- Protection of Intellectual Property and Critical Business Information
Overview:
- Description: This policy is describing Guiding principles on Policy for management and protection of information used by all affiliates. It communicates objective, defines the scope of information addressed, and defines actions to be taken to protect information that affiliates use to conduct their business.
It sets a guideline for management and protection of information that might otherwise lead to a negative impact on the interests of the affiliate and its employees.
Affiliates are expected to adopt similar policy that conforms to the policy principles, legal requirements, and customary practices in their operating areas.
- Application: All employees (modifications only as required by country law)
- Stakeholders:
- Responsibilities (Process owner): Human Resources
- Accountability: Huma Resources
- Consultation: Legal
- Information: All employees and Contractors’ staff
Policy Statement:
Company Confidential Information:
For the Company, its confidential information is a valuable asset and every director, employee and agent of the Company must protect it. Confidential information includes all non-public information. It also includes personal information (regardless of its source) that we obtain in the course of business. We must take care that all confidential information is used for Company business purposes only and in case of personal information, in addition, it must be processed on instructions from the Company in accordance with laid out policies, procedures and guidelines and as per applicable privacy laws and regulations.
Upon joining our company, all employees sign a Confidentiality and Nondisclosure Agreement which details their confidentiality obligations to the Company. As employees, we have access to significant amounts of company information that may not be available to the public, and we should preserve the confidentiality of information obtained in the Company’s service. Information of a confidential, private and sensitive nature must be used responsibly and controlled and protected to prevent its prohibited, arbitrary or careless disclosure.
Unless the Company has provided its specific consent, which should preferably be in writing, or there is a legal or professional right or duty to disclose, we are prohibited from disclosing confidential Company information. Confidential or proprietary information about clients, our organization, or other parties, which has been gained through employment or affiliation with our company, may not be used for personal advantage or for the benefit of third parties.
Our Information Security Policy sets out the expectations on each of us to safeguard confidential information of OLA Energy and our third parties with the assurance of security, availability, integrity and confidentiality. The Acceptable Usage Policy provides the purposes for which OLA Energy IT resources may be legitimately used and our cybersecurity responsibilities. These policies together provide employees with the mandatory directive of safeguarding OLA Energy and client information. Our Company Privacy Policy sets out the expectations on each of us to process personal information belonging to our employees, clients, agents, consultants, suppliers, and contractors in a manner so as to ensure compliance with all applicable privacy laws and regulations, including processing through cross border data transfer between group entities. Unless authorized and contractually agreed, we are committed to protect the confidentiality of such personal information while processing such personal information, implement adequate technical and organizational measures and employees are made aware of and required to comply with mandated processes under Privacy Policy for responsible use, disclosure, storage, retaining or any other processing of such personal information.
Improper Opportunities
When we receive information as part of our job, we should not trade with it for our personal benefit. Neither should we pass on the information to our friends and family members or indirectly compete with the Company. Information obtained as part of our job should not be taken advantage of even after we leave the organization.
Classification of the information
Classified information should be clearly labelled by its originator and protected by recipients in a manner consistent with these guidelines and any other procedures issued by management. Information and materials (including visually transmitted information) that is not labelled in accordance with these guidelines and procedures is termed “unclassified information”. The absence of labelling does not indicate that the information may be disclosed or used outside the company. Employees are required to take reasonable steps to protect such unclassified information from inappropriate disclosure and use (including asking the originator to review its classification, where appropriate).
Business management may choose to add additional document labeling, particularly to communicate protection expectations related to third parties or joint ventures. For example, the term “Confidential” may be used to establish Company intellectual property rights for information shared with universities and research partners. While incremental labeling is at business management discretion, the base classification level should be clear.
All information should be considered for classification using the structure below and appropriately safeguarded against unauthorized actions, whether accidental or intentional. Furthermore, any information which, if inappropriately disclosed, modified or lost, could result in significant negative consequences to the Company on a competitive, legal or productivity basis is considered sensitive and should be classified as either Company Proprietary or Private based upon the following descriptions:
Proprietary
Materials containing sensitive operational, financial or technical information such as strategic business plans, supply chain strategy, and assessment of the competitive position. Some organization charts and research results may warrant this classification should they provide insights to strategic business plans and activities
Private
Sensitive personnel data relating to individual employees such as salary data, performance appraisal, potential, medical history, pre-employment background screening reports. This information must be handled in compliance with the Management and Protection of Information guidelines.
Company Use Only
Information that does not qualify as Proprietary or Private, but for which special attention is warranted prior to release outside the company may be classified as Company Use Only. Examples include telephone directories, some technical guidelines, some meeting agendas or notes, and training modules, etc. While not requiring the level of protection warranted by the categories above, discretion and judgment should be used in handling information bearing this classification.
Restricted Distribution
Extremely sensitive information may be further identified as “Restricted Distribution.”
For example:
Company Proprietary – Restricted Distribution
Company Private – Restricted Distribution
This designation is intended to prevent reproduction or forward without the authorization, or the authorization of an individual at a higher organizational level who is familiar with such information.
Privileged and Confidential
Used at the direction of and in compliance with guidance issued by the Law and Tax segments to designate attorney work product, attorney-client communications, and other privileged communications. Handling requirements are similar to those defined for Company Proprietary.
Roles and responsibilities
Management is responsible for ensuring compliance with the MPI policy and standards by their business unit. They provide guidance for the originators, owners, and users of information, including contractual arrangements with third parties, to ensure appropriate classification, handling, and reclassification/declassification.
The roles and responsibilities of people manipulating the information include the following:
Originators are responsible for determining the level of sensitivity of information, classifying and labelling it, accordingly, establishing distribution/declassification requirements, and complying with requirements for release of information outside the company. Management also designates owners of information, communicates requirements to staff, and monitors employee compliance.
Owners are responsible for periodic review of information classification and implementation of appropriate control measures
Employees and contractors are responsible for properly handling information and making appropriate arrangements for safeguarding information with third parties to whom information is transmitted. Such information includes, but is not limited to, financial, technical, and personnel information regardless of media form, whether written, electronic, magnetic, oral, or any other means, and whether being used, transmitted or stored. Recipients of classified information may not change classification levels and must provide protection consistent with that classification. Recipients of inappropriately classified information should notify originators, owners, or management.
Human Resources and Medical Unit
Focal points within the Human Resources and Medical Unit (where applicable) define requirements and provide guidance for handling Private information. HR and Medical Units also own respectively information generated by HR processes (e.g. performance appraisal, salary budgeting, medical appeals) and by Medical processes (e.g. fitness for duty reports).
Law and Tax
The Law and Tax Units provide specific guidance for protecting and designating information as Privileged and Confidential, as well as guidance on proper internal and external releases of information.
Research and Engineering
Research and engineering organizations are responsible for the oversight of research agreements that facilitate development, sharing, and licensing of technical research and engineering information among operating affiliates. They provide guidance on the proper internal and external release of technical information covered by the agreements and endorse intellectual property agreements that may affect research agreement rights and obligations.
Information technology (IT)
Information technology provides the services for storing electronic information. In support of MPI, IT Units maintain controls as outlined in service descriptions and service control statements. They provide end-user tools, training, and consulting expertise for risk-assessment processes and current electronic barriers. They provide support, as needed, in the investigation of incidents. IT maintains an electronic repository of the MPI policy and standard, handling guidelines, and awareness documents.
Public Affairs
Public Affairs provide guidance for the release of information through public appearances, speeches, news releases or any other disclosure to identify possible sensitivities associated with the event and ensure that communications activities are aligned with the Company’s business objectives. They maintain Public Statement Guidelines to provide guidance in preparation for public presentations.
Company Intellectual Property
The intellectual property (IP) of the Company must be protected as a vital business asset. Our IP portfolio includes copyrights, patents, trademarks, service marks, trade secrets, design rights, logos, brands and know-how. We must use our IP focusing on protecting these assets. It is important to ensure that to the extent permitted by law, the rights to all IP created using the Company’s time and expense that which are within the scope of our duties are assigned to and are the property of the Company. We should promptly disclose any works, inventions or developments we create to obtain legal protection over them.
Classification Guide and Handling Matrix Preparation
A classification guide provides the functional or business unit originators and owners of information with a tool for identifying, analyzing, classifying, declassifying, and handling classified information initially and on-going. The implementation of specific control point options is based on the level of classification, the assessment of risks, and the control point alternatives.
The MPI guidelines should be reviewed periodically and changed appropriately to meet the changing business environment, as well as to leverage more cost-effective safeguards as they evolve. The general approach for building a classification guide is as follows:
Identify the types of business unit information processed (e.g., financial, operational, technical, production, or sales) as well as the owners of this information. Determine whether third-party information is involved and what contractual restrictions may exist for that information.
For information not subject to third-party commitments, assess the value of the information, evaluate the impact to the company if this information was to become unavailable, inappropriately disclosed or compromised, and determine the likelihood of an incident occurring. Examples of impact include lost revenue, increased costs, financial liabilities incurred, and/or adverse publicity.
Prepare the classification guide to help determine the classification levels and control points that are most appropriate.
Implement handling procedures and control points that are tailored to business requirements and commensurate with the classification of information and level of risk. Be sure to include special contract requirements for third-party information.
Business units also have the flexibility to deploy powerful protection measures (such as encryption) as a means for streamlining control points, as well as deal with special circumstances such as extremely high volumes of information, abbreviated time schedules, etc.
Plan for declassification/reclassification (to include determination of the expiration of the classification and its re-labelling.)
- Protection of Employee Information
Overview:
- Description: This policy is describing Guiding principles on protection of employee information used by the Group. It Communicates objective, defines the scope of information addressed, and defines actions to be taken to protect information about employees. It sets a guideline for management and protection of employee privacy.
Affiliates are expected to adopt similar policy that conforms to the policy principles, legal requirements, and customary practices in their operating areas.
Policy Statement:
In this age of the Internet where privacy has become an increasing concern, we take your privacy very seriously. The privacy and security of personal data (the “Personal Information”) is important to us.
By being an employee of OLA Energy, you acknowledge that you have read, understood and agreed to all the terms of this Privacy Policy as outlined below in the last page of the Code of Business Conduct.
- Collection of Information:
In the course of conducting business and complying with local regulations governing such matters as employment, tax, insurance, etc., we must collect Personal Information from you. The nature of the Information collected varies somewhat for each employee, depending on your employment responsibilities, your citizenship, the location of the facility where you work, and other factors.
We collect Personal Information from you solely for business purposes, including those related directly to your employment with the Company, and those required by local governmental agencies such as Tax authorities, Ministry of Labor.
Data collected may include, but is not limited to:
- Your name
- User ID(s)
- Phone numbers
- Email address (es)
- Mailing addresses
- Banking and other financial data
- Government identification numbers, e.g., Social Security number, ID number
- Date of birth
- Gender
- Health and disability data
- Family-related data, e.g., marital status,
- Personal and health – related data for you and your family
The Company will not knowingly collect or use Personal Data in any manner not consistent with this Policy.
Because the Personal Information collected by the Company is necessary for business purposes, you are required to provide it. Your refusal or failure to provide the requested Personal Information may, therefore, disqualify you from employment or from receipt or enjoyment of certain Company benefits.
- Use of collected information
The objectives of collecting, storing and using employee Personal information include, but are not limited to:
- Human Resources Management:
Personal Information is collected, stored, analyzed, and shared (internally) in order to attract, retain and motivate a highly qualified workforce.
This includes recruiting, compensation and benefits administration, succession planning, reorganization, performance assessment and management, training, compliance with applicable legal requirements, and communication with employees and/or their representatives.
- Business Processes and Management:
Personal Information is used to run our business operations including, for example: scheduling work assignments, managing company assets, reporting and / releasing public data (e.g., Annual Reports, etc.); and populating employee directories.
Information may also be used to comply with local government regulations.
- Safety, Health and Security Management:
Personal Information is used as appropriate to ensure safety, health and protection of our employees, assets, resources, and communities.
- Communication and Identification:
Personal Information is used to identify employees and to communicate with them.
The Company acts to protect Personal Information and ensure that unauthorized individuals do not have access to Information by using security measures to protect Personal Information.
It is not permitted to knowingly disclose, sell or otherwise distribute Personal Information to any third party without employee knowledge and, where appropriate, express written permission, except under the following circumstances.
- Legal requests and investigations:
The company may disclose Personal Information when such disclosure is reasonably necessary (i) to prevent fraud; (ii) to comply with any applicable statute, law, rule or regulation; or (iii) to comply with a court order.
- Third-party vendors and service providers:
The company may, from time to time, outsource services, functions, or operations of our business to third -party service providers. When engaging in such outsourcing, it may be necessary for us to disclose Personal Information to those service providers, e.g., a payroll service, a benefits provider. In some cases, the service providers may collect Personal Information directly from employees.
Service provider agreements are inclusive of clauses to restrict how the providers may access, use and disclose your Information. When using a third party provider, the company selects reliable third parties and written agreements are signed to ensure (i) the rights and obligations of each party are specified; (ii) that the third party has adequate security measures in place to protect the Personal Information; and (iii) the provider will only process Personal Information on the specific written instructions of the Company.
During the employment period, company may buy other companies, create new subsidiaries or business units or sell part or all of its assets. It is likely that some or all of Personal Information will be transferred to another company as part of any such transaction. However, Personal Information will remain subject to protection outlined in the Privacy Policy.
- Protection of Company and Other:
Personal Information may be released when release is necessary to comply with the law; enforce or apply policies and other agreements; or protect the rights, property, or safety of Company, health of our employees, or others. This disclosure will never, however, include selling, renting, sharing or otherwise disclosing Personal Information for commercial purposes in violation of the commitments set forth in this Privacy Policy.
- Security of Personal Information
The Company implements reasonable security measures and technologies, such as password protection, encryption, physical locks, etc., to protect the confidentiality of Personal Information.
Only authorized employees have access to Personal Information. Below are some safeguards to help protect such Information:
- Paper and other hard copy containing Personal Information (or any other confidential information) should be secured in a locked location when not in use.
- Computers and other access points should be secured when not in use by logging out or locking.
- Passwords and user ID’s should be guarded and not shared.
- When no longer necessary for business purposes, paper and hard copies should be immediately destroyed using paper shredders or similar devices.
- Do not leave copies in unsecured locations waiting to be shredded or otherwise destroyed.
- Do not make or distribute unauthorized copies of documents or other tangible medium containing personal data.
- Electronic files containing Personal Information should only be stored on secure computers and not copied or otherwise shared with unauthorized individuals within or outside of Company.
Compliance with this Privacy Policy is important to the Company. Any violation or potential violation of this Policy should be reported to the Human Resources Department. The failure by any employee to follow these privacy policies may result in discipline up to and including termination of the employee.
Any questions or suggestions regarding this policy may also be directed to the Human Resources Department.
- Protection of Company’s Assets
Overview:
- Description: This policy is describing Guiding principles for the protection of company assets
Affiliates are expected to adopt similar policy that conforms to the policy principles, legal requirements, and customary practices in their operating areas.
Policy Statement:
We are all obligated to protect the Company’s assets and to ensure their careful and legitimate use. Our assets include resources such as office supplies, equipment, communications systems and vehicles, as well as proprietary information, intellectual property, financial resources and information. Theft, wasteful use of resources, and fraudulent activities are detrimental to our Company objectives and are prohibited.
Examples of fraudulent activities include, but are not limited to:
- Physical Access Control
- Misuse of Company Assets
- Abuse of Expense Claims
- Physical Access Control
OLA energy has developed procedures covering physical access control to ensure privacy of communications, maintenance of the security of the Company communication equipment, and safeguard Company assets from theft, misuse and destruction. We are responsible for complying with the security policies in your location. You must not defeat or cause to defeat the purpose for which the access control was implemented.
The use of the company assets for individual profit or any unlawful, unauthorized personal or unethical purpose is prohibited. Our information technology, intellectual property (e.g., copyrights, patents, and trademarks), facilities, equipment, machines, software, and cash may be used for business purposes only, including responsible and accurate expense reimbursement, and in accordance with applicable policies. Other assets (e.g., computers, printers, and copiers) may be used for minor and incidental personal purposes provided such use is kept to a minimum, and does not create any significant incremental costs, interfere with work duties, or violate any laws or Infosys policies. The use of any company resources for personal political activities is prohibited. Computer hardware, software, data, and facilities are valuable resources that need protection from potential destruction, theft, or misuse. These resources may also include confidential client or OLA Energy information that requires safeguarding. It is your responsibility to prevent unauthorized access through the use of ID badges, passwords, or other security codes, and physical security measures (such as using computer cable locks, not leaving computers unattended in cars, and other normal precautions). Software used in connection with the business of OLA Energy should be properly licensed and used only in accordance with that license. Using unlicensed software could constitute copyright infringement and may be grounds for disciplinary action.
In a reasonable manner and for Business use only, employees are enabled to claim back expenses they incurred on behalf of the company.
Each supervisor, manager, and individual employee has an obligation to each other and to the Company to comply with the company business expenses and reimbursement policies and practices. All business-related expense claims must be authorized by your manager before being incurred. Personal expenses will not be reimbursed by the Company
- Social Media and External Communication
Overview:
- Description: This policy is describing Guiding principles for external communication and the use of Social Media
Affiliates are expected to adopt similar policy that conforms to the policy principles, legal requirements, and customary practices in their operating areas.
Policy Statement:
Employees and representatives of OLA Energy are expected to demonstrate best practices and appropriate etiquette on social media, including but not limited to the following:
- Be respectful to all,
- No hate or racist speech,
- No confidential company info disclosure
- No negative reaction even on negative comments
- No use of personal social media account on behalf of the company
Guidelines for employees:
- How to respond to Customer Inquiries?
Employees are not expected to engage on Social media on behalf of the company, customer inquiries should be redirected to brand and communications unit for response.
- How to react to Questionable content
Employees are not expected to react or fight negative comments when coming across misinformation, news leaks, confidential information, or other questionable content regarding the company on social media. Only authorised spokesperson who have received proper media training should handle this with the approval of Brand and communications department.
- When do I need approval to post a message on social media?
Personal social media accounts must not be used for business purposes as it only represents the person’s own views and perspectives.
Social media networks, blogs and other types of online content sometimes generate press and media attention or legal questions. Employees should refer these inquiries to authorized spokespersons.
- What should I do on social media during a PR crisis?
Employees are not expected to react on behalf of the company, during PR crisis, OLA Energy Crisis Management Plans are in force.
- Can I share company results on Social Media?
Employees are not allowed to disclose information that are financial, operational and legal in nature, as well as any information that pertains to clients and customers
Consequences of Breach:
Social media use shouldn’t interfere with employee’s responsibilities; OLA Energy’s computer systems are to be used for business purposes only. When using computer systems, use of social media for business purposes is allowed (ex: Facebook, Twitter and LinkedIn), but personal use of social media networks or personal blogging of online content is discouraged and could result in disciplinary action.
Failure to comply with the social media policy may lead to employee termination.