Data Security Policy

1. Purpose and responsibility

This policy applies to LT Marine Offshore Services, Inc. employees, directors, contractors and service providers entrusted with company information, whether working ashore, remotely or in connection with a vessel. It covers paper files, messages, photographs, portable media, devices and hosted systems, including information received from seafarers, principals and suppliers.

Management must assign responsibility for each business system, assess information risks and arrange appropriate resources and instruction. Managers must report control gaps and track corrective work. Requirements must reflect applicable Philippine privacy law and any other law that applies to the activity.

2. Access and everyday handling

• Use information only for an authorised work purpose and access only the records necessary for your assigned duties. Do not browse a colleague's or applicant's file out of curiosity.
• Use individual accounts; protect passwords and verification codes. Never approve an unexpected sign-in request. System owners must require appropriate authentication, including multi-factor authentication for privileged and remote access.
• Obtain approval before granting access. Review permissions when duties change and remove access promptly when it is no longer required.
• Lock unattended screens, secure paper files and collect printouts promptly. Keep crew documents away from public view when travelling or working aboard.

3. Sharing and working securely

Before sharing a crew list, contract, identity document or medical record, verify the recipient, purpose, authority and minimum information needed. Check attachments and access settings before sending. An urgent request or familiar display name does not prove identity; independently verify requests to change payment details or release sensitive records.

Use approved business systems and protected transfer methods appropriate to the information. Do not copy company records to personal email, public links, unapproved cloud storage or external AI tools. Personal devices require prior approval and suitable protection. Do not disable security controls or install unapproved software.

System owners must arrange risk-appropriate encryption, maintenance, security updates, protected backups and recovery checks. Changes affecting personal information require a privacy and security assessment before release. Suppliers must receive defined instructions and contractual security obligations before access is provided.

4. Retention and proportionate oversight

Keep working copies to a minimum. Follow the retention requirements for the record concerned, including any lawful preservation instruction; dispose of records securely when retention ends. Do not keep downloaded crew documents indefinitely or delete evidence after a problem is reported.

Any security logging or monitoring must have a defined, lawful purpose, appropriate notice, restricted access and a justified retention period. Monitoring must be proportionate and respect individual rights. This policy does not authorise unrestricted surveillance or removal of statutory privacy rights.

5. Report suspected incidents promptly

Report a lost device, misdirected email, suspicious link, exposed file, unexpected access or loss of important records immediately to your manager and Diane Tapia, Data Protection Officer, at dpo@lt-marine.com. Do not wait for proof or attempt an unauthorised investigation. If email may be compromised, use another verified company contact.

Describe what happened, when it was noticed and how you can be contacted. Avoid attaching passwords, full identity documents or unnecessary personal records. Preserve relevant evidence and follow authorised containment instructions. Management and the DPO must arrange assessment, recovery and any legally required notifications within the applicable deadlines.

6. Accountability and related notices

Management must review these requirements and unresolved risks periodically and after material changes or incidents. Breaches may lead to corrective or disciplinary action, subject to fair procedures and applicable law. Honest incident reports and protected disclosures must not result in retaliation.

Read the Privacy Notice for data handling and individual requests, and the Speak Up & Whistleblower Policy for reporting misconduct.