Data Handling Policy

SISCOM handles personal and commercial data entrusted to it by clients and investors. This Policy describes the standards we apply so that this data is used only for proper purposes and is protected at every stage.

Responsibility for data protection sits with SISCOM management, and each person who handles data is accountable for following this Policy.

Questions or requests about data can be sent to us through the contact page on our website.

Client Data is what applicants and clients give us or we obtain about them, such as company documents, identity details of directors and owners, financial records, credit and screening results, and project information.

Investor Data is what investors give us, such as identity details, tax and bank details, source-of-funds information and investor category.

We treat data according to its sensitivity: identity, financial and screening data is Restricted and receives the strongest protection; other business data is Confidential; information published on our website is Public.

Each person uses their own login, and logins are never shared.

Access is granted only when needed, reviewed regularly, and removed promptly when no longer required.

Everyone with access is bound by confidentiality.

Client and investor data is held in secured systems under SISCOM's control, and is encrypted in transit and at rest.

Restricted data is not kept on personal devices, in personal email or in messaging apps, and is not sent as an unprotected attachment.

Regular backups are made and recovery arrangements are tested.

We share data only where needed for the purposes described in our Privacy Policy, and only with parties bound to protect it, such as service providers, credit bureaus, screening providers, advisers and authorities required by law.

Disclosures of Restricted data are recorded.

We do not sell client or investor data.

Data is kept only as long as needed for its purpose or as the law requires. Data from declined or abandoned applications is destroyed sooner than data from active relationships.

When data is no longer needed, electronic copies are permanently deleted, including from backups in due course, and paper copies are shredded.

Requests to access, correct or delete data, or to object to its use, are logged, verified and answered within the periods required by the Act and its regulations.

Any suspected loss, leak or misuse of data must be reported immediately. We will contain the incident, assess its impact, notify the ODPC and affected people as the Act requires, fix the cause and review what happened.

We review this Policy periodically and update it when our practices or the law change.