Privacy & cookie policy — Power & Sun Management Reporting System
Version 1.0 · effective 11 September 2026 · Data controller: Orange Overseas Group — Power & Sun Division · Internal system for authorised employees only.
1. What this system is
The MRS is the Group's internal tool for work reports, pending jobs, business information, approvals, attendance check-ins and KRA assessments. It is operated by the Group's IT function on the Group's own infrastructure and is not offered to the public.
2. Personal data we process and why
| Data | Purpose | Legal basis / policy |
|---|---|---|
| Name, employee ID, designation, band, department, profit centre, reporting line, work e-mail, phone, joining date | Identify you, build your forms, route reviews and approvals | Employment contract; Office Communication Note v4.8 |
| Your daily, weekly, monthly reports, tasks, business information, approvals, KRA assessments, attachments and comments | Management reporting, performance assessment and payroll compliance | Employee Handbook v6.4 Part G; Communication Note §A.4a (reports are linked to payroll) |
| Sign-in events, IP address, browser type, failed attempts, lockouts, password changes and other security events (account logbook) | Security, audit and fraud prevention | Communication Policy v2.3 §14 |
| Check-in / check-out times, chosen work location and — only if you tick the box — the browser's location coordinates | Your own record of the working day; pre-fills the daily report; team presence overview | Handbook v6.4 §12; location sharing is optional and consent-based |
| Weekly biometric attendance figures entered by HR | Attendance and payroll | Communication Policy v2.3 §6.1 |
3. Cookies
The system uses strictly necessary cookies only: a session cookie that keeps you signed in, and a security (CSRF) token cookie that protects forms. Both are first-party, expire when the session ends or after the idle timeout (30 minutes), and are not used for advertising, analytics or tracking. Your browser's local storage remembers only that you dismissed the cookie notice. No third-party scripts, fonts or trackers are loaded.
4. Who can see your data
- You see your own records.
- Your reporting line (administrative and functional manager and their managers) sees your reports, tasks, approvals, check-ins and assessments.
- HR & Performance, the IT administrator and the Managing Director see all records, the account logbook and payroll-compliance data.
- Business information you share is visible to the audience you chose. Approvals are visible to the requester, the approver, anyone copied and management.
Data is not sold, shared with advertisers or transferred outside the Group. External processors are limited to the Group's hosting and e-mail providers under contract.
5. Retention
Reports, tasks, approvals, assessments and archived PDF copies are kept for the employment period and the statutory retention period thereafter (payroll and audit evidence). Account-logbook entries are kept for at least 12 months. Backups are rotated after 30 days. Business information is archived after its validity date and can be deleted by its author or management.
6. Your rights
You may view your profile, KRAs, reports and check-in register at any time in the system. To correct personal details, request a copy of your data, or raise a concern about how it is used, contact HR & Performance or the IT administrator. Requests are answered within the timelines of the Communication Policy §13.
7. Security
Access requires a personal username and password (minimum 10 characters, changed every 90 days); accounts lock after 5 failed attempts; all access is logged; files are stored outside the web root; the system is served over HTTPS in production; daily backups are taken. Never share your credentials (Communication Policy v2.3 §14).
8. Changes
Changes to this policy are published here and announced through Business information. Continued use of the system after a change constitutes acceptance.
Questions: HR & Performance · IT administrator (MRS) · Orange Overseas Group — Power & Sun Division.
Back to sign in
An Orange Overseas Group companyInternal system — authorised employees only. All access is logged (Communication Policy v2.3 §14). Do not share your credentials. Privacy & cookies