Confidentiality and Data Protection Policy

INTRODUCTION

Pan Nation Energy FZCO (“Pan Nation Energy”) is committed to protecting the confidentiality and security of proprietary data and information throughout all aspects of our business. Whether handling our own sensitive information or managing data entrusted to us by our partners and clients, Pan Nation Energy upholds stringent standards to ensure that all data is managed and safeguarded in accordance with applicable laws and internal policies.

As a global provider of petro-chemical products and services, Pan Nation Energy often deals with proprietary information, intellectual property, and commercial data, which are vital to our operations and essential to maintaining trust with our clients and partners. This Confidentiality and Data Protection Policy (“Policy”) outlines the principles and controls that Pan Nation Energy follows to ensure the responsible management, protection, and retention of confidential and proprietary data, while complying with relevant laws and regulations in every market where we operate.

This Policy establishes a robust framework for protecting the confidentiality of information, preventing unauthorised access, and safeguarding the intellectual property rights of Pan Nation Energy and our business partners. Our goal is to promote a culture of diligence, transparency, and accountability, ensuring that the handling of all sensitive information is performed in a manner that mitigates risks and supports the sustainable success of Pan Nation Energy. These principles are consistent with the values set out in Pan Nation Energy’s Code of Conduct.

Compliance with this Policy is mandatory for all employees, contractors, and third-party representatives of Pan Nation Energy, regardless of location or role within the organisation. All personnel must ensure that they understand and apply this Policy when accessing, processing, or sharing proprietary data and information. Any actions that violate the principles of this Policy will be subject to disciplinary measures, up to and including termination of employment or business relationships, and may result in legal liability.

Pan Nation Energy recognises that the security and integrity of proprietary information are critical to maintaining our competitive edge and fulfilling our obligations to clients and partners. We continuously review and update this Policy to reflect the evolving regulatory landscape and incorporate best practices for data protection and intellectual property management. Any person unsure of how to proceed in a situation not specifically addressed by this Policy is required to seek guidance from the Compliance Department or the Legal Department before taking any further action.

Our commitment to confidentiality and data protection is a cornerstone of how we operate, reinforcing our reputation as a trusted and reliable partner in the global energy and petro-chemical industry.

DEFINITIONS

1. “Confidential Information”

Refers to any proprietary, technical, business, or financial information, including intellectual property, business strategies, technical data, trade secrets, pricing, commercial proposals, or any other information that is not publicly known and could cause harm to Pan Nation Energy or its business partners if disclosed without authorisation. Confidential Information also includes data shared with Pan Nation Energy by clients, suppliers, and third parties under confidentiality agreements or obligations.

2. “Data Protection Legislation”

Means the various laws and regulations that govern the protection, processing, and management of personal and proprietary data in all jurisdictions where Pan Nation Energy operates. These include, but are not limited to, the General Data Protection Regulation (GDPR) in the European Union, the UK Data Protection Act 2018 (DPA), the UAE Federal Decree Law No. 45 of 2021 regarding Personal Data Protection, the People’s Republic of China Personal Information Protection Law (PIPL), applicable US state and federal privacy laws, and any other local or regional data protection and confidentiality laws applicable to Pan Nation Energy’s operations.

3. “Data Controller”

Refers to any Pan Nation Energy employee or department that determines, alone or jointly with others, the purposes and means of processing confidential or proprietary data on behalf of Pan Nation Energy.

4. “Data Processor”

Any Pan Nation Energy employee, contractor, or third party, including vendors or service providers, who processes data on behalf of Pan Nation Energy and under the direct authority of the Data Controller, ensuring that all processing activities comply with Pan Nation Energy’s data protection policies and applicable laws.

5. “Data Subject”

An individual whose personal or proprietary data is collected, stored, or processed by Pan Nation Energy. This may include Pan Nation Energy employees, clients, suppliers, business partners, and other stakeholders with whom Pan Nation Energy has business relationships.

6. “Personal Data”

Any information relating to an identified or identifiable individual, such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual. In the context of Pan Nation Energy, this may also extend to sensitive business data that requires protection.

7. “Proprietary Data”

Information that belongs to Pan Nation Energy or its business partners, which includes but is not limited to intellectual property, business plans, commercial documents, project proposals, pricing strategies, or any other data that provides competitive advantage and must be kept confidential to prevent unauthorised use or disclosure.

8. “Processing”

Any operation or set of operations performed on confidential information or personal data, whether by automated or manual means. This includes activities such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction of data.

9. “Personal Data Breach”

Any incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data or confidential information transmitted, stored, or otherwise processed by Pan Nation Energy or its third-party processors. This includes both digital and physical breaches.

10. “Special Category Data” or Sensitive Data

Refers to data that reveals or relates to an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health information, or data concerning an individual’s sex life or sexual orientation. In the Pan Nation Energy context, this also includes proprietary commercial data or intellectual property that, if disclosed, could harm Pan Nation Energy or its stakeholders.

11. “Intellectual Property”

Refers to patents, trademarks, copyrights, designs, inventions, processes, technical specifications, research and development data, commercial know-how, and any other proprietary information that constitutes the intellectual assets of Pan Nation Energy or its business partners.

12. “Consent”

The freely given, specific, informed, and unambiguous permission expressed by a Data Subject, indicating agreement to the processing of their personal data. Consent must be documented and can be withdrawn at any time. For proprietary data, consent may include permissions provided through contracts or agreements between Pan Nation Energy and its clients or partners.

13. “Data Minimisation”

The principle of processing only the minimum amount of data necessary for the specific purpose for which it was collected, ensuring that Pan Nation Energy does not collect or store more information than is required to fulfil its operational or contractual obligations.

14. “Recipient”

The person, entity, or third party to whom personal or proprietary data is disclosed, shared, or transferred. This may include clients, partners, service providers, regulatory authorities, or other entities involved in the processing or management of data on behalf of Pan Nation Energy.

15. “Data Anonymisation”

The process of removing or obscuring personal identifiers from data so that the information can no longer be attributed to a specific Data Subject, thereby ensuring the data cannot be linked back to an individual or entity.

16. “Data Pseudonymisation”

The processing of personal data in such a manner that the data can no longer be attributed to a specific Data Subject without the use of additional information, which is kept separately and protected by technical and organisational measures to prevent re-identification.

PURPOSE AND APPLICABILITY

The purpose of this Confidentiality and Data Protection Policy is to establish the principles and procedures necessary to ensure that Pan Nation Energy FZCO (“Pan Nation Energy”) manages, protects, and retains all proprietary, confidential, and personal data in compliance with applicable laws and internal standards. This Policy outlines the obligations of Pan Nation Energy as a data controller, data processor, and custodian of proprietary information, ensuring that all business activities involving data are conducted lawfully and with the highest degree of integrity and transparency.

Pan Nation Energy is responsible for upholding and demonstrating compliance with the following principles in all its data handling and confidentiality practices:

1. Protection of Confidential and Proprietary Information: This Policy sets the guidelines for protecting Pan Nation Energy’s proprietary data and intellectual property, as well as confidential information shared by clients, business partners, and suppliers. By ensuring robust data management and security controls, Pan Nation Energy safeguards sensitive commercial information from unauthorised access, misuse, or disclosure, thereby maintaining the trust and confidence of its stakeholders.
2. Compliance with Legal Obligations: Pan Nation Energy adheres to all applicable data protection legislation and regulatory requirements, including but not limited to the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the UAE Personal Data Protection Law, the PRC Personal Information Protection Law (PIPL), and relevant trade and sanctions regulations. This Policy serves as a framework for compliance, addressing obligations related to data processing, retention, security, and transfer, while supporting Pan Nation Energy’s role as both a data controller and a data processor.
3. Limiting Data Retention and Ensuring Data Integrity: The Policy establishes limits on data retention to ensure that personal and proprietary information is retained only for as long as necessary to fulfil legitimate business needs or comply with legal requirements. This reduces the risk of data breaches and supports the efficient management of data throughout its lifecycle.
4. Transparency and Rights of Data Subjects: Pan Nation Energy is committed to informing data subjects about its data processing activities and ensuring that their rights are protected, including the right to access, correct, or erase their personal data as provided by applicable laws. For proprietary business data, Pan Nation Energy ensures that all parties involved understand how data will be managed and protected through clear contractual agreements.
5. Data Security and Breach Management: Pan Nation Energy implements technical and organisational measures to ensure the confidentiality, integrity, and availability of data. In the event of a data breach or suspected violation of this Policy, Pan Nation Energy has established procedures for prompt detection, reporting, and resolution, minimising potential damage and ensuring compliance with legal requirements.

Applicability

This Policy applies to all functional departments, business units, employees, contractors, and third-party representatives of Pan Nation Energy, regardless of location. It governs all activities related to the collection, use, storage, transmission, and destruction of confidential, proprietary, and personal data within Pan Nation Energy and with external stakeholders.

All personnel are required to comply with the minimum requirements set forth in this Policy, as well as any additional local regulations or contractual obligations that impose stricter standards. Where local laws or regulations impose more stringent requirements than those outlined in this Policy, the stricter requirements shall take precedence. Compliance with this Policy is mandatory and monitored by Pan Nation Energy ‘s Compliance Department. Any breach of this Policy or failure to adhere to its requirements may result in disciplinary action, up to and including termination of employment or contractual agreements, and may lead to legal consequences.

This Policy serves as a foundation for Pan Nation Energy’s approach to confidentiality and data protection, but it does not cover every possible scenario or specific requirement that may arise. Detailed guidance and information on data protection and retention will be provided by the Compliance Department through supplementary materials, regular training, and ongoing consultations to ensure that all personnel understand their responsibilities and how to apply this Policy in practice. If there is any uncertainty regarding compliance with this Policy, employees are encouraged to seek clarification from the Compliance Department or Legal Department before proceeding.

DATA PROTECTION AND RETENTION PRINCIPLES

Processing of Proprietary and Confidential Information

Pan Nation Energy ensures that all proprietary, confidential, and personal data disclosed to or collected by the company are processed and managed according to the following principles:

1. Lawfulness, Fairness, and Transparency: All data must be processed lawfully, fairly, and in a transparent manner, with clear communication to the data subjects or stakeholders on how their data will be used, stored, and protected.
2. Purpose Limitation: Data must be collected for specified, explicit, and legitimate business purposes that are consistent with Pan Nation Energy’s operational needs and contractual obligations. Proprietary and confidential information shall only be used in accordance with these predefined purposes, and no additional uses are permitted without appropriate authorisation and documentation.
3. Data Minimisation: The processing and retention of data should be adequate, relevant, and limited to what is necessary for the purposes for which the data was collected or is being used. This includes minimising access to proprietary and confidential information and ensuring that only personnel with a legitimate need have access to such data.
4. Accuracy and Integrity: Pan Nation Energy is committed to ensuring that all data, including proprietary information and commercial documentation, is accurate, up-to-date, and relevant for its intended purposes. Any inaccuracies must be corrected promptly, and reasonable steps must be taken to verify the accuracy of critical data elements.
5. Storage Limitation: Data, whether personal, proprietary, or confidential, must not be kept for longer than is necessary for the purposes for which it was collected. Pan Nation Energy reviews the retention periods for different types of data regularly to ensure compliance with legal and operational requirements. Unnecessary data should be deleted or anonymised as soon as it is no longer needed.
6. Integrity and Confidentiality: Proprietary and confidential information must be handled in a manner that ensures its security and integrity, protecting it from unauthorised access, disclosure, alteration, or destruction. Appropriate technical and organisational measures must be implemented to safeguard data, both during processing and in storage.
7. Sensitive Data Processing: Sensitive data, such as confidential commercial terms, trade secrets, or other proprietary information, must only be processed if:
8. The data subject or stakeholder has given explicit consent;
9. It is necessary for compliance with legal obligations or the performance of a contractual agreement;
10. The data has been made manifestly public by the data subject or stakeholder; or
11. Appropriate safeguards are in place to ensure the security and confidentiality of such data.

Transfer of Proprietary and Confidential Information

Proprietary and confidential information may only be transferred within Pan Nation Energy or to third parties under the following conditions:

1. Internal Transfers: Information may be shared within Pan Nation Energy only if it is necessary for the performance of business activities or contractual obligations, and only the minimal amount of data required for such tasks shall be transferred. All recipients of proprietary or confidential information within Pan Nation Energy are required to handle the data in compliance with this Policy.
2. External Transfers: Transfers of proprietary or confidential information to external entities, such as regulatory authorities, clients, or partners, must be conducted in accordance with applicable laws and contractual agreements, ensuring that the recipient has appropriate safeguards in place to maintain the confidentiality and security of the data.
3. Transfer Restrictions: Proprietary information may only be transferred to third parties outside of Pan Nation Energy if:
4. The transfer is necessary for the execution of a contractual agreement or the provision of services;
5. The concerned individual or entity has explicitly consented to the transfer;
6. The transfer is required to fulfil legal obligations or protect the vital interests of Pan Nation Energy or its stakeholders.
7. Data Processor Requirements: If Pan Nation Energy engages third-party data processors to handle proprietary or confidential information on its behalf, these processors must demonstrate adequate safeguards and comply with Pan Nation Energy’s data protection requirements. Appropriate contractual agreements must be in place to ensure ongoing compliance with the terms of this Policy.

Data Retention

Pan Nation Energy adheres to strict data retention guidelines to ensure that all data, whether personal, proprietary, or confidential, is retained only for as long as necessary:

1. Retention Periods: The retention periods for different categories of data will be defined based on legal, contractual, and operational requirements. These periods will be regularly reviewed to ensure they remain appropriate and comply with applicable laws.
2. Review and Deletion: Data that no longer serves a legitimate business purpose or has exceeded its defined retention period will be securely deleted or anonymised. Where applicable, employees must conduct periodic reviews of stored data to identify information that should be deleted or archived.
3. Data Disposal: Upon the expiry of the retention period or at the request of a data subject, personal, proprietary, or confidential data will be deleted, destroyed, or otherwise securely disposed of. This process includes:
4. Electronic Data: Permanently deleting data stored electronically, including all backups, in a manner that prevents retrieval or reconstruction.
5. Hardcopy Data: Shredding or securely disposing of data stored in hard form (e.g., paper copies, physical records) to prevent unauthorised access or recovery.

Data Disposal

Data disposal is a critical part of Pan Nation Energy’s data management strategy. It ensures that all information, once it has reached the end of its retention period or is no longer needed, is disposed of securely:

1. Electronic Data Disposal:
2. All electronic data and backups must be securely and permanently deleted, using methods that prevent data retrieval. This includes removing data from hard drives, cloud storage, and other digital media.
3. Hardcopy Data Disposal:
4. All data stored in hard form, including paper copies, printed documents, and physical records, must be shredded or otherwise disposed of using secure methods to ensure that it cannot be reconstructed or retrieved.

ORGANISATIONAL MEASURES

The following organisational measures are implemented within Pan Nation Energy to protect the security of proprietary, confidential, and personal data:

1. Awareness and Responsibility: All employees, managers, directors, contractors, and third-party representatives working on behalf of Pan Nation Energy must be fully aware of their individual responsibilities as well as Pan Nation Energy’s responsibilities under applicable data protection legislation and this Confidentiality and Data Protection Policy. Access to facilities and locations where any confidential or commercial data is stored is restricted; personal devices and recording equipment must not be used in such areas without prior authorisation.
2. Access Control: Access to proprietary, confidential, or personal data is granted only to employees and third parties who require it to perform their specific duties. All personnel must adhere to the principles of data minimisation and must not access or use data beyond what is necessary for their roles.
3. Training and Supervision: Employees and third parties handling proprietary or confidential information are required to undergo ongoing training on data protection and security measures to ensure compliance. Regular supervision and performance evaluations are conducted to confirm adherence to Pan Nation Energy’s data protection principles.
4. Data Handling Protocols: Employees and representatives must exercise caution and discretion when discussing, sharing, or processing confidential or proprietary information. Conversations regarding such information should be conducted in secure settings, and data should never be discussed in public or unsecured areas.
5. Regular Reviews and Audits: The methods for collecting, processing, and holding confidential and proprietary data are reviewed semi-annually or whenever necessary. Performance evaluations of individuals handling such information are conducted quarterly to ensure compliance and identify areas for improvement.
6. Contractual Compliance: All employees, contractors, and third parties handling proprietary or confidential information must be contractually bound to comply with Pan Nation Energy’s Confidentiality and Data Protection Policy. Non-compliance with this Policy or relevant data protection legislation may result in disciplinary action, termination of contract, and legal liabilities.
7. Sub-Contractor Management: Any sub-contractors or third parties processing data on behalf of Pan Nation Energy must ensure that their personnel are held to the same standards as Pan Nation Energy employees. They must demonstrate compliance with data protection legislation and agree to indemnify Pan Nation Energy against any breaches or violations resulting from their activities.
8. Consequences for Non-Compliance: Any failure by employees, contractors, or third parties to comply with this Policy or data protection obligations will result in appropriate disciplinary measures, which may include suspension, termination, and potential legal action.

TECHNICAL MEASURES

Pan Nation Energy employs the following technical measures to safeguard the security, integrity, and confidentiality of proprietary, confidential, and personal data:

1. Encryption and Secure Transmission: All electronic communications containing proprietary or confidential information must be encrypted and transferred using secure methods. Emails containing sensitive data must be marked as “confidential” and transmitted over secure networks.
2. Secure Data Storage: All electronic data must be stored on secure servers that are protected by firewalls, encryption, and access controls. Data stored on physical media (e.g., USB drives, external hard drives) must be encrypted and stored in locked, access-restricted compartments.
3. Secure Physical Handling of Data: Confidential and proprietary data transferred in hardcopy form (e.g., paper copies) should be handed directly to the intended recipient or transmitted using secure, traceable methods. Any physical data storage or transmission must be conducted in containers clearly marked as “confidential.”
4. Access Restrictions and Device Security: Computers and devices used to access or process proprietary and confidential data must be password-protected and locked when unattended. Personal devices must not be used for storing or accessing Pan Nation Energy data, and only authorised devices are permitted for data processing.
5. Data Sharing Protocols: No proprietary or confidential data may be shared informally or with unauthorised individuals. If access to data is required, a formal request must be made and approved by the Chief Compliance Officer or the designated data manager.
6. Password Management: Passwords protecting confidential data must be secure, randomly generated, and changed at least quarterly. Passwords must never be shared or written down. In case of a forgotten password, it must be reset using the established secure process.
7. Data Backup and Recovery: All electronic data must be regularly backed up, with backups stored in secure, off-site locations that are access-restricted. Backups must be encrypted and protected by strong passwords to prevent unauthorised access.
8. Software and System Updates: All software used by Pan Nation Energy, including operating systems and applications, must be kept up-to-date. Security-related updates must be installed as soon as they become available to protect against vulnerabilities.
9. Data Handling Protocols for Portable Media: No proprietary or confidential data should be transferred to or stored on portable media (e.g., USB drives) unless absolutely necessary. If such transfer is required, the media must be encrypted, and the data must be deleted after use.
10. Controlled Data Transfers: Data may not be transferred to third parties, contractors, or external entities without prior authorisation and appropriate safeguards. Data must only be transferred in compliance with Pan Nation Energy’s Confidentiality and Data Protection Policy and applicable legislation.
11. Disposal of Data: Data that is no longer needed or has reached the end of its retention period must be securely disposed of. Electronic data should be permanently deleted using secure erasure methods, while hardcopy data must be shredded and securely disposed of to prevent reconstruction or unauthorised access.
12. Incident Reporting and Management: Any suspected data breach or security incident must be reported immediately to the Compliance Department or the Chief Compliance Officer. Pan Nation Energy has established procedures for investigating, managing, and mitigating the impact of data breaches to ensure prompt resolution and compliance with legal requirements.

DATA CONTROLLER

1. The Data Controller for Pan Nation Energy Pan Nation Petro-Chemical Co. Ltd is the Compliance Director, who can be contacted at compliance@chim-pn.com. The Compliance Director is responsible for overseeing the implementation and monitoring of this Confidentiality and Data Protection Policy across the organisation.
2. The Data Controller ensures that Pan Nation Energy complies with all relevant data protection legislation, including applicable local regulations, the EU GDPR, the UK Data Protection Act, and the PRC Personal Information Protection Law, as well as with internal data protection and confidentiality policies. This includes ensuring that the principles outlined in this Policy are adhered to by all employees, contractors, and third-party representatives, and that data handling practices reflect Pan Nation Energy’s commitment to secure, transparent, and responsible data management.
3. The Data Controller is directly responsible for managing the retention and disposal of proprietary, confidential, and personal data in accordance with the retention periods and guidelines defined in this Policy. This includes ensuring that data is not kept for longer than necessary and that data disposal is conducted securely and appropriately.
4. Any questions, concerns, or requests regarding this Policy, data retention practices, data protection compliance, or any other related matters should be directed to the Data Controller. Employees and third parties are encouraged to seek clarification or report any concerns to the Data Controller without delay to ensure full compliance and support continuous improvement in data management practices.

NON-COMPLIANCE

1. Compliance with this Confidentiality and Data Protection Policy is the responsibility of each employee, contractor, and third-party representative associated with Pan Nation Energy, regardless of their position or role. Delegating data protection responsibilities to the Chief Compliance Officer or any other individual does not exempt any person from their duty to comply with this Policy and all applicable data protection legislation.
2. Non-compliance with this Policy, data protection regulations, or internal confidentiality standards will not be justified by claims of acting in the best interests of Pan Nation Energy or its clients and partners. Employees must exercise due diligence and seek guidance from the Compliance Department or Legal Department if there is any uncertainty about how to handle or process confidential information.
3. In cases of intentional or reckless breaches of this Policy or applicable data protection laws, Pan Nation Energy reserves the right to impose disciplinary measures, up to and including termination of employment or business relationships. This includes, but is not limited to, suspension, demotion, or other sanctions permitted by applicable labour or corporate laws and regulations. Severe or repeated violations may result in legal proceedings, where applicable.
4. Third parties, contractors, or business partners found to be in violation of Pan Nation Energy’s data protection policies may have their agreements terminated and may be subject to legal consequences for breaches of confidentiality or failure to protect proprietary information.

POLICY GOVERNANCE

1. The Compliance Director is responsible for the implementation of this Confidentiality and Data Protection Policy, including its incorporation into Pan Nation Energy’s employee training programmes, operational policies, and procedural standards. This includes ensuring that all employees and third parties receive regular training on data protection principles, confidentiality requirements, and the handling of proprietary information.
2. This Policy shall be reviewed by the Compliance Director annually, or more frequently if required by changes in Pan Nation Energy’s operations, business processes, or external factors such as amendments to applicable data protection legislation, regulatory developments, or industry best practices. The objective of these reviews is to ensure that the Policy remains current, effective, and aligned with Pan Nation Energy’s business needs and legal obligations.
3. Amendments or updates to this Policy may be proposed by any member of the Board of Directors, the Compliance Director, or any other business process owner. All proposed amendments must be reviewed and approved by the Compliance Director and, where necessary, the Board of Directors, to ensure that changes do not compromise Pan Nation Energy’s commitment to data protection and confidentiality.
4. All changes and updates to this Policy will be tracked and communicated to employees and relevant stakeholders through official channels. New or revised versions of this Policy will be made available through Pan Nation Energy’s internal communication systems and will be incorporated into employee training sessions as needed.