European data protection rules restrict transfers of Personal Data outside the EEA (including to other group companies and external Data Processors) unless there is adequate protection for the Personal Data or prescribed steps have been taken to ensure the Personal Data is protected. YUM! Pizza Hut Gibraltar/ Fontenay Limited may on occasion exports to other parties located outside of the EEA. If we do so, we will do so pursuant to European Commission approved standard contractual clauses to regulate the transfers of certain Personal Data between us and other members of our Group.

All files containing personal information that are exported are subject to the same requirements outlined in the Information Security Standard. These describe the processes that should be followed by Personnel when exporting this data as well as the technological controls used to ensure onward processing is controlled.

There are a (limited) number of other circumstances where Personal Data can be transferred outside of the EEA, including:

• where it is being sent to a country or territory or international organisations recognized by the Commission as offering adequate protection (this would include to US organisations which are EU-US Privacy Shield Certified.);
• reliance on binding corporate rules;
• where the individual has explicitly consented to the transfer;
• where necessary to perform a contract;
• where necessary for reasons of important public interest; or
• where necessary for the establishment, exercise or defence of legal claims.

Data Portability

Further to section 5.9 on Individuals’ Rights, data subjects have the right to request an export of their data in a usable format that can be given to another vendor or service provider to import into its service in certain circumstances. Whilst this specific requirement is of low likelihood and risk for the organisation, YUM! Pizza Hut Gibraltar/ Fontenay Limited uses widely available products (such as Office 365 and Microsoft Exchange for email) to facilitate this requirement.

Endpoint Security and Mobile Device Management (“MDM”)

The GDPR requires computing devices to be protected from loss or theft through mobile device management capabilities, such as remote wipe and kill. A lost device could be the weak link in the data protection chain, leading to a data breach based on information stored on the device or accessible through still active user credentials. YUM! Pizza Hut Gibraltar/ Fontenay Limited has rolled out MDM to all its staff, with specific measures taken detailed in the Information Security Standard.

Cloud Storage and Sharing Services

YUM! Pizza Hut Gibraltar/ Fontenay Limited conducts a periodic review of documents shared externally to minimise the extent of sharing with external parties. Use of default restrictions (such as time-limited links) is also encouraged to restrict sharing by default without the need for user intervention. Measures taken by YUM! Pizza Hut Gibraltar/ Fontenay Limited to review these permissions are outlined in the Data Governance Model whereas measures embedded within the design of the system are described in the Information Security Standard.

 Any transfers of Personal Data must be done securely, whether externally or internally.

When emailing or posting, double check that information is being sent to the right recipient.

 Be aware that those seeking information sometimes use deception. Before sending out any Personal Data to any third party, be sure of their identity. This may involve carrying out checks to verify their identity particularly if you are releasing information over the phone. If in doubt, contact Robert Rae.

Anti-Malware

While a successful malware infiltration can render computers unusable, of more serious concern under GDPR is the potential for malware to harvest credentials for user and administrator accounts. Harvested credentials can then be used to access data sources across the organization (both on-premises and in cloud services), including those containing personal and sensitive personal data.

YUM! Pizza Hut Gibraltar/ Fontenay Limited works closely with its managed IT service provider to ensure the strongest practical level of security is applied in this respect (predominantly through the use of anti-virus and intrusion detection software). Identity and Access Management

A cohesive identity and access management system that seamlessly unifies employee identity across applications is a foundational requirement for GDPR compliance. YUM! Pizza Hut Gibraltar/ Fontenay Limited uses the latest identity management protocols (Windows 10 Azure Active Directory) to manage this aspect of GDPR Compliance]. Furthermore, user identities are connected to third-party software providers using Single-Sign-On where appropriate. This ensures access can be controlled centrally (and quickly) across a number of applications in a uniform way.