Privacy policy

This is the Privacy Standard/Policy of the HAE GROUP LIMITED and its associated subsidiaries. This Privacy Standard/Policy has been updated to reflect the EU GDPR laws and obligations adopted in May 2018 and the UK GDPR adopted in December 2020, including the jurisdictional boundaries and adaptation of data protection practices that meet the specific obligations outlined by each framework.

HAE Group Data Protection Policy 2025–2027

1. Interpretation

Company Name: HAE Group Limited together with all associated subsidiaries in the EEA.

Company Personnel: All employees, workers, contractors, agency workers, consultants, directors, members and others.

Consent: Agreement which must be freely given, specific, informed and be an unambiguous indication of the Data Subject's wishes by which they, by a statement or by a clear positive action, signify agreement to the Processing of Personal Data relating to them.

Data Controller: The person or organisation that determines when, why and how to process Personal Data. It is responsible for establishing practices and policies in line with GDPR. The Company is the Data Controller of all Personal Data relating to Company Personnel and Personal Data used in its business for its own commercial purposes.

Data Subject: A living, identified or identifiable individual about whom Personal Data is held. Data Subjects may be nationals or residents of any country and may have legal rights regarding their Personal Data.

Data Protection Impact Assessment (DPIA): Tools and assessments used to identify and reduce risks of a data processing activity. DPIAs can be carried out as part of Privacy by Design and should be conducted for all major system or business change programmes involving the Processing of Personal Data.

Data Protection Officer (DPO): The person required to be appointed in specific circumstances under GDPR. Where a mandatory DPO has not been appointed, this term means a data protection manager or other voluntary appointment of a DPO or refers to the Company's data privacy team with responsibility for data protection compliance.

EEA: The 27 countries in the EU, and Iceland, Liechtenstein and Norway.

Explicit Consent: Consent which requires a very clear and specific statement and not merely an action.

General Data Protection Regulation (GDPR): The General Data Protection Regulation (EU) 2016/679. Personal Data is subject to the legal safeguards specified in GDPR.

Personal Data: Any information identifying a Data Subject or relating to a Data Subject that can be identified directly or indirectly. Personal Data includes Sensitive Personal Data and Pseudonymised Personal Data but excludes anonymous data or data where identity has been permanently removed.

Personal Data Breach: Any act or omission that compromises the security, confidentiality, integrity or availability of Personal Data or the safeguards in place to protect it. Loss, unauthorised access, disclosure or acquisition of Personal Data constitutes a Personal Data Breach.

Privacy by Design: Implementing appropriate technical and organisational measures in an effective manner to ensure compliance with GDPR.

Privacy Notices: Notices setting out information that may be provided to Data Subjects when the Company collects information about them.

Processing: Any activity involving the use of Personal Data, including obtaining, recording, organising, storing, retrieving, using, disclosing, erasing, destroying or transferring it.

Pseudonymisation: Replacing information that identifies an individual with artificial identifiers so the individual cannot be identified without additional information held separately and securely.

Sensitive Personal Data: Information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health information, sexual orientation, biometric or genetic data, and information relating to criminal offences and convictions.

2. Introduction

This Privacy Standard sets out how HAE Group Limited and its subsidiaries handle the Personal Data of customers, suppliers, employees, workers and other third parties.

This Privacy Standard applies to all Personal Data processed by the Company regardless of the medium in which it is stored or whether it relates to current or former employees, workers, customers, suppliers, shareholders, website users or any other Data Subject.

This Privacy Standard applies to all Company Personnel. Personnel must read, understand and comply with this Privacy Standard when Processing Personal Data on behalf of the Company and attend training on its requirements.

Compliance with this Privacy Standard is mandatory. Any breach may result in disciplinary action.

3. Scope

The Company recognises that correct and lawful treatment of Personal Data is essential to maintaining confidence and supporting successful business operations.

Protecting the confidentiality and integrity of Personal Data is a critical responsibility.

The Company is exposed to potential GDPR fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, depending on the nature of the breach.

All heads of department are responsible for ensuring compliance and implementing appropriate practices, processes, controls and training.

The DPO is responsible for overseeing this Privacy Standard and developing related policies and privacy guidance where applicable.

Company Personnel must contact the DPO if they are unsure about:

(a) the lawful basis for Processing Personal Data;

(b) reliance on Consent or Explicit Consent;

(c) drafting Privacy Notices;

(d) retention periods;

(e) required security measures;

(f) a Personal Data Breach;

(g) transfers outside the EEA or the UK;

(h) Data Subject rights requests;

(i) significant new or changed Processing activities;

(j) direct marketing compliance; or

(k) contracts and arrangements involving third-party data sharing.

4. Personal Data Protection Principles

The Company adheres to GDPR principles requiring that Personal Data is:

(a) Processed lawfully, fairly and transparently.

(b) Collected only for specified, explicit and legitimate purposes.

(c) Adequate, relevant and limited to what is necessary.

(d) Accurate and kept up to date.

(e) Not retained longer than necessary.

(f) Processed securely and confidentially.

(g) Not transferred internationally without appropriate safeguards.

(h) Made available to Data Subjects exercising their rights.

The Company is accountable for demonstrating compliance with these principles.

5. Lawfulness, Fairness and Transparency

5.1 Lawfulness and Fairness

Personal Data must be Processed lawfully, fairly and transparently.

The Company may process Personal Data where:

(a) the Data Subject has given Consent;

(b) processing is necessary to perform a contract;

(c) processing is required to meet legal obligations;

(d) processing protects vital interests; or

(e) processing is necessary for legitimate interests that are not overridden by Data Subject rights and freedoms.

The legal basis relied upon must be identified and documented for each processing activity.

5.2 Consent

A Data Controller may process Personal Data on one or more lawful bases, including Consent.

Consent must be a clear affirmative action. Silence, inactivity or pre-ticked boxes are unlikely to be sufficient.

Consent must be capable of being withdrawn at any time and withdrawals must be honoured promptly.

Where Sensitive Personal Data is involved, Explicit Consent is usually required unless another lawful basis applies.

Records of Consent must be maintained to demonstrate compliance.

5.3 Transparency

Data Controllers must provide clear and accessible information to Data Subjects through appropriate Privacy Notices.

When collecting Personal Data directly, the Company must inform Data Subjects about:

• the identity of the Data Controller and DPO;

• how and why information will be used;

• disclosure arrangements;

• security measures; and

• retention arrangements.

Where data is obtained indirectly, equivalent information must be provided as soon as possible and the Company must verify that collection by the third party was lawful.

6. Purpose Limitation

Personal Data must only be collected for specified, explicit and legitimate purposes.

Personal Data must not be used for incompatible purposes unless the Data Subject has been informed and Consent obtained where required.

7. Data Minimisation

Personal Data must be adequate, relevant and limited to what is necessary.

Personnel may only process Personal Data where required for their duties.

Only the information necessary for legitimate business purposes should be collected.

When Personal Data is no longer needed, it must be deleted or anonymised in accordance with Company retention guidelines.

8. Accuracy

Personal Data must be accurate and kept up to date.

Inaccurate or outdated information must be corrected or deleted without delay.

Personnel are responsible for checking data accuracy at collection and at appropriate intervals thereafter.

9. Storage Limitation

Personal Data must not be retained in identifiable form longer than necessary.

The Company maintains retention policies and procedures to ensure information is deleted appropriately unless legal requirements dictate otherwise.

Personnel must follow all retention and erasure guidance and ensure Data Subjects are informed of applicable retention periods.

10. Security, Integrity and Confidentiality

10.1 Protecting Personal Data

Personal Data must be secured through appropriate technical and organisational measures.

Neville Karai
HAE Global Limited