. Consent must be as easy to withdraw as it is to give, and a record of when and how consent was obtained must be kept. Consent will not be relied upon as the lawful basis where another basis is more appropriate, and pre-ticked boxes or inactivity will not be treated as valid consent.

Data Retention

Personal data will only be retained for as long as necessary to fulfil the purpose for which it was collected, or to comply with applicable legal, regulatory, tax or accounting requirements. The Group will maintain a data retention schedule setting out standard retention periods by data category, and personal data that is no longer required will be securely deleted or anonymised.

Data Security

The Group will implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, proportionate to the risk. These measures include, as appropriate:

• access controls and role-based permissions restricting access to personal data on a need-to-know basis;
• encryption or pseudonymisation of personal data where appropriate;
• secure storage of physical records and controlled disposal of confidential waste;
• regular testing and review of technical security measures; and
• mandatory data protection and information security training for staff.

International Data Transfers

Personal data will only be transferred outside the European Economic Area (“EEA”) where an appropriate safeguard is in place, being one of the following:

• the transfer is to a country benefiting from an adequacy decision of the European Commission;
• the transfer is subject to the European Commission’s Standard Contractual Clauses (“SCCs”), supplemented where necessary by additional technical, contractual and organisational measures following a transfer risk assessment;
• in the case of transfers to the United States, the recipient’s self-certification under the EU-U.S. Data Privacy Framework (which replaced the invalidated EU-U.S. Privacy Shield); or
• another derogation permitted under Article 49 GDPR applies in the specific circumstances.

The DPO must be consulted before any new category of international transfer is put in place, and international transfers must be recorded in the Group’s Record of Processing Activities.

Data Protection Impact Assessments

A Data Protection Impact Assessment (“DPIA”) will be carried out before undertaking any processing that is likely to result in a high risk to the rights and freedoms of individuals, such as large-scale processing of special category data, systematic monitoring of a publicly accessible area, or the use of new technologies. The DPO must be consulted on, and sign off, all DPIAs, and any residual high risk identified must be referred to the Office of the Commissioner for Personal Data Protection for prior consultation.

Personal Data Breach Management

Any actual or suspected personal data breach must be reported to the DPO immediately upon discovery. The DPO will assess the breach and, where it is likely to result in a risk to the rights and freedoms of individuals, will notify the Office of the Commissioner for Personal Data Protection without undue delay and, where feasible, within 72 hours of the Group becoming aware of it. Where the breach is likely to result in a high risk to individuals, affected data subjects will also be notified without undue delay. All breaches, whether notifiable or not, will be recorded in the Group’s data breach register.

Processors and Third Parties

Before engaging any third party to process personal data on the Group’s behalf, appropriate due diligence must be carried out on that party’s data protection and security practices. A written Data Processing Agreement complying with Article 28 GDPR must be entered into with every processor, setting out the subject matter, duration, nature and purpose of processing, the categories of personal data and data subjects, and the processor’s obligations, including in respect of sub-processing, security, assistance with data subject rights, breach notification, and deletion or return of data on termination.

Record of Processing Activities

The Group will maintain a written Record of Processing Activities in accordance with Article 30 GDPR, covering, for each processing activity, the purposes of processing, categories of data subjects and personal data, categories of recipients, details of any international transfers and safeguards, retention periods, and a general description of security measures. This record will be reviewed and updated at least annually and made available to the Office of the Commissioner for Personal Data Protection upon request.

Training and Awareness

All staff who process personal data will receive data protection training upon induction and on a periodic basis thereafter. Staff in roles with elevated data protection responsibilities (for example, HR, IT, Marketing and Legal) will receive additional role-specific training.

Complaints and Supervisory Authority

Any individual who is not satisfied with how the Group has handled their personal data, or a request relating to it, may lodge a complaint with the Group’s DPO at dpo@islandenergies.com. Data subjects also have the right to lodge a complaint directly with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or with the supervisory authority of their habitual residence, place of work, or place of the alleged infringement.

Breach of this Policy

Failure by any employee, worker or contractor to comply with this Policy may result in disciplinary action, up to and including dismissal, and may expose the individual and/or the Group to regulatory enforcement action, including administrative fines of up to €20 million or 4% of annual worldwide turnover, whichever is higher.

Policy Review

This Policy will be reviewed by the DPO at least annually, and updated as necessary to reflect changes in Data Protection Law, regulatory guidance, or the Group’s processing activities. Material changes require Board approval.