Kiroyan Partners recognizes that responsible management of data, confidential information, and digital systems is fundamental to maintaining trust, professional integrity, and responsible business conduct.
As an advisory firm, we handle information relating to clients, employees, partners, stakeholders, and other parties in the course of our work. We are committed to protecting such information against unauthorized access, use, disclosure, alteration, or destruction, and to handling it with appropriate care and confidentiality.
Our Commitment
We are committed to:
- Protecting the confidentiality, integrity, and availability of data and information.
- Collecting and handling information fairly, transparently, and for legitimate purposes.
- Limiting access to sensitive information to those who require it for their work.
- Preventing unauthorized use, disclosure, transfer, or distribution of confidential information.
- Maintaining appropriate safeguards for both digital and physical information.
- Promoting responsible and secure use of digital platforms and technologies.
Our approach applies across the information lifecycle, from collection and access to storage, use, sharing, retention, and secure disposal.
Scope and Application
Our data protection and confidentiality requirements apply to all parties who have access to company information, including:
- Employees and management.
- Contract workers and interns.
- Technical experts and advisors.
- Partners, consultants, and other third parties involved in our projects or business activities.
The requirements apply to information obtained or managed both within and outside the Company’s networks and systems.
Data Protection and Confidentiality
We treat information entrusted to Kiroyan Partners with appropriate care and confidentiality.
Our practices include:
- Collecting information transparently and with the knowledge of the relevant parties.
- Maintaining information accurately and keeping it appropriately updated.
- Processing information only for legitimate purposes and within applicable legal requirements.
- Restricting access to sensitive information on a need-to-know basis.
- Requiring relevant parties involved in Company projects or activities to enter into confidentiality agreements before accessing Company information.
- Restricting disclosure or distribution of information to authorized parties, subject to applicable requirements.
We also recognize the importance of respecting the rights and interests of individuals whose information we hold, including providing appropriate information about how data is collected, processed, and accessed.
Information Security
We maintain organizational and technical safeguards appropriate to the information we handle.
These include:
- Access controls for sensitive information.
- Controlled access to SharePoint and other official online platforms through authorized company accounts.
- Password protection and encryption for sensitive project documents.
- Secure storage of confidential documents with restricted access.
- Secure storage and disposal of physical documents.
- Firewall, antivirus, and data backup measures.
- Secure deletion of information that has reached the end of its retention period.
The specific safeguards applied may vary according to the nature and sensitivity of the information involved.
Confidential Projects and Client Information
Confidentiality is particularly important in engagements involving sensitive client or strategic information.
Kiroyan Partners uses internal project and client coding to help protect identities and reduce unnecessary disclosure of confidential information. Sensitive project documents, including those relating to mergers and acquisitions, crisis management, or strategic client matters, are subject to additional protection measures such as password protection, encryption, and restricted access.
Responsible Use of Digital Tools and AI
Digital platforms and technology are an important part of our professional work. We therefore expect their use to be consistent with our confidentiality and data protection responsibilities.
Employees and other authorized users are expected to exercise appropriate care when using online platforms, collaboration tools, applications, and AI-enabled technologies, particularly when handling confidential, proprietary, or client-related information.
Kiroyan Partners also incorporates data security, privacy, and ethical use of digital platforms — including AI, online applications, and collaboration systems — into its employee awareness and training efforts.
Detailed requirements governing the use of AI and other digital tools may be set out in separate internal guidance and procedures.
Third-Party Access
Third parties who require access to Company information as part of a project or business activity are subject to appropriate confidentiality requirements.
Access to sensitive information is limited to what is necessary for the relevant work, and confidentiality obligations apply before access is provided.
Data Retention and Secure Disposal
Information is not intended to be retained indefinitely.
Kiroyan Partners applies appropriate retention practices and takes steps to securely dispose of information that is no longer required, including the secure destruction of physical documents and secure deletion of digital data after the applicable retention period.
Incident and Breach Response
We take the loss, damage, unauthorized access, or compromise of data and information seriously.
Our data protection framework provides for appropriate measures in the event that information is lost, damaged, or compromised, including controls to address such incidents and protect affected information.
Concerns relating to data protection, confidentiality, or information security may also be raised through our Whistleblowing & Reporting Mechanism.
Awareness and Accountability
Data protection and cybersecurity are shared responsibilities.
We support this through:
- Internal controls and procedures.
- Access and confidentiality requirements.
- Employee awareness and training.
- Responsible use of digital platforms and technology.
- Ongoing reinforcement of secure information-handling practices.
Compliance with our data protection and confidentiality requirements is part of our professional and organizational responsibilities. Breaches may result in disciplinary action in accordance with the applicable Company Regulations and the severity of the violation.
Alignment with Other Policies
This framework should be read together with other relevant Kiroyan Partners policies and governance documents, including:
- Privacy Policy
- Code of Conduct
- Conflict of Interest
- Whistleblowing & Reporting Mechanism
- Company Regulations
Together, these frameworks support responsible, ethical, and secure conduct across our operations.
Further Information
This page provides a high-level overview of Kiroyan Partners’ approach to data protection, confidentiality, and cybersecurity. Detailed procedures, controls, and requirements are set out in applicable internal policies and guidance.
The full Data Protection & Confidentiality Policy and additional guidance are available upon request.
For inquiries, please contact:
info@kiroyan-partners.com
Effective Date: November 2025
Review: Periodic