Version: 1.1
Last Amendment:

November 2023

Next Review:

November 2024

Data Protection Policy

IS08

Department:

Information Security
Contact:

infosec@keywordsstudios.com

To be read in conjunction with:

CONFIDENTIAL AND PROPRIETARYEXECUTIVE SUMMARY
1. For any business travel, reason should prevail. People should manage their bookings and expenses as if it was
their own money.
2. We shouldn’t travel if we don’t need to: that’s better for our finances and that’s better for the planet.
3. Where the Navan platform is available, its usage to manage travel and hotel bookings will be mandatory.
4. Seat reservation options can be flexible depending on your band in the Group, but by default, we should always
try to limit ourselves to economy classes.
5. All travel and expenses need to be approved by your manager. Please do so ahead of booking a new trip.
6. All exceptions to this policy should be approved by an ExCo member.

Document Title

Document No.

Version

IS08
Data Protection Policy

1.1

Last Revision Date

Nov 2023

Page 1 of 6

Document History
Date

VersionDescrip�on2020.12

1.1

Design updated/links added

CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.

AuthorEkaterinaUs�na

Document Title

Document No.

Version

IS08
Data Protection Policy

1.1

Last Revision Date

Nov 2023

Page 2 of 6

Table of Contents
1.

INTENT OF THIS POLICY ................................................................................................................................................... 3

2.

WHAT IS EXPECTED OF YOU ............................................................................................................................................ 3

3.

DETAILED POLICY STATEMENTS FOR PRIVACY AND DATA PROTECTION.......................................................................... 3

4.

ACCOUNTABILITY & COMPLIANCE .................................................................................................................................. 4

5.

DATA PROTECTION PRINCIPLES ....................................................................................................................................... 46.

GENERAL PROVISIONS..................................................................................................................................................... 5

7.

LAWFUL, FAIR AND TRANSPARENT PROCESSING ............................................................................................................ 5

8.

LAWFUL PURPOSES ......................................................................................................................................................... 5

9.

DATA MINIMIZATION ....................................................................................................................................................... 5

10. ACCURACY ....................................................................................................................................................................... 6
11. ARCHIVING / REMOVAL................................................................................................................................................... 6
12. SECURITY ......................................................................................................................................................................... 6
13. DATA BREACH .................................................................................................................................................................. 6

CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.

Document Title

Document No.

Version

IS08
Data Protection Policy

Last Revision Date

Nov 2023

1.

1.1
Page 3 of 6

PURPOSE
Keywords Studios, a data controller with reference to the personal data processed, needs to collect personal information toeffectively carry out our everyday business functions and activities and to provide the products and services defined by ourbusiness type.
Such data is collected from employees, customers, suppliers and clients and includes (but is not limited to), name, address, email
address, data of birth, IP address, identification numbers, private and confidential information, sensitive information andbank/credit card details.
In addition, we may be required to collect and use certain types of personal information to comply with the requirements ofworldwide data protection laws and/or regulations, however we are committed to processing all personal information inaccordance with the General Data Protection Regulation (GDPR) as Keywords chosen privacy framework and any other relevant
the data protection laws and codes of conduct (herein collectively referred to as “the data protection laws”).
The Company has developed policies, procedures, controls and measures to ensure maximum and continued compliance withthe data protection laws and principles, including staff training, procedure documents, audit measures and assessments.
Ensuring and maintaining the security and confidentiality of personal and/or special category data is one of our top priorities and
we are proud to operate a 'Privacy by Design' approach, assessing changes and their impact from the start and designing systems
and processes to protect personal information at the core of our business.
Please refer to the GDPR Article 4 for further GDPR definitions, GDPR Article 24 for more information regarding responsibilities
of Data Controllers and to GDPR Article 28 for more information regarding responsibilities of Data Processors.

2.

RESPONSIBILITIES••Management is expected to endorse, understand and promote Privacy across the organization.
All of Keywords Employees and Contractors are expected to respect Privacy practices, especially:i. Keeping all Keywords and client information strictly confidential.
ii. Protecting Keywords and client assets and infrastructure.
iii. Respecting corporate responsibilities, laws and regulations.
iv. Understanding your personal rights under the GDPR.
v. Respecting the GDPR principles and acting towards compliance with it.
vi. Completing all necessary Privacy training and workshops you’re enrolled to.
vii. Undertaking Data Protection Impact Assessments whether necessary.
•

Keywords Group Data Protection Manager together with the Information Security team are expected to define and support
privacy and security practices, including Policies at Keywords. They are also expected to manage and track official
exceptions to such regulations requirements and policies.

3. DETAILED POLICY STATEMENTS FOR PRIVACY AND DATA PROTECTION
3.1 PRIVACY LEADERSHIP• Keywords Group Data Protection Manager acts as Keywords’ acting Data Protection Officer; however, as Privacy stems frombusiness requirements, ultimate accountability for Privacy and Data Protection principles resides with business andcorporate leadership.
• As part of the Information Security Team, Keywords Group Data Protection Manager - under the responsibility of Global
Director of Security Operations – sets the Global Operations Director as responsible for defining and supporting Privacy andData Protection practices at Keywords.
3.2 POLICIES• Policies are produced by the Information Security team, submitted for review to Keywords leadership globally (Executive
management and Studio Heads), and approved by the Global Operations Director.
CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.

Document Title

Document No.

Version

IS08
Data Protection Policy

Last Revision Date

Nov 2023••

1.1
Page 4 of 6

Local policies can be defined and it will exist to enforce local laws – including local data protection laws, but cannot define
rules that are less strict than Global Security Policies. The process to define and review periodically Global Policies is definedand executed by the Information Security Team.
Exceptions to Policies must be managed adequately (listed, approved, followed-up) by teams responsible for granting them,typically Information Security.

4. ACCOUNTABILITY & COMPLIANCE
4.1 MAIN GOVERNANCE OBJECTIVES• Protect the rights of individuals with regards to the processing of personal information• Develop, implement and maintain a data protection policy, procedure, audit plan and training program for compliance withthe data protection laws
• Make sure that every business practice, function and process carried out by the Company, is monitored for compliance withthe data protection laws and its principles• Make sure that personal data is only processed where we have verified and met the lawfulness of processing requirements• Only process special category data in accordance with the GDPR requirements• Record consent at the time it is obtained and evidence such consent to the Supervisory Authority where requested• Allocate responsibility for data protection compliance and ensure that Keywords’ Group Data Protection Manager has
sufficient access, support and budget to perform the role
• Identify, create and disseminate the reporting lines within the data protection governance structure• Maintain a continuous program of monitoring, review and improvement with regards to compliance with the dataprotection laws and to identify gaps and non-compliance before they become a risk, affecting mitigating actions where
necessary• Monitor worldwide Supervisory Authority, European Data Protection Board (EDPB) and any GDPR and local data protection
laws news and updates, to stay abreast of changes, notifications and additional requirements
4.2 COMPLIANCE, EXCEPTIONS AND ENFORCEMENT• Non-compliance to this policy, including non-compliance with its intent can involve disciplinary measures, up to an
including termination and in appropriate cases, civil action or referral for criminal prosecution.
• As Information Security is in conflict of interest in the specific case of matters of governance, exception requests must be
addressed to the Global Operations Director.

5. DATA PROTECTION PRINCIPLES
Keywords Studios is committed to processing personal data in accordance with its responsibilities under the GDPR, which is thechosen worldwide privacy framework for Keywords, and applies to all of its subsidiaries regardless of geographical location orbusiness line.
Article 5 of the GDPR requires that personal data shall be:
•
•
•
•
•

processed lawfully, fairly and in a transparent manner in relation to individuals;
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible withthose purposes; further processing for archiving purposes in the public interest, scientific or historical research purposesor statistical purposes shall not be considered to be incompatible with the initial purposes;
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data thatare inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which
the personal data are processed; personal data may be stored for longer periods insofar as the personal data will beprocessed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical
CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.

Document Title

Document No.

Version

IS08
Data Protection Policy

Last Revision Date

Nov 2023•

1.1
Page 5 of 6

purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR inorder to safeguard the rights and freedoms of individuals; andprocessed in a manner that ensures appropriate security of the personal data, including protection against unauthorisedor unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational
measures.”6. GENERAL PROVISIONS•••This policy applies to all personal data processed by Keywords Studios.
Keywords Group Data Protection Manager shall take responsibility for Keywords Studios’s ongoing compliance with thispolicy and all tasks under the GDPR Article 39 (tasks of the data protection officer). KWS DPM can be directly reachedat dataprotectionmanager@keywordsstudios.com and/or privacy@keywordsstudios.com.
Keywords Studios, acting as a Data Controller shall abide to the Irish Data Protection Commissioner rules andrequirements as an organisation that processes personal data.

7. LAWFUL, FAIR AND TRANSPARENT PROCESSING•••

To ensure its processing of data is lawful, fair and transparent, as a requirement from the GDPR Article 30, Keywords
Studios shall maintain a complete Register of Processing Activities.
The Register of Processing Activities shall be reviewed at least annually and/or at every change to the way personal data
is processed e.g. in the event of a new system to be put in place.
As per the GDPR Chapter 3, individuals have rights Keywords Studios needs to respect, including the right to access theirpersonal data and any such requests made to Keywords Studios shall be dealt within 30 calendar days. All data subject
requests should be sent to KWS DPM for log and compliance purposes.

8. LAWFUL PURPOSES••••

All data processed by Keywords Studios must be done on one of the following lawful basis: consent, contract, legal
obligation, vital interests, public task or legitimate interests (see GDPR guidance for more information).
All lawful basis should be assessed case-by-case and the decision should be logged within the register of processing
activities. When decided to use legitimate interest as lawful basis, the legitimate interest guideline assessment should
be completed so any risks can be raised and properly logged.
Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept with thepersonal data.
Where communications are sent to individuals based on their consent, the option for the individual to revoke theirconsent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in
Keywords Studios’s systems.

9. DATA MINIMIZATION•••

Keywords Studios shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to
the purposes for which they are processed.
Our systems, employees, processes and activities are designed to limit the collection of personal information to thatwhich is directly relevant and necessary to accomplish the specified purpose. Data minimisation enables us to reduce
data protection risks and breaches and supports our compliance with the data protection laws.
Measures to ensure that only the necessary data is collected includes:i. Electronic collection (i.e. forms, website, surveys etc) only have the fields that are relevant to the purpose of collection
and subsequent processing. We do not include 'optional' fields, as optional denotes that it is not necessary to obtain
ii. Physical collection (i.e. face-to-face, telephone etc) is supported using scripts and internal forms where the required
data collection is ascertained using predefined fields. Again, only that which is relevant and necessary is collected

CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.

Document Title

Document No.

Version

IS08
Data Protection Policy

1.1

Last Revision Date

Nov 2023

Page 6 of 6iii. We have SLA's and bespoke agreements in place with third-party controllers who send us personal information(either in our capacity as a controller or processor). These state that only relevant and necessary data is to be provided
as it relates to the processing activity we are carrying out
iv. We have documented destruction procedures in place where a data subject or third-party provides us with personal
information that is surplus to requirement
v. Forms, contact pages and any documents used to collect personal information are reviewed from time to time toensure they are fit for purpose and only obtaining necessary personal information in relation to the legal basis being
relied on and the purpose of processing

10.ACCURACY••

Keywords Studios shall take reasonable steps to ensure personal data is accurate.
Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data
is kept up to date.

11.ARCHIVING / REMOVAL••To ensure that personal data is kept for no longer than necessary, Keywords Studios shall put in place an archiving policy(also commonly known as data retention policy) for each area in which personal data is processed and review thisprocess annually.
The archiving policy shall consider what data should/must be retained, for how long, and why.

12.SECURITY••••

Keywords Studios shall ensure that personal data is stored securely using modern software that is kept-up-to-date.
Access to personal data shall be limited to personnel who need access and appropriate security should be in place to
avoid unauthorised sharing of information.
When personal data is deleted this should be done safely such that the data is irrecoverable.
Appropriate back-up and disaster recovery solutions shall be in place.

13.DATA BREACH
In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of,or access to, personal data, following the necessary actions from Keywords’ Data Breach Policy, an email should be sent to the
InfoSec team alias (InfoSec@keywordsstudios.com) so the very next steps can be taken.
Keywords Studios shall promptly assess the risk to people’s rights and freedoms and, following the guidelines from GDPR Articles
33 and 34 - if appropriate - report breaches to the local Supervisory Authorities and/or Data Subjects.
End of document.

CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.