MEMORY TECHNOLOGY CORPORATION EMPLOYEE HANDBOOK
Welcome to Memory Technology Corporation Thank you for choosing to be part of Memory Technology Corporation. We are delighted to welcome you to our team and look forward to your contributions to our continued success. At Memory Technology Corporation, our values define who we are and guide everything we do. They shape our culture, influence our decisions, and inspire the way we work together. As you begin your journey with us, you will become familiar with these values and the important role they play in creating a positive, respectful, and high-performing workplace. This Employee Handbook has been prepared to provide you with an overview of the Company's policies, procedures, working conditions, and standards of conduct. It serves as a reference guide to help you understand your responsibilities, comply with Company requirements, and meet workplace expectations. The Company may review, amend, or update the policies and procedures contained in this Handbook from time to time to reflect changes in business needs, operational requirements, or applicable laws and regulations. The most current version of the Handbook will be available through the HR Portal and will serve as the official source of Company policies and procedures. All employees are expected to read, understand, and comply with the policies and guidelines outlined in this Handbook. Employees will also be required to acknowledge receipt of the Handbook and confirm their understanding of their responsibilities under its provisions. We are pleased to have you as part of Memory Technology Corporation and wish you every success in your career with us. Once again, welcome to the team. Warm regards, The Management Team
01 02 03 04 05 06 COMPANY OVERVIEW MISSION, VISION & EXPERTISE EMPLOYMENT POLICIES LEAVE CREDITS & BENEFITS MEET THE TEAM TABLE OF CONTENTS pn
MTC AT A GLANCE For over two decades, Memory Technology Corporation (MTC) has been the trusted backbone of technology distribution in the Middle East and North Africa. Established in 1998, we have grown from a specialized memory distributor into a leading partner for IT infrastructure. Today, our portfolio spans memory, storage, networking, data centers, power solutions, Audio and Visual, Document Management System, and gaming, delivering the solutions that fuel digital transformation across industries. What defines MTC is not just the scale of our vendor partnerships, but the certainty we provide to our partners. With deep regional presence, reliable workforce, and proven technical expertise, we enable system integrators, resellers, and enterprises to access and deploy world class technologies with confidence. Our reputation has been built on consistent execution, long-term relationships, and an unshakable commitment to delivering value. Our approach is anchored by a clear mission, a forward-looking vision, and decades of expertise that guide how we serve our partners and shape the industry: We don’t just move boxes, we bring the world’s top IT brands into the Middle East and North Africa and make them available at scale. From memory and storage to networking, data centers, power, AV, and gaming, MTC curates a portfolio that vendors trust us to carry and partners rely on to win in competitive markets. What sets us apart is the bridge we create between global supply chains and regional demand: negotiating access to the right products, securing allocation in constrained markets, and ensuring consistent availability where others can’t. Our role is simple but critical, to make sure the right technology reaches the right hands, at the right time, every time. WHAT WE DO?
MISSION , VISION & EXPERTISE To empower businesses across the Middle East and North Africa by providing direct access to the world’s leading technology brands. Delivering innovative and reliable solutions in memory, storage, networking, data centers, power, AV, DMS, and gaming, we bridge global technology with regional demand, ensuring availability, authenticity, and service excellence that help our partners grow with confidence. To shape the future of technology distribution in the Middle East and North Africa by ensuring that the region’s businesses have seamless access to the world’s most advanced IT solutions. We aim to strengthen the link between global innovation and regional markets by anticipating demand, building resilient supply chains, and enabling our partners to scale with confidence, efficiency, and sustainable growth. MISSION VISION EXPERTISEWith over two decades of proven experience, MTC stands as a leader in technology distribution — from memory and storage to enterprise infrastructure. Our strength lies in our people: a team of industry experts in sales, marketing, and technical fields who ensure the right partnerships, reliable supply, and the technical excellence needed to support complex IT solutions at scale.
Strategic Partnerships Established Expansion into Print 2002-2005 1998-2001 2006-2009 2010-2013 2014-2017 2018-2020 2021-2022 2023-2024 2025 From Vision to Success Inception Year Starting with a strong focus on memory products, MTC built its reputation on reliability, authenticity, and an unwavering commitment to delivering high-quality components to partners across the Middle East.Distribution Agreement Signed Starting with a strong focus on memory products, MTC built its reputation on reliability, authenticity, and an unwavering commitment to delivering high-quality components to partners across the Middle East. In-House Brands Introduced MTC expanded its portfolio by launching its own proprietary brands, GenX and Xtreme, offering high-quality USB drives and MicroSD cards designed to meet the growing demand for reliable, performance- driven storage solutions. MTC expanded its product portfolio through key industry collaborations, including a partnership with Toshiba Gulf for Flash, HDD, and lifestyle products, and with PFU, a global leader in document imaging solutions. Expanded Partnerships & Regional Launch MTC expanded its partnerships with Kingston, SK hynix, and Kioxia, and led the launch of KLEVV in the Middle East, strengthening its leadership in memory and storage solutions. Portfolio Diversification MTC expanded its portfolio through key partnerships with Western Digital, Samsung Electronics, Gigabyte, Corsair, and Lexar, reinforcing its presence across storage, memory, and gaming solutions. Strengthening Market Reach MTC expanded its network by partnering with Ubiquiti, SanDisk, MSI, and EATON, further enhancing its reach across networking, storage, gaming, and power solutions segments. MTC strengthened its market presence by partnering with OKI Printing Solutions. New Brand Collaborations MTC strengthened its market presence by partnering with LG Electronics for home appliance solutions and Samsung for high- performance monitors.
CEOSam MobiedORGANIZATIONAL STRUCTUREFINANCE & CREDIT MANAGERBUSINESS ANALYSTxxxxxxxxxxxxxxxxxSALES DIRECTORGeneral managerTarek TaraziOperations & IT Managerxxxxxxx
ONBOARDING To provide a clear and structured onboarding process for new employees at Memory Technology Middle East, ensuring a smooth and welcoming integration into the organization. 1 PRE-ONBOARDING Candidates must acknowledge the offer letter and confirm acceptance, submit their resignation and acceptance from their current employer. While HR contacts them 10 days before the joining date to share required documents and coordinate with IT and relevant departments for onboarding preparation. 2 Employees must report on the agreed joining date and time, attend an induction covering the company overview, leadership, values, policies, and departments, and submit all required documents for visa processing, including passport, visa, Emirates ID, photograph, certificates, and cancellation papers. HR will provide system login details, complete onboarding in HR system with mandatory activation within one JOINING & INDUCTION 3 POST-ONBOARDING HR will announce the new employee’s appointment via email and facilitate introductions to the team and relevant personnel, with team members providing support and guidance during the onboarding period.
4 PROBATION PERIOD The probation period is determined by the reporting manager based on role requirements and complexity, typically ranging from three to six months. The Company reserves the right to terminate the employment contract in accordance with applicable laws and company policy. 5 TRAINING A training support is provided during the probation period to support the employee’s role development Including guidance on job tasks, workplace practices, and product or technical knowledge. 6 PERFORMANCE REVIEW At the end of the probation period, the manager will conduct a final performance review to assess the employee’s suitability for the role. This review must be completed on or before the end of the probation period; otherwise, the appointment may be considered confirmed by default. If performance is satisfactory, the manager will notify HR via email, and HR will issue an official confirmation of permanent employment to the employee. If performance is not satisfactory, the manager must consult with HR before any decision is made regarding non- confirmation of employment.
Employees work Monday to Friday with a 1-hour break. Timings differ slightly by location, with a 15- minute grace period allowed for late arrival. WORKING SCHEDULE: AS REPRESENTATIVES OF THE COMPANY, WE SHOULD CONDUCT OURSELVES APPROPRIATELY OUR POLICIES WORK ATTENDANCE GUIDELINES 1 Clock-In Expectations All employees must clock in and out using the HR system while at approved office locations. For remote work or field visits, employees must submit a Work from Home (WFH) or On Duty (OD) request and still log their hours. Missing or incomplete logs may result in system penalties Flexibility Employees may work from home up to 2 days per month with manager approval. For missed log entries - There is limited flexibility to fix missed entries or request adjustments, but these must be done within set timelines. Absences More than 2 days sick leave require supporting documents (e.g., medical certificate). At least 1 hour notice is required for unexpected absences. 3 days of no communication is treated as job abandonment. 2 OVERTIME Overtime is only used when the company needs employees to work beyond regular hours, mainly for blue-collar staff. It must be planned by managers and supervisors in advance to minimize unnecessary extra hours. Any overtime work requires prior approval from management and will be compensated either through payment along with the monthly salary or granted as time off, where applicable.
Annual Leave Entitlement Employees are entitled to 22 days of paid annual leave per year, excluding public holidays and weekends. No Carry Forward / Encashment Employees are expected to use their annual leave within the same fiscal year, as unused leave will generally not be carried forward or encashed. ANNUAL LEAVE 1 PAID TIME OFF Pro-Rata Leave For new joiners, annual leave in the fiscal year in which the employee completes probation will be calculated on a pro-rata basis. In the event of resignation / termination of an employee. If an employee resigns or is terminated mid-year after already using their leave entitlement, a pro-rata adjustment will be made, and the corresponding amount will be deducted from final settlement. Short Leave: For one-day leave, employees should submit their request at least one calendar day in advance. Leave During Resignation or Termination Year-End Exception: For employees who join later in the year and complete probation close to year-end, a limited carry forward may be allowed. Such leave must be used within the first quarter of the following year, otherwise it will be forfeited. Leave Request Approval Longer Leave: For leave of two or more days, employees should submit their request at least two weeks in advance, where possible. Approval All leave requests must be submitted in advance and approved by the reporting manager before the leave is taken. Work Handover Employees are responsible for ensuring proper work handover arrangements before proceeding on leave.
3 EMERGENCY LEAVE Emergency leave is granted only in genuine and unforeseen situations requiring immediate attention, such as medical or family emergencies, natural disasters, or other urgent circumstances. A formal request must also be submitted through the HR portal, clearly stating the nature and urgency of the situation. Notification & Approval Immediate Notification Employees must inform their Reporting Manager as soon as possible in the event of an emergency. If the Reporting Manager is unavailable, HR must be contacted directly without delay. 4 BEREAVEMENT LEAVE Employees are entitled to up to 5 days of fully paid bereavement leave in the event of the death of an immediate family member, including a spouse, child, parent, or sibling. . Additional leave beyond the 5-day entitlement may be granted at the discretion of the Manager or HR and will be deducted from the employee’s annual leave balance. Annual Leave Deduction Emergency Leave is deducted from the employee’s annual leave balance. If no leave balance is available, the emergency leave will be treated as unpaid leave. Requests are reviewed and approved case by case, based on the urgency and supporting details provided. Entitlement Additional Leave & Documentation Employees may be required to provide supporting documentation where necessary to verify the request. Employees are required to notify their Reporting Manager at least one to two hours before the start of their shift in case of sickness or absence and must submit sick leave requests through the HR portal, as backdated applications are not permitted. Employees who are unable to apply must inform HR or their manager immediately. Sick leave exceeding two days requires supporting medical documentation, and repeated absences around weekends or public holidays may be reviewed for verification. SICK LEAVE2 Employees are entitled to a maximum of 12 sick leave days annually, after which absences will be deducted from annual leave or treated as unpaid leave if no leave balance remains. Unused sick leave cannot be carried forward to the following year.
1 PAY OUT CYCLE If an employee join the company between January and March, you'll receive your first air ticket reimbursement in December, once you've completed six months of service. ANNUAL AIR TICKET BENEFIT If you have not completed six months of service by December, your reimbursement will be paid in the next June payment cycle, once you have completed six months of service and successfully finished your probation. For existing employees, the air ticket benefit is processed every June, once each year. For blue collar employees will be entitled to claim their air ticket prior to their travel. IMPORTANT NOTE: The air ticket entitlement will be provided based on the company- approved average fare. The air ticket benefit is applicable to employees only and is provided for economy-class travel. If an employee leaves before completing one year after receiving the air ticket benefit, the pro-rated amount will be deducted from End of Service benefits
Employees may travel for business work-related, exploring and expanding businesses in different countries, or visiting other partner / vendor company. BUSINESS TRAVEL 1 APPROVAL PROCESS Business trip plan must be communicated and approved by their line manager, once approve employees must share their request through HR Portal under Helpdesk. 2 Company covers economy class flights. Upgrades are personal cost. Book early when possible; urgent travel needs prior approval and must stay within budget. FLIGHTS 3 Employees stay in 3–4-star hotels, usually arranged by the company in collaboration with our registered travel agent. Self-booking is allowed only if needed and must stay within budget approved by Finance. Personal extensions are self-paid. HOTELS 4 The company covers the visa & insurance but not the passport fees VISA & INSURANCE 5 LOCAL TRANSPORT Business-related transport (e.g., airport transfers, client meetings) is reimbursed. 6 PER DIEM Employees can either take a daily allowance (per diem) or claim actual expenses with receipts, but must choose only one option per day. Per Diem Coverage: Covers meals, snacks, and small local transport (e.g., taxis for meetings). Per Diem Exclusions: Per diem does not cover flights, hotels, personal expenses, fines, upgrades, passport fees, or hotel extras. (refer to the next page) 7 CLAIMS REQUIREMENT Keep receipts and submit a travel report before claiming; in any case receipt is not available, a detailed breakdown of expenses must be provided with manager approval. 8 REIMBURSEMENT Choose per diem or actual expenses (with receipts), not both. Claims must be submitted on or before 20 of the monthth
PER DIEM AED 250 Gulf Area AED 450 Europe AED 250 Egypt, Syria & Yemen AED 300 Maghreb ( Algeria, Libya, Mauritania, Morocco, Tunisia) AED 350 Asia AED 350 South Africa
MEDICAL INSURANCE The Company provides medical insurance to support employee wellbeing, with options for upgrades and dependant coverage at the employee’s expense, along with flexible payment arrangements. 1 ELIGIBILITY All employees are covered under the standard medical insurance plan. Upgrades are optional and fully paid by the employee, including any additional premium. 2 DEPENDANT INSURANCE Employees are responsible for arranging insurance for their dependents. HR can assist by providing estimated cost details, and the cost will be borne by the employee. 3 PAYMENT TERMS A 6-month payment plan for dependant insurance coverage is available, subject to Finance approval. Payments may be made via post-dated cheques (PDCs) or cash deposit to the company bank account. Note: Insurance coverage follows the terms and conditions set by the approved insurance provider. Any upgrades or additions for dependents are subject to insurer approval and applicable premiums. For late additions, a Medical Application Form may be required.
Employees are expected to use all company IT systems, devices, and networks in a responsible and secure way, and only for approved business purposes. Everyone is responsible for protecting company information, especially anything confidential or sensitive, whether it is stored digitally or in hard copy. To keep our systems safe, employees must follow all security measures, including access controls, passwords, and physical security rules for computer rooms and equipment. These protections are in place to prevent unauthorized access and to keep company data secure and reliable. IT resources must not be misused, and no one should try to access systems or information they are not authorized to use. Any breach of these rules may lead to disciplinary action, up to and including termination. For full details, employees should refer to the IT Policy, which explains the complete requirements and standards we all need to follow.INFORMATION TECHNOLOGY POLICY
INFORMATION TECHNOLOGY POLICY Security1 MTC facilitates legitimate access to information and information technology resources to facilitate normal business activities for all users of MTC systems while at the same time reducing exposure to unauthorized access of both employees and non-employees 1.0 Access to Information Resources 2.0 Basis MTC employees depend on information and IT resources to perform their work. Access should be easy for authorized users while ensuring data integrity and confidentiality. Strong security is necessary to prevent unauthorized access, which can lead to financial costs, data loss or compromise, and reputational damage. 3.0 Data and Application Implications Manager is responsible for revoking access for former employees and coordinating with the appropriate personnel to ensure timely action. Employees must exercise caution when using the internet to protect company systems and data. All computer files, including emails, are company assets and may be accessed by MTC at any time. MTC complies with copyright and software licensing requirements, and each department is responsible for preventing unauthorized software use and copying. 4.0 Infrastructure Security Implications MTC requires employees to follow established remote access protocols to protect company systems and reduce security risks. Remote connections must be secure, monitored, and aligned with MTC’s firewall standards, with access granted only when necessary for business purposes. Designated individuals are accountable for systems connected to external networks, ensuring they remain secure and compatible with organizational requirements. Access for former employees must be revoked immediately upon termination, while access for employees on leave is subject to management discretion. 5.0 Computer Security Implications MTC enforces strong password and access control practices to protect company systems and information. Department managers are responsible for ensuring that access credentials for former employees are promptly updated or removed through coordination with IT Department. Access privileges are granted based on business needs, subject for approval and are not enabled by default. Clear guidelines govern the assignment, monitoring, and responsible use of privileged accounts, with varying levels of access provided according to job responsibilities. 6.0 Physical Security Implications Physical security of computer rooms and public computers areas must be properly maintained. Biometric, restricted key or electronic card key access must be enforced for all machine rooms and network access points. Sensitive and confidential information must be stored securely in locked locations, and hard copies must be shredded when no longer needed. MTC also reserves the right to remove an employee’s computer to protect the integrity of computer files.
7.0 Break-ins, Viruses, Worms, and Trojan Horse Implications MTC regularly monitors its network and computer systems to identify and respond to potential security threats. IT staff must use good judgment in publicizing security problems. Information should often only be disseminated on a need-to-know basis. If a break-in is detected or a virus, worm, or Trojan horse infects MTC's resources, IT staff must be adequately prepared to take appropriate actions. Information Technology Department will provide the IT groups with written procedures on what to do in the event of a security breach, including information on determining how the intrusion occurred, how to change passwords for suspected accounts, and how to check for Trojan horses and trap doors. Escalation procedures should be clearly documented and include information about who can be contacted for higher-level help and the departments that should be notified. All computers must run current anti-virus software. 2 Information Security Participation All users of MTC information technology systems must participate in information security. 1.0 Basis Employees are responsible for handling information and technology resources in a manner that protects the security and integrity of MTC’s systems and data. All information created or maintained in the course of business is the property of MTC. Likewise, all files stored on company-owned devices, including computers, laptops, and mobile phones, remain the property of MTC. 2.0 Employee Implications All employees are responsible for exercising sound business sense to maintain, protect, and share information and data. Employees should not share MTC's information and data with people outside the organization except when doing so helps achieve our business goals. Employees shall participate in open communication of information with other MTC staff when necessary or beneficial. Department managers are responsible for their staff's appropriate use of MTC's computers and related services. Failure to comply with MTC's computer security and privacy policies is grounds for disciplinary action, including termination of employment. Employees will be permitted to use MTC computers and services for personal use when such use does not interfere with legitimate business uses. Employees must consent to MTC's requests for access to corporate information stored on personally-owned computers. Employees are responsible for protecting and destroying any MTC data and information stored on personally-owned computers, copied to portable computers, printed on faxes, and printed on printers
3.0 Data and Software Implications Computer files, including e-mail, created on MTC's computer systems are MTC property. They should not be considered private and may be searched for litigation or other corporate purposes at any time as needed. Information published using MTC computers are covered by the employee confidentiality agreement. Posting to public bulletin boards or sending e-mail to large distribution lists from MTC computers may constitute publication. MTC can require that all corporate information, data, and software on personally- owned computers be destroyed. 4.0 Communication Implications Information security guidelines must be clear and brief. All MTC employees must be trained to properly handle information, data, and appropriate security measures. All MTC employees must be educated about the importance of security. Information Technology Services must provide guidelines for employees about Internet and other network access to sites outside the network. Benefits, Risks and Costs3 1.0 Basis Security measures will cost money, require personnel time, and inconvenience users and administrators of the services. Data and information should be protected when there is a clear business need to do so. Good judgment is necessary when balancing security concerns and business needs 2.0 Implications Costs may include: Extra routers with better filtering capabilities. Expansion of firewall security. Operational costs to set up and run the equipment. Costs in convenience, productivity, and staff morale. Benefits may include protection of data critically important to MTC from a competitive point of view. 4 Levels of Information Technology Security 1.0 Basis MTC handles different types of information and supports various user groups, including employees, contractors, consultants, interns, and collaborators. Security and legal requirements vary based on the sensitivity of the information and the user's role, requiring appropriate access controls and protections. Note: Information security and legal issues will be different for each type of information and user 2.0 Implications What needs to be protected and define different levels of access must be defined. Definition of security classes (e.g., confidential, proprietary, public) and their levels of access must be defined. Access restrictions can apply to data, information, or services. Different types of users will require different degrees of supervision and different levels of access to data, information, and services.
5 Guidelines of Information Security 1.0 Basis None of MTC's resources are secure unless all of them are secure. We should never assume that MTC's computing environment is totally secure, as vulnerabilities may exist despite security measures. Regular audits will help identify any weak points, enabling timely corrective actions and strengthening the overall security posture of the organization. 2.0 Implications Management support for information security is required, IT groups must cooperate on security issues, information security responsibilities and authorities must be clearly defined at the corporate level to ensure prompt responses to security problems, and periodic audits of MTC's systems and network must be conducted to maintain and improve security. 6 Identity Theft Think Before You Click Identity theft occurs when someone uses another person's personal information, such as a name, Social Security number, credit card number, or other identifying details, without permission to commit fraud or other crimes, often causing victims to spend significant time and money resolving the resulting issues; identity thieves may obtain this information through methods such as searching through trash, hacking computer systems, exploiting legitimate access to data, or using online scams like phishing, which has become a common threat encountered by MTC employees through email and web-based communications. Phishing attacks involve the mass distribution of 'spoofed' e-mail messages with return addresses, links, and branding which appear to come from banks, insurance agencies, retailers or credit card companies. These fraudulent messages are designed to fool the recipients into divulging personal authentication data such as account usernames and passwords, credit card numbers, social security numbers, etc. Because these emails look "official", up to 20% of recipients may respond to them, resulting in financial losses, identity theft, and other fraudulent activity. You should always be wary of e-mails requesting personal information Identity Protection Essentials Never share personal information by phone, mail, or online unless you initiated the contact and can verify the recipient's identity, as scammers may impersonate trusted organizations to steal sensitive information. Never share personal information by phone, mail, or online unless you initiated the contact and can verify the recipient's identity, as scammers may impersonate trusted organizations to steal sensitive information.
7 Security Incident Policy 1.0 Purpose The purpose of this policy is to establish a standard for escalating, reporting and resolving information security incidents. MTC will escalate potentially sensitive information security incidents and issues to the Chief Information Officer (CIO) by email and telephone. 1.1 Scope This policy applies to all MTC “Users”. The term “users” apply to any person (MTC, third party contractors, temporaries, guests, licensees or invitees, as well as those who represent themselves as being connected – in one way or another – to MTC) who uses, possesses or has access to communications systems and equipment. 2.0 Policy Potentially sensitive incidents include, but are not limited to: Security breaches of MTC systems, whether or not resulting in the loss of MTC confidential information, intellectual property, or other highly sensitive information; Violations of the MTC Professional Conduct and Code of Ethics; Violations of the MTC Confidential Information Protection Policy and Practice; Information Security will confer on the referred matter as soon as possible to identify the potential risks/exposure and potential responses. MTC Information Security will engage Legal, Internal Audit, Human Resources and other internal resources, as appropriate, in determining the appropriate course of action. Significant instances of misuse or misappropriations of computer assets and systems; Thefts of MTC computing assets; Sensitive security issues relating to, or involving, MTC executives; Situations requiring forensic analysis/investigation of MTC computing assets. Any situation which may pose a serious threat to MTC’s IT business processes and potentially impact on MTC’s ability to continue operations or service its customers. 3.0 Resolution 4.0 Incident Reporting Immediately report unauthorized disclosures or uses of confidential information, as well as other potential information security issues, to your manager or the Director of Information Security. 5.0 Enforcement Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
8 Passwords 1.0 Policy This policy applies to all MTC “Users”. The term “users” applies to any person in MTC, third party contractors, guests, temporaries, licensees, as well as those who represent themselves as being connected – in one way or another – to MTC who uses, possesses or has access to MTC communications systems 2.0 General All user-level passwords (such as email, desktop, local/domain, and ERP system passwords) must be changed at least every 90 days, must contain a minimum of six characters, and must not be shared or transmitted through email or other electronic communication unless properly encrypted; all user-level, system-level, local, and application passwords must follow the defined security guidelines, be generated randomly when not managed in a password database, and must never use standard or default passwords for users or groups. 3.0 Guideline Some of the more common uses of passwords include: user level accounts, web accounts, email accounts, screen saver protection, and voicemail password. Due to cost constraints, very few systems have support for one-time tokens (i.e., dynamic passwords which are only used once) and everyone should be aware of how to select strong passwords. 3.1 Weak passwords Passwords must not include personal names, computer-related terms, personal information (such as birthdays, addresses, or phone numbers), common patterns or sequences (like qwerty or 12344321), reversed words, or simple variations such as adding numbers or substitutions (e.g., “passw0rd”). 3.2 Strong passwords Strong passwords should be at least six characters long and include a mix of upper- and lower-case letters and numbers, while avoiding dictionary words and personal information; they must never be written down, stored online, or shared, and should be changed immediately if compromised or disclosed. 4.0 Password Management Do not share MTC passwords with anyone, including IT support personnel, administrative assistants or secretaries. All passwords are to be treated as sensitive, confidential information. Passwords must remain strictly confidential and should never be shared with anyone, including supervisors, co-workers, family members, or external parties. Employees should not disclose passwords through phone calls, emails, forms, questionnaires, or conversations, nor provide hints about them. In short, passwords should never be discussed, revealed, or shared under any circumstances. If someone requests your password, refer them to this document or the Information Security Department. Do not use “Remember Password” features in applications. If you suspect compromise, report it immediately and change all passwords. IT Security may conduct periodic password testing, and any discovered passwords must be changed; only IT Security or approved auditors are authorized to perform such tests. Notes
9 Use of the Internet/Online and E-Mail Services 1.0 Purpose To communicate Management objectives for the acceptable use of company- provided electronic mail and Internet/Intranet services by all employees and agents ("Users") of MTC and its subsidiaries ("Company"). 2.0 Policy This policy applies to all MTC “Users”. The term “users” applies to any person in MTC, third party contractors, guests, temporaries, licensees, as well as those who represent themselves as being connected – in one way or another – to MTC who uses, possesses or has access to MTC communications systems. 3.0 Company Business Company-provided electronic mail and Internet/Intranet services are valuable business tools that enhance productivity and communication, but these tools cannot be abused. While incidental and occasional personal use of Company-provided electronic mail and Internet/Intranet services are permitted, they are valuable corporate resources and must not be used for personal solicitation of non-company business, advancement of individual views, or illegal activity. All use and product of such use, including e-mails, is the Company’s not the individuals. 4.0 Confidentiality This policy applies to all MTC “Users”. The term “users” applies to any person in MTC, third party contractors, guests, temporaries, licensees, as well as those who represent themselves as being connected – in one way or another – to MTC who uses, possesses or has access to MTC communications systems. 5.0 Controlled and Prohibited Activities All information posted on the Internet representing MTC must be approved by the appropriate corporate department and consistent with the Company's policy for communicating information to the public. Only specifically authorized management may send broadcast messages to all e-mail Users within one or more of the MTC companies.
6.0 Prohibitions Creation of Web pages or information sites without appropriate written approval. Posting statements representing or purporting to represent the Company on the Internet or Intranet. The generation or circulation of any form of "chain letter" or other nonprofessional communication. Use of the Company-provided electronic mail and Internet/Intranet services to transmit information on behalf of any company or entity other than MTC. Use of pseudonyms to disguise the identity of a sender. Postings to “message boards” about business or individuals within MTC or any opinions about MTC or individuals within MTC. Communications on the Company- provided electronic mail and Internet/Intranet services should be professional and should not contain any pictures, materials, comments, language, links or anything else that might be considered inappropriate or offensive. The access of inappropriate web sites and the posting of offensive materials on or using Company-provided electronic mail and Internet/Intranet services will not be tolerated and may subject offenders to immediate discharge. The Company reserves the right to restrict access to certain sites. Use of proxies or services that by-pass the corporate controls for Internet content and message filtering. 7.0 Illegal Activities Illegal activities, such as harassing other users, accessing or distributing threatening or obscene material, the intentional spread of computer viruses or other destructive information, malicious service disruption, unauthorized attempts to break into any computer system or use resources or access or destroy data belonging to the Company or any other organization or individual, or unauthorized use or retrieval or distribution of copyrighted material are strictly prohibited. Any illegal use of Company-provided electronic mail and Internet/Intranet services will subject the user to prosecution to the full extent of the law. Users can also be held personally liable for any and all damages caused by such activities and may be subject to immediate discharge. 8.0 Security Access to the Company-provided electronic mail and Internet/Intranet services must be approved. Only company-approved software may be used when connecting to the Internet through the Company's network. Before access to the Company-provided electronic mail and Internet/Intranet services will be granted, the User is required to acknowledge receipt and understanding of this policy and sign a statement of acceptance. Account Ids and passwords for the Services are strictly for the use of the registered User and should not be shared or made accessible to others. Under circumstances in which passwords must be provided to others to gain access to the computer, such as system maintenance or repair, a new password should be created and used after the completion of that process. Computers capable of live access to the Company-provided electronic mail and Internet/Intranet services should not be left unattended. Sensitive Company information must be protected while being transmitted over the Services.
9.0 Misaddressed Messages Recipients of messages or information inadvertently sent or misaddressed to them should not copy, retain or disclose the contents of such messages. It is the policy of the Company that such messages should be deleted and the sender should be notified, if possible, that the message was misaddressed or misdirected. E-mail is considered by the Company to be a non- permanent form of communication and messages should be promptly deleted after use. E-mail messages stored in folders or archived should be maintained only so long as they remain in use and should thereafter be deleted unless otherwise directed by the Company. Please consult the Company E mail Retention Policy for further details. 10.0 Accountability Every employee at each level of each company is strictly accountable for the enforcement of this policy. Users and their managers are strictly accountable for the accuracy and appropriateness of links and information available from the User's Internet sites. 11.0 Policy-Owner/Contact The policy owner is the Director, Information Technology. Questions regarding this policy should be directed to the policy owner.
10 Acceptable Internet Use Policy Ensure all software downloaded from non-MTC sources via the Internet are screened with a virus detection software prior to being invoked. Not to place MTC material (software, internal memos, etc.) in any location, on machines connected to MTC internal networks or on the Internet, unless the persons who have access to that location have a legitimate need-to-know. Be aware that all publicly writable directories on MTC Internet-connected computers can be reviewed and cleared each evening. Be aware that all internet traffic is recorded. Not to use the Internet for commercial purposes such as advertising, marketing, or business transactions without approval of MTC management. Not to create, modify, execute, or distribute any computer program or instructions intended to obscure the true identity of the sender of electronic mail or electronic messages. Guidelines for Instant Messaging Use Not to probe security measures at either MTC or other Internet sites unless you have first obtained permission from MTC. Not to send or disclose MTC secret, proprietary, or confidential information over the Internet. Not to sell or transfer any company software, documentation or any other internal information to any non-MTC party for any purposes other than business purposes expressly authorized by management. Not to participate in pirated software, music exchanges, or other non-business related newsgroups, chat rooms (including but not limited to: USENET, web forums, blogs, etc.), FTP sites and social utilities websites (including but not limited to: facebook.com, hi5.com, etc.) Not to participate in peer-to-peer applications (including but not limited to: WinMX, Kazaa, Bearshare, Morpheus, eDonkey, Limewire, BitTorrent, etc.). 11 Instant Messaging Policy Employees are permitted use of Instant Messaging (IM) for business related work only. Voice over IM is supported. Accessing, contributing and downloading of pirated software such as application, music, games, movies, etc. is prohibited. .File transfers are prohibited and not supported. Use of offensive language and/or derogatory comments to any individual or group is prohibited. 12 General Computer Usage A computer is defined as any system, server or workstation, that runs an operating system, including imbedded, that is but not limited to Microsoft Windows, Linux, UNIX and Macintosh. Information on computers should be protected from disclosure to, modification of or theft by unauthorized persons, and controls should be in place to minimize loss or damage.
Guidelines 12 General Computer Usage Where appropriate, paper and computer media should be stored in suitable locked cabinets when not in use, especially outside working hours. Users should not store confidential information on the personal computers. File servers should be used to store confidential information since appropriate access restriction can be applied for such confidential data. Availability of information is also ensured by regular backup at the server level. Users should not download, install or store games on their computers. Sensitive or classified information, when printed, should be cleared from printers immediately. The following control measures should be undertaken by the users to secure their personal computers from unauthorized access: a. Users should terminate or lock their logon session if they are leaving the desktops unattended. b. Hard disk(s) of the personal computer should not be shared. In the event sharing is required, then the hard disk should be shared by an access control list with no open shares (Everyone with either READ or higher access). The usage of personal PCs or laptops in the office is not permitted. The use of Wireless Access Points (WAP) or wireless network adaptors for the purpose of communicating with other computers or networked devices is prohibited and not supported. 13 Acceptable Use Acknowledgement Statement Form This form is an acknowledgement to certify that staff has read and understood the guidelines set forth within the MTC’s Use of the Internet/Online and Mail Services Policy services. This has to be signed by each staff member and filed in the personnel file. 14 Confidential Information Protection The protection of confidential information is critical to any business in defining and maintaining success. These information assets include: The features of unreleased product, schedules, and launch strategies Pre-released financial data, not yet available to the public Future business ideas and concepts Network and systems access passwords Information relating to pending acquisitions and joint ventures Operational strategies Production, marketing, and sales forecasts Customer's names and their product needs. Pricing and sales strategies Employee Records Organization charts and organization changes Security procedures Any other information that has value, provides competitive advantage, and is not generally public
14 Confidential Information Protection Confidential information can be presented or stored in many forms, including but not limited to: paper documents, information on electronic storage media, information passed by voice, charts and graphic presentations, audio and video tapes, and email. In any form, it must be protected. This policy applies to all employees, contractors, temporary workers, and business partners of MTC and its subsidiaries, worldwide. It applies to proprietary and confidential information in all forms and expressions, developed, owned, and maintained by and for MTC. Scope Confidential information is defined as any data, whether it be technical, financial, operational, or strategic, that if improperly used or disclosed to unauthorized parties, could adversely affect MTC competitive advantage, or be otherwise damaging to MTC. Responsibilities Management personnel are responsible for implementing information protection policy and procedures and monitoring compliance within their respective organizations. Definition Employees, contractors, temporary workers, and business partners are responsible for protecting MTC confidential information by following this policy and the related protection procedures and for protecting the confidential information of others that has been entrusted to MTC. The Originator of a document or other expression containing confidential information is responsible for classifying the information as "confidential" and labeling it properly with handling instructions as appropriate. Classifying and Labeling Confidential Information It is the responsibility of the originator of confidential information to identify it as confidential and label it properly. Information that needs safeguarding -- including emails and presentations -- should be visibly labeled "MTC Confidential" at the top or the bottom of each page. The originator of confidential information may specify distribution and handling instructions by including them in the label. Typical handling instructions include: Internal Use Only, which specifies that the information is only for MTC (who have signed confidentiality agreements). Do Not Copy or Distribute, which stipulates that the receiver of this information may not distribute it further, forward it, or otherwise disclose it to others, without the agreement of the originator. The label should read, MTC: Do Not Copy or Distribute.
14 Confidential Information Protection Classifying and Labeling Confidential Information In certain situations, documents will contain headings and labels established by the Legal Department to maintain attorney-client privilege or as "registered and restricted" as determined by the executive staff and Board of Directors. Once the company releases confidential information to the public, or other circumstances undo the need for confidentiality, we should discontinue using these labels. Information Protection Procedures Employees must be careful when discussing confidential information so those without authorization and a need-to-know do not overhear these conversations. This is especially important in public places and while traveling. Do not expose confidential information, presentations, etc., to those seated around you when traveling on airplanes. Be careful using a computer in conditions where others can view the screen. When traveling, do not put confidential information in your checked baggage. Keep it with you and protect it at all times. Use the hotel room safe or safe deposit box to store it if you need to leave it at the hotel. Keep electronic versions of confidential information separate from your computer. Use password protection and, whenever possible, encryption. Third parties, including contractors, vendors, and business partners who are privy to MTC confidential information should sign confidentiality or non-disclosure agreements. Consult the Legal web site for information. Employees must lock their workstations (using a password screen saver, Windows NT lock workstation, or other security feature) to prevent access when away from their desks. Employees must protect their workstations and company networks from computer viruses by using MTC resident virus scanning applications. Do not disable or modify this software/ MTC facilities must be secure and access must be restricted to areas where confidential information is processed, used, and stored. While visitor procedures may vary among MTC locations, all guests are to identify themselves and register with security, the receptionist, or their host before entering MTC facilities. Visitors to non-public work areas within MTC must be escorted. When handing out a confidential document, make sure it is delivered directly to the recipient. Do not leave it on their desk or chair. Use a MTC confidential envelope if you must send it through internal mail. When using the post office or other carriers to send confidential information, put the document in a sealed MTC confidential envelope, and then place that envelope inside the sealed mailing envelope. Do not label the outside envelope "Confidential" -- it attracts attention. Documents and media containing confidential information must be stored out of view, inside the access- controlled areas of our buildings, whenever possible. Confidential information should be stored in locked file cabinets or secure file rooms. Information stored on networks, hard drives, and other electronic storage media, must be protected by properly constructed passwords. Employees must not divulge, or let others use, their passwords. Passwords must be changed every 90 days.
14 Confidential Information Protection Classifying and Labeling Confidential Information In certain situations, documents will contain headings and labels established by the Legal Department to maintain attorney-client privilege or as "registered and restricted" as determined by the executive staff and Board of Directors. Once the company releases confidential information to the public, or other circumstances undo the need for confidentiality, we should discontinue using these labels. Information Protection Procedures Employees, contractors and partners must not make unauthorized copies of MTC or others licensed software or products. When no longer needed, documents and media containing confidential information should be shredded or otherwise destroyed, in accordance with the MTC Records Management Policy. Faxing Confidential Information. If you must fax a confidential document, take these precautions: a. Telephone the recipient and have them wait at their fax machine. b. Carefully dial the number, double check it, send the fax, and wait for it to complete. c. Telephone the recipient a few moments later and make certain they received all pages. d. Confidential faxes should contain a paragraph instructing the recipient that the fax is confidential, and, if they receive it inadvertently, they are to notify MTC and not divulge the information. Our standard heading for this purpose is: When photocopying confidential information, be careful to remove the original from the machine and take all the copies when you finish. Reporting Immediately report unauthorized disclosures or uses of confidential information, as well as other potential information security issues, to your manager. The caller may report allegations without fear of retaliation and elect to remain anonymous. Protecting Laptops When a laptop computer is stolen two kinds of loss is suffered: the computer, and, perhaps far more serious, information stored in the computer. Take these precautions: Continued on the next page →
Do not leave your laptop unsecured in a MTC office. Lock it in its docking station, secure it with a cable lock, or lock it up in a cabinet or your desk when it is not being used. Do not leave your laptop unattended in open view in your hotel room. Utilize the room safe if possible. Do not leave your laptop unattended and in open view in your automobile. If you must leave it in your car, lock it in the trunk. Never place your laptop in checked baggage and keep it securely with you in hotel lobbies, airports, restaurants, and other public places. Remember, the carrying case offers no protection from theft; what is inside is easily recognizable. Be careful using your laptop on airplanes and in public areas. Make certain those around you cannot read your screen if you are working with confidential presentations or other material. Use password protection and encryption, when possible. Continued from previous page Protecting Laptops Disclosing Confidential Information Properly Often MTC business requires us to share confidential information with people outside our company. MTC’s Legal Department has produced special nondisclosure and confidentiality agreements to use with vendors, customers, consultants, partners, and contractors. Employees are responsible for ensuring these agreements are signed and properly executed before divulging confidential information to these outside parties. Refer to the Legal Department web site for forms and instructions. Confidential information can only be disclosed to people outside MTC when these agreements are in place. Information Protection Law Most countries now have laws governing trade secrets and confidential information. Some people feel comfortable taking documents from one employer to the next to facilitate their career. Unauthorized taking of a company's trade secrets for the economic benefit of anyone other than the owner is a serious crime. The law is very broad in protecting company trade secrets and confidential data. Reviewing Your Responsibilities MTC’s employees have signed employment agreements with MTC specifying that they will protect company confidential information and the confidential information of others with whom we work. Following these policies and procedures is required by these agreements. Protecting confidential information enhances our competitive advantage, our reputation, and our profits.
15 Classifying Types of Information Employee Information Personnel data (privacy data) Payroll and financial data Human Resources actions 1.0 Confidential Information Performance review data Benefits and health plan data and actions Manager-employee personnel correspondence and actions Trade Secrets Pre-patent information Acquisition, merger, and divestiture information Corporate business strategies and plans Business pricing and costing algorithms Competitive and market analyses, forecasts and plans Customer accounts/negotiations information Privileged Legal Information Security or Operational Vulnerability Assessments Critical Infrastructure Safeguards and Security Controls Customers lists and customer information Customer r account data and agreements Business and service proposals Vendor and supplier negotiations and agreements 2.0 Sensitive and Proprietary Business Information Legal actions and information Security Investigations related information Compliance and audit data Detailed facilities information Passwords, security control codes, access codes, security mechanisms for systems, networks and applications Physical and Logical protection processes and procedures Financial information which has not been officially certified and submitted for public release Asset inventory and value information Asset configurations and deployment plans Operational plans, status, processes and procedures Risk Assessment and Management information Tax Returns and Reports 3.0 Internal Use Only Information This category applies to internal business information, sensitive or aggregated information that is Company property or under MTC custodial control, and that does not fit into the more sensitive, “Confidential” classification. This type of information may generally be used within the Company, but if disclosed to external entities, could result in some level of harm or disadvantage for the company, its employees, customers, vendors, suppliers, business operations, assets, safety, legal standing, reputation, etc.
MTC Internal Use Only Information includes but not limited to: Internal Departments and Personnel lists Internal phone systems and locations lists Customer problems, services, satisfaction statistics and details affecting customer relationships Internal performance and business measurements Unmarked MTC business related information should be handled and protected as “Internal Use Only” by default unless an authorized business owner has specifically designated that information for release to the public. Aggregated financial, operational, statistical information which may be of value to competitors Business issue discussions, site management plans, trend analyses and measurements Internal processes and procedures which may constitute a competitive advantage Whenever practical, physical files and documents should be labeled” Internal Use Only”, along with any other appropriate copyright, trademark, etc., markings. Documents marked as “Internal Use Only” may also identify the document owner or designated control point, if applicable. Internal Use Only information should be stored and handled in a manner that protects it from inadvertent or unauthorized disclosure to external entities. Note: The nature and sensitivity of the information content, rather than document markings, determine the actual classification of a document or file. 4.0 Recommended Default 16 Safety Incident Intervention To communicate management objectives for managing High Risk Employees (“HREs”). 1.0 Purpose HREs are defined as those employees who have had one or more Critical Rules violation. When an employee has violated the Company’s safety rules, it is the responsibility of the employee’s manager to use progressive counseling and discipline, where appropriate, to manage performance. Any safety rules violation or combination of violations may lead to a more severe disciplinary action than that described below An employee who commits Critical Rules violation or commits violations should be terminated. The termination should occur after consultation and documentation review with the Human Resources Manager. The description of the violation must be documented and placed in the employee’s personnel file. The Company, in determining appropriate discipline, may consider all previous safety violations that occurred before adoption of this policy. There are additional considerations that must be taken into account when managing employee performance. Such considerations may include the Family and Medical Leave Act (FMLA), state workers compensation laws, collective bargaining agreements, and local laws. This procedure should in no way be construed as a contract of employment, nor as conferring any contractual or other rights upon an employee, including a right to continued employment or employment for any specific period of time. This policy does not alter an employee at will status. Additionally, this policy may, at the discretion of the company, be modified, revoked or changed at any time with or without notice.
Code of Conduct The code of conduct policy of “Memory Technology Middle East and Subsidiaries” is a legal document that describes a set of rules that refers to ideal characteristics and behavior any employee should obey in the organization. The employee is liable to follow this agreement upon signage between a new recruit and the employer. The major purpose of this policy is to give importance to the organization’s principles, goals, mission, and values. “Memory Technology Middle East and Subsidiaries’” code of conduct describes the set of essential standards and regulations controlling decent and lawful behavior of each employee of the company. In addition, this policy describes the ideal relationship between the company’s staff with partners like customers, government agencies, suppliers, media, etc. Through this policy, “Memory Technology Middle East and Subsidiaries” creates a standard ethical behavior for its workplace. The policy extends to all the stakeholders of the “Memory Technology Middle East and Subsidiaries” regardless of the position or location, including directors, board members, employees, interns, suppliers, distributors, customers, and anyone in contact with the company. Purpose Scope Working Environment “Memory Technology Middle East and Subsidiaries” follows all the essential and applicable rules and regulations to ensure all its employees a comfortable working environment. Every active employee of the company is expected to fulfill their responsibilities ethically. If any of the coworkers are seen with improper misbehavior, it is an employee’s primary duty to inform or prevent them from doing so. In this way, employees can help the company implement a “zero-injury” environment. Bribery and Corruption The company strongly disregards any kind of direct or indirect bribery and corruption entertained by any stakeholders and considers it as a punishable offense. This also includes offering gifts, entertainment, hospitality, or other advantages in order to influence any decisions. Political Contributions & Charitable Donations Any corporate offerings to political parties, people, or action committees, including the endowment of services or materials for a value less than the market price, with the aim of a Quid-pro-quo arrangement in favor of the company, are not entertained. It will only be considered after written approval of “Authorized person’s-CEO”. Use of Company’s Assets Any assets assigned to employees that include IT equipment and access credentials such as e-mails, desktops, laptops, mobile phones, etc., must strictly be used for business purposes and not for personal usage
Training & Awareness All the employees who become a part of “Memory Technology Middle East and Subsidiaries” must read and acknowledge the Code of Conduct policy by filling out the Employee Certification form mentioned in Annexure. The training requirements will be applicable to both temporary and permanent employees if their job profile is considered important by the company. As far as training is concerned, the HR team will be accountable for setting its degree and nature. Employee Obligation Report In any case of doubts or questions, the employee is free to seek advice from the HR Manager, Line Manager, or CEO. In addition, the employee is also responsible for reporting any misconduct against any law of the code of conduct policy. Managing Ethical Dilemma In case of any ethical dilemma related to business, the employee has the right to consult their manager, HR Manager, or CEO and resolve the issues considering everyone’s interest. Monitoring & Administration The company’s CEO will govern the employees’ code of conduct. Any alterations to it seek immediate confirmation by the CEO, or The HR Manager. If any query or explanation is required, it shall first be discussed with the HR Manager, Operations Manager, or CEO. Dissemination The code of conduct policy will be shared on the employee’s portal and in the company’s common space. Confidentiality Employees may handle information related to customers, vendors, colleagues, the company, and its business partners. Any information that has not been publicly disclosed should be treated as confidential. Employees must protect sensitive information and exercise extra caution when dealing with regulated data, such as commercially sensitive information and personal data, to ensure compliance with legal and company requirements. The company requires all employees to protect personal and confidential information by following established data protection, confidentiality, and cybersecurity policies. Information should only be shared on a need-to-know basis, with appropriate safeguards and clear communication of confidentiality requirements. Employees must also comply with all information system security rules when accessing, strong, or transmitting electronic data.
Declaration of Confidentiality of Information I acknowledge that I have full legal capacity and understand that, during the course of my employment with the company, I may have access to confidential and highly sensitive information relating to the company, its branches, and its sister companies. This includes, but is not limited to, information related to customers, prospective customers, suppliers, vendors, employees, business records, product designs, software, installation, operation, maintenance, and post-sale services, as well as internal documents, account statements, business plans, and other proprietary or personal data. I hereby undertake to maintain the strict confidentiality of all company information and agree not to disclose, share, distribute, copy, destroy, or misuse it in any form, whether for personal benefit or for the benefit of any third party, with or without compensation. “Information” refers to all data, whether written, oral, electronic, visual, or stored in any form (including magnetic or optical media), that is directly or indirectly related to the company or its operations. This includes, but is not limited to, files, records, customer data, employee data, financial information, business plans, pricing, trade secrets, intellectual property, software, source code, designs, technical documentation, research, reports, and any other technical, financial, or commercial information belonging to the company or its affiliates. Upon termination or expiration of my employment for any reason, I further agree to the following: I will not use, sell, license, copy, or distribute any company products, software, or materials to any party, including clients or competitors. I will continue to maintain confidentiality and will not disclose any company information after leaving the organization. I will return all company property, including devices, documents, software, records, and any other materials belonging to the company or its affiliates. I will permanently delete any company-related data stored on personal or external devices and confirm that no copies are retained. I acknowledge that any work, inventions, designs, or materials created during my employment are the sole property of the company. This declaration remains valid throughout my employment and for a period of five (5) years after the termination or expiration of my employment. In the event of a breach of this declaration, I understand that I may be subject to disciplinary action, legal liability, financial compensation for damages, and forfeiture of end-of-service benefits in accordance with applicable labor laws and company policies.
US Export Administration Regulations (EAR) Most of the products we sell, fall under the definition of computer related products and so are regarded as “dual-use” products – that is they can be used for both good and malicious purposes. It is of utmost importance that MTC FZCO (Memory Technology Middle East FZCO.) fully complies with the US Export Administration Regulations (“EAR”), as any violation of the EAR can lead to loss of business with US companies (i.e., termination of our contracts for distribution of US-made products), fines and penalties or even placement of the Company on the Denied Persons List. Therefore, our company opted to fully comply with the said regulations. With the above in mind, it is the responsibility of each and every employee of our organization, to be updated on all banned destinations and sanctions per destination and to prevent products from being on-shipped to any such destination. The information needed to conform to these regulations is available to you online at: Export Administration Regulations (EAR) (doc.gov) EAR (Export Administration Regulations) Database. You are therefore all requested to disallow shipment to customers, in every case that you know or have suspicion that the products will end up going to a banned user, country or use. The following definitions are used in the EAR: Banned Countries of ultimate destinationii: US laws enforce certain sanctions for a number countries. Both the said countries and sanctions are adjusted by the US Government. Therefore, you are all responsible of keeping yourselves regularly updated, by visiting the site http://www.treas.gov/offices/enforcement/ofac/index.html (go to the ‘Search’ Function and type the country of preference i.e. Iraq to get the Document on Iraq’s Sanctions). Banned ultimate end-users: In addition to embargoed countries, there are three types of banned destinations identified by the US Government on the: Entity listiii, Denied Persons List (DPL) & Specially Designated Nationalsiv and Embargoed Countries and Entitiesv. The people/organizations on these lists are in many countries worldwide. If the end user has any association with: arms, chemicals, biological, nuclear, terrorism, or is a questionable foreign government department involved in this kind of research, it is likely they are on one of the lists. Furthermore, it is the responsibility of all the local Export Compliance Officers, to audit and ensure that all employees under their responsibility fully comply with EAR and keep themselves aware of any changes and updates. Banned ultimate end-uses: The banned end uses include research, development, design, manufacture, construction, testing or maintenance of: nuclear items, missiles and chemical and biological weapons.
US Export Administration Regulations (EAR) Procedures to be followed: 1. Screen the clients Before accepting an order, it is required that you screen the client against the Denied Persons List (DPL) prior to exporting the goods. EAR explicitly forbids selling to clients that appear to DPL. Therefore, you should decline the order immediately if the client appears on the list. 2. Decide if there are “red flags” When deciding on accepting an order, you must take into account any abnormal circumstances in a transaction that indicate that the export may be destined for an inappropriate end-use, end- user, or destination. Such circumstances are referred to as "red flags." Included among examples of red flags are orders for items which are inconsistent with the needs of the purchaser, a customer's declining installation and testing when included in the sales price or when normally requested, or requests for equipment configurations which are incompatible with the stated destination (e.g. a request of 120 volts in a country with a standard of 220 volts). Below is a list of such "red flags" which are not all-inclusive but are intended to illustrate the types of circumstances that should cause reasonable suspicion that a transaction will violate the EAR: 1. Quantity/specification ordered is unusual for that customer. 2. Customer is reluctant to offer information about the end-use of the products. 3. The quantity/specification of products does not fit the stated end-user’s business – e.g. a small company wants many high-capacity workstation modules. 4. The quantity/specification ordered is incompatible with the country to be shipped to – e.g. large quantity of high spec modules to a very small or technologically weak country. 5. Delivery is to an out-of-the-way place. 6. A freight forwarding firm is listed as the products’ final destination. 7. A specific / unusual shipping route has been requested. 8. Specific / unusual packaging is requested. 9. When questioned, the buyer is evasive about whether the purchased product is for domestic use, export or re-exports. New Customer – Red Flags 1 Any of above, or 2 Large orders from a new and unknown customer. 3 Customer has little or no business background. 4 Customer is willing to pay cash for a high value order. 5 Customer is unfamiliar with the product performance characteristics, but still wants the product.
US Export Administration Regulations (EAR) Procedures to be followed: 3. If there are “red flags” If there are no "red flags" in the information that comes in, you should be able to proceed with a transaction in reliance on information you have received. That is, absent "red flags" (or an express requirement in the EAR), there is no affirmative duty to inquire, verify, or otherwise "go behind" the customer's representations. However, when "red flags" are raised in the information that comes in, the Company has a duty to check out the suspicious circumstances and inquire about the end-use, end-user, or ultimate country of destination. Who is the end user? What is the ultimate country of destination? What is the end use, or end user’s business? Whatever the case may be, you must not “self-blind” by either: Telling the customer not to discuss details of the order Refraining from asking questions if suspicious. 4. Re-evaluate all the information after the inquiry The purpose of the above inquiry and re-evaluation is to determine whether the "red flags" can be explained or justified. If they can, you may proceed with the transaction. If the "red flags" cannot be explained or justified and you proceed, the Company runs the risk of having had "knowledge" that would make this action a violation of the EAR. If, after the re-evaluation you are still suspicious, do not ship and consult the Management for guidance.
Employee Handbook Acknowledgement and Declaration We want everyone to have a clear understanding of our workplace policies, expectations, and the way we work together. By acknowledging this Employee Handbook, I confirm that I have had the opportunity to read and understand the information shared in it. I understand that I am expected to follow the Company’s policies, guidelines, and standards, as well as any updates communicated to me from time to time. I understand that the Company may update its policies and procedures when needed to reflect changes in the business or applicable laws. I will make an effort to stay informed about any such updates. I also understand that this Handbook is intended to provide guidance on our workplace practices and does not, by itself, create or change the terms of my employment. If I have any questions or need clarification about any part of the Handbook, I understand that I can reach out to my manager or the HR team.
Founder & CEO Booklets are printed materials with four or more pages, containing details about a business, event, product, promotion, etc. They are also known as catalogs or pamphlets, and are usually created to communicate a message to a wide variety of audiences. Head of Human Resources Booklets are printed materials with four or more pages, containing details about a business, event, product, promotion, etc. They are also known as catalogs or pamphlets, and are usually created to communicate a message to a wide variety of audiences. Human Resources Business Partner Booklets are printed materials with four or more pages, containing details about a business, event, product, promotion, etc. They are also known as catalogs or pamphlets, and are usually created to communicate a message to a wide variety of audiences. XXXXX XXXX XXXXX MEET THE TEAM THE PEOPLE WHO MAKE UP TATON GROUP LTD. SHARE THE VISION AND VALUES OF OUR COMMUNITY pn
MTCMTC CONTACT US 123 Anywhere St., Any City, ST 012345 +91 12345 67890 | www.reallygreatsite.com hello@reallygreatsite.com | @reallygreatsite
