Incident Management Policy

At Pet Watch, data protection and our stakeholders’ privacy are of utmost importance and thus, through transparency and thought-out processes, we are committed to maintaining and securing all data as laid out by our comprehensive Data Protection Policy. However, in the unlikely event that there is a Data Breach, the following policy outlines the procedures and responsibilities for addressing and mitigating data security incidents in compliance with the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”). This policy applies to all employees, contractors, and third-party partners who handle personal data within Pet Watch.

This Incident Management Policy should be read along with our internal Data Protection Policy, Terms & Conditions, Privacy Policy and other policies provided to Users on the Platform to get a well-rounded and comprehensive understanding of how we work, and to ensure your compliance with all policies and requirements.

Also, please refer to our Data Protection Policy for the definition of any capitalized terms, which are not defined in this Policy.

1. DATA BREACH

1.1 A data breach refers to a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed (“Data Breach” or “Incident”).

1.2 These Incidents can occur through various means, such as cyberattacks, hacking, insider threats, accidental data exposure, or physical theft of devices or documents.

1.3 Data breaches can involve a wide range of data types, including personal information (e.g., names, addresses, contact numbers), financial data (e.g., credit card numbers, bank account details), intellectual property, trade secrets, or any other information that, if exposed or accessed without authorization, could result in harm to individuals or organizations.

1.4 Personal data breaches can include, but are not limited to:

1.4.1 unauthorized third party access to systems and applications;

1.4.2 deliberate or accidental action (or inaction) by a Controller or Processor;

1.4.3 sending Personal Data to an incorrect recipient;

1.4.4 lost or stolen devices; or

1.4.5 alteration of Personal Data without permission or necessary instructions;

2. PREVENTATIVE ACTIONS & RESPONSIBILITIES

2.1 All Pet Watch employees shall be trained in handling Users’ Personal Data by practicing daily security measures and reporting any Data Breaches as per the below provisions.

2.2 All systems, including hardware and software, will be regularly assessed for vulnerabilities, and updates or patches will be promptly applied to address identified security weaknesses. This practice aims to minimize the risk of exploitation due to known vulnerabilities.

2.3 Pet Watch will implement and continuously assess security measures designed to protect against data security Incidents. These measures may include but are not limited to:

2.3.1 Firewalls and intrusion detection/prevention systems to monitor and filter network traffic.

2.3.2 Encryption protocols to protect data in transit and at rest.

2.3.3 Access controls and authentication mechanisms to restrict unauthorized access to sensitive data.

2.3.4 Regular security assessments, including penetration testing and vulnerability scanning.

2.3.5 Employee training and awareness programs to promote a culture of security.

2.4 Regular training and awareness programs will be conducted to educate employees, contractors, and third-party partners about their responsibilities in identifying, reporting, and mitigating data security Incidents. This will help create a culture of vigilance and accountability.

2.5 Pet Watch is committed to maintaining open communication with all stakeholders, including affected individuals, regulators, and law enforcement agencies, as required. Regular updates will be provided on the progress of Incident resolution and any subsequent actions taken.

2.6 This Incident Management Policy will be periodically reviewed and updated to ensure alignment with changes in the PDPL, industry best practices, and Pet Watch’s evolving security landscape.

3. INCIDENT MANAGEMENT PROCEDURE

3.1 Incident Reporting

3.1.1 In case of a Data Breach, the relevant employee will report details of the Data Breach to the Data Protection Officer (“DPO”). Contact details can be found under the Contact Us section of this Policy.

3.1.2 Relevant details to be reported shall include:

3.1.2.1 Affected Data Subjects;

3.1.2.2 A description of the nature of the Data Breach, its form, causes, approximate number and records;

3.1.2.3 Potential and expected effects of the Data Breach;

3.1.2.4 Corrective measures and actions taken or suggested to confront the Data Breach and reduce its negative impacts;

Documents of the Data Breach and corrective actions taken.

3.2 Incident Assessment

3.2.1 Upon receiving a report of a data security Incident, the DPO will assess the severity and potential impact of the Incident. This assessment will include evaluating the type of Personal Data involved, the extent of the breach, and the potential risks to individuals.

3.2.2 The DPO shall assess whether the breach poses a risk to the privacy, confidentiality, or security of the Personal Data and shall notify the UAE Data Office and Data Subject accordingly, as outlined in this Policy below and as required under Article 9 of the PDPL.

3.3 Containment & Mitigation

3.3.1 Immediate action will be taken to contain and mitigate the effects of the Incident. This may include but is not limited to isolating affected systems, disabling compromised accounts, and initiating necessary technical measures to prevent further unauthorized access.

3.4 Notification

3.4.1 In accordance with the PDPL, affected Data Subjects and the UAE Data Office will be notified if the Incident poses a risk to their rights and freedoms.

3.4.2 Notifications will be made promptly, transparently and as soon as is permittable, providing clear and concise information about the breach, its potential impact, and the measures being taken to address it.

3.4.3 If there is a Data Breach that comprises a Data Subject’s confidentiality, security or privacy, the DPO shall notify the UAE Data Office and cooperate in any manner required in accordance with the PDPL.

3.4.4 If there is a Data Breach that is likely to result in a high risk to the security or rights of a Data Subject, the DPO shall notify the affected Data Subject as soon as practically possible, in compliance with the PDPL. If communicating directly with the affected Data Subject is not feasible, Pet Watch shall make a public announcement via the Platform.

3.5 Record Keeping

3.5.1 Detailed records of all data security Incidents, including the nature of the Incident, its impact, actions taken, and outcomes, will be maintained as outlined in clause 3.1.2. These records will assist in compliance with regulatory reporting requirements and facilitate internal audits.

3.5.2 Such records shall be retained for the minimum period required under the PDPL and made available to the UAE Data Office upon request.

3.6 Lessons Learned & Remediation

3.6.1 Following the resolution of an Incident, a thorough review will be conducted to identify the root causes, vulnerabilities, and lessons learned. Based on the findings, appropriate remediation measures will be implemented to prevent similar Incidents in the future. This may include updating security protocols, enhancing employee training, and improving overall data protection measures.

4. NON-COMPLIANCE

4.1 If an employee fails to comply with this policy, disciplinary actions shall apply, including but not limited to retraining, suspension, or termination, based on the severity and impact of the non-compliance.

5. CONTACT US

5.1 If you have any suspicions, doubts, concerns or requests regarding data breach Incidents or this Policy, please do not hesitate to contact our Data Protection Officer by emailing info@petwatchapp.com. Any inquiries or concerns relating to Data Protection will be forwarded to the DPO.