We do the right thing.
In writing.

1. Purpose

ThiaraX Limited and its group subsidiaries (together, the Group) are committed to protecting the personal data of all individuals with whom we interact, including clients, candidates, suppliers, partners and employees, in a manner that is lawful, transparent and respectful of individual rights.

This policy sets out the Group's approach to data protection and privacy in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all personal data processed by any entity within the ThiaraX Group, regardless of the format in which that data is held.

2. Scope

This policy applies to:

• All ThiaraX Group entities, including all current and future subsidiaries.
• All individuals working for or on behalf of the Group, including employees, contractors, consultants and associates.
• All personal data processed by the Group in connection with its business activities, whether held digitally or in physical form.

3. Definitions

For the purposes of this policy:

Personal data

Any information relating to an identified or identifiable natural person. This includes, but is not limited to, names, contact details, identification numbers, location data, and any factors specific to the physical, economic, cultural or social identity of that person.

Special category data

Personal data that is particularly sensitive and therefore requires a higher level of protection. This includes data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sexual orientation.

Processing

Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, erasure or destruction.

Data subject

The individual to whom personal data relates.

Data controller

The entity that determines the purposes and means of processing personal data. ThiaraX Limited and its subsidiaries act as data controllers in respect of the personal data they process.

Data processor

Any entity that processes personal data on behalf of a data controller.

Data Protection Officer (DPO)

The individual appointed to oversee the Group's data protection strategy and ensure compliance with applicable law.

Data Protection Impact Assessment (DPIA)

A process designed to identify and minimise the data protection risks of high-risk processing activities.

Record of Processing Activities (ROPA)

The formal register, maintained pursuant to Article 30 of the UK GDPR, documenting all personal data processing activities carried out by the Group.

4. Data Protection Principles

The Group is committed to processing personal data in accordance with the following principles, as set out in Article 5 of the UK GDPR:

4.1 Lawfulness, fairness and transparency

Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Individuals will be informed of how their data is being used at the point of collection.

4.2 Purpose limitation

Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. We do not use data collected for one purpose to fulfil an unrelated objective.

4.3 Data minimisation

Personal data collected shall be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. The Group does not collect data it does not need.

4.4 Accuracy

Personal data shall be accurate and, where necessary, kept up to date. Every reasonable step will be taken to ensure that inaccurate personal data is erased or corrected without delay.

4.5 Storage limitation

Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed. Retention periods are set out in the Group's Data Retention Schedule.

4.6 Integrity and confidentiality

Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage. The Group implements appropriate technical and organisational measures to achieve this.

4.7 Accountability

The Group takes responsibility for compliance with these principles and maintains appropriate records and documentation to demonstrate that compliance.

5. Lawful Basis for Processing

The Group will only process personal data where a lawful basis exists. The lawful bases relied upon by the Group include:

5.1 Consent

Where the data subject has given clear and specific consent to the processing of their personal data for one or more specific purposes. Consent may be withdrawn at any time.

5.2 Contract

Where processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

5.3 Legal obligation

Where processing is necessary for compliance with a legal obligation to which the Group is subject.

5.4 Legitimate interests

Where processing is necessary for the purposes of the legitimate interests pursued by the Group or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Where special category data is processed, the Group will identify and document an additional condition for processing as required under Article 9 of the UK GDPR.

6. Individual Rights

The Group respects and upholds the rights of data subjects under UK GDPR. These rights include:

6.1 Right of access

Data subjects may request confirmation of whether the Group holds personal data about them and, if so, access to that data and related information.

6.2 Right to rectification

Data subjects may request correction of inaccurate or incomplete personal data held about them.

6.3 Right to erasure

Data subjects may request deletion of their personal data where there is no compelling reason for its continued processing.

6.4 Right to restrict processing

Data subjects may request that processing of their personal data is restricted in certain circumstances.

6.5 Right to data portability

Data subjects may request receipt of their personal data in a structured, commonly used and machine-readable format, and may request transmission of that data to another controller where technically feasible.

6.6 Right to object

Data subjects may object to processing based on legitimate interests or for direct marketing purposes.

6.7 Rights in relation to automated decision-making

Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.

Requests in relation to any of the above rights should be submitted in writing to the Data Protection Officer. The Group will respond within one calendar month of receipt.

7. Data Protection Officer

The Group appoints a Data Protection Officer (DPO) to oversee compliance with this policy and applicable data protection law. The DPO is responsible for:

• Monitoring the Group's compliance with the UK GDPR and the Data Protection Act 2018.
• Advising on Data Protection Impact Assessments and high-risk processing activities.
• Acting as the primary point of contact for data subjects exercising their rights.
• Liaising with the Information Commissioner's Office on behalf of the Group.
• Maintaining and reviewing the Group's Record of Processing Activities.
• Providing data protection training and guidance across the Group.

The DPO may be an internal appointment or an external specialist engaged for this purpose. The identity and contact details of the current DPO will be maintained on the Group's internal policy register and communicated to all relevant individuals. Where the Group does not yet meet the threshold for a mandatory DPO appointment under UK GDPR, the Chief Executive assumes this function until a formal appointment is made.

8. Record of Processing Activities (ROPA)

In accordance with Article 30 of the UK GDPR, the Group maintains a formal Record of Processing Activities (ROPA). The ROPA documents all personal data processing activities carried out by the Group and each subsidiary, and includes the following information for each processing activity:

• The name and contact details of the data controller and, where applicable, the DPO.
• The purposes of the processing.
• A description of the categories of data subjects and personal data processed.
• The categories of recipients to whom personal data has been or will be disclosed.
• Details of any transfers of personal data to third countries or international organisations.
• The envisaged retention periods for each category of data.
• A description of the technical and organisational security measures in place.

The ROPA is maintained by the DPO and reviewed on a quarterly basis, or immediately upon any material change to processing activities. It is available for inspection by the Information Commissioner's Office upon request.

9. Data Protection Impact Assessments (DPIAs)

The Group will conduct a Data Protection Impact Assessment (DPIA) prior to commencing any processing activity that is likely to result in a high risk to the rights and freedoms of individuals. A DPIA is required where processing involves:

• Systematic and extensive profiling or automated decision-making with significant effects.
• Large-scale processing of special category data or criminal conviction data.
• Systematic monitoring of a publicly accessible area.
• Use of new technologies or novel processing methods where the privacy impact is uncertain.
• Processing that involves vulnerable individuals, including candidates and employees.
• Any other processing identified by the DPO as presenting a high risk.

Where a DPIA identifies a residual high risk that cannot be mitigated, the Group will consult with the Information Commissioner's Office prior to commencing processing. All DPIAs will be documented and retained as part of the Group's compliance records.

10. Data Security

The Group maintains appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure. These measures include:

• Access controls and role-based permissions on all systems holding personal data.
• Encryption of personal data in transit and at rest where technically feasible.
• Regular review of systems and processes holding or processing personal data.
• Secure disposal of personal data and physical documents containing personal data.
• Incident response procedures in the event of a data breach.

All individuals working for or on behalf of the Group are required to handle personal data in accordance with this policy and any supporting guidelines issued by the DPO.

11. Data Breaches

In the event of a personal data breach, the Group will:

• Contain the breach and assess the risk to individuals as a matter of urgency.
• Where the breach is likely to result in a risk to the rights and freedoms of individuals, notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.
• Where the breach is likely to result in a high risk to the rights and freedoms of individuals, notify affected data subjects without undue delay.
• Document all breaches, including those that do not require notification, in the Group's Data Breach Register.

Any individual who becomes aware of a suspected or actual data breach must report it to the DPO immediately.

12. Third Parties and Data Processors

Where the Group engages third parties to process personal data on its behalf, it will ensure that:

• Appropriate due diligence is carried out prior to engagement.
• A written data processing agreement is in place that meets the requirements of Article 28 of the UK GDPR.
• Third party processors provide sufficient guarantees regarding their technical and organisational measures.
• Personal data is not transferred to third parties outside the UK without appropriate safeguards in place.

13. International Data Transfers

The Group will not transfer personal data outside the United Kingdom unless one of the following conditions is met:

• The transfer is to a country deemed to provide an adequate level of protection by the UK Government.
• Appropriate safeguards are in place, such as standard contractual clauses approved for use under UK law.
• The data subject has given explicit informed consent to the transfer.
• The transfer is necessary for the performance of a contract with the data subject.

14. Retention of Personal Data

Personal data will not be retained for longer than is necessary for the purpose for which it was collected. The Group maintains a Data Retention Schedule which sets out the applicable retention periods for each category of personal data processed across the Group.

At the end of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction.

15. Responsibilities

15.1 Chief Executive

The Chief Executive holds ultimate accountability for data protection across the Group and is responsible for ensuring that adequate resources are allocated to data protection compliance.

15.2 Data Protection Officer

The DPO is responsible for day-to-day oversight of data protection compliance, maintaining the ROPA, conducting and overseeing DPIAs, and acting as the primary contact for data subjects and the ICO.

15.3 All individuals working for the Group

Every person working for or on behalf of the Group is responsible for handling personal data in accordance with this policy, completing any required data protection training, and reporting any suspected breaches to the DPO immediately.

15.4 Subsidiary leads

As the Group grows and subsidiary leadership is appointed, subsidiary leads will be responsible for ensuring compliance with this policy within their respective entities, for maintaining subsidiary-level processing records, and for escalating any data protection concerns to the DPO.

16. Training and Awareness

All individuals working for or on behalf of the Group will receive appropriate data protection training commensurate with their role and access to personal data. Training will be provided upon commencement of work with the Group and refreshed on an annual basis. The DPO will maintain records of training completed across the Group.

17. Complaints

Any individual who believes that the Group has not handled their personal data in accordance with this policy or applicable law has the right to raise a complaint. Complaints should be submitted in writing to the DPO in the first instance.

Individuals also have the right to lodge a complaint directly with the Information Commissioner's Office at any time:

18. Policy Review

This policy will be reviewed annually by the DPO and Chief Executive, or sooner in the event of material changes to applicable law, regulatory guidance, or the Group's business activities. Any material amendments will be communicated to all relevant individuals and the version history updated accordingly.

This policy has been approved by Cameron Thiara, Chief Executive and Director of ThiaraX Limited, and applies across all entities within the ThiaraX Group.