The DOMO Code of Conduct
Schedule 9
DATA PROTECTION AND PRIVACY POLICY Introduction The basic principles of GDPR (i.e. the European General Data Protection Regulation of 27 April 2016 which entered into application on 25 May 2018), the personal data of our employees that we process and our general rules of conduct regarding data protection are set out in this Schedule.
Where there are more specific or deviating local privacy laws and regulations applicable in the country of your employment, this policy will be adapted to the local legal requirements and a copy of the locally applicable data protection policy will be provided to you. This Schedule 9 only applies to our employees working in the European Union. For DOMO employees whose country of employment is outside the European Union, substantially similar data protection and privacy principles apply: any deviations or further specifications are set out in your locally applicable data protection policy. As a company we attach a great deal of importance to the privacy of our customers, suppliers and business partners but also to the privacy of our own employees.
Considering the importance of this subject we have drawn up this document so that any employee would be informed of: • • •
the major principles in data protection (see part 1); the personal data that we process from him/her (see part 2); the way he/she is to handle the personal data of others in a correct and safe manner in the execution of his/ her function within our company (see part 3).
1.
BASIC PRINCIPLES IN DATA PROTECTION. 1.1
What are personal data? Personal data are all the information relating to a natural person (“the person concerned”) that directly or indirectly is or can be identified. A few examples of personal data are: name, telephone number, photo, bank account number, etc. When it is possible to identify a natural person thanks to the combination of different information (such as: age, gender, diploma, marital status, town, salary, nationality, religious belief, health situation, etc.), such information is also considered as personal data. In certain circumstances data can also be considered ‘sensitive’. This is the case when the data relate to race or ethnical origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics, health, sexual behavior and criminal convictions and facts. The collecting and processing of these data is prohibited in principle and/or is only exceptionally permitted under very strict conditions.
44
