In order to comply with our legal and regulatory obligations, we are required to keep certain information for defined periods of time and must not delete or dispose of such information before any retention periods have expired. Examples include (but are not limited to) tax information, financial statements, contracts or agreements, certain marketing information, and HR documentation. In addition, privacy laws may mean that we cannot hold people’s information for any longer than necessary.

We are all responsible for managing records and information in accordance with the Group Records & Information Management Procedure, which sets out the rules for all Employees. It is also important that we recognize that certain records and information may need to be kept beyond the normal retention period for legal reasons, such as those under a ‘Hold Order’. If you are informed that you may have information subject to a Hold Order, you must not alter, destroy, or delete it in any way.

In our efforts to collaborate with our colleagues and third parties, non-BAT communications applications hosted by third parties, such as Instant Messaging or personal email applications, can be a popular channel for communication.

However, the use of Third-Party Communications Applications for work can pose risks to the Company in the context of cybersecurity and our ability to adhere to records and information management obligations.

We recognize that there are exceptional occasions where using such communications channels may be critically required (e.g. broadcast messaging for health and safety purposes when no other channel is available). These exceptions are set out in the Group Records & Information Management Procedure.

Save for those permitted exceptions, the use of Third-Party Communications Applications for any work-related communications is strictly prohibited.

All transactions and contracts must be properly authorized at all levels and accurately and completely recorded.

All contracts entered into by Group Companies, whether with another Group Company or a third party, must be evidenced in writing.

If we are responsible for preparing, negotiating or approving any contract on behalf of a Group Company, we must make sure that it is approved, signed and recorded in accordance with the relevant contracts approval policy and procedures.

All documents prepared by a Group Company in connection with sales of its products, whether for domestic or export, must be accurate, complete and give a proper view of the transaction.

All documentation must be retained (together with relevant correspondence), where required for possible inspection by tax, customs or other authorities, in line with the requirements of the Group Records & Information Management Procedure and any applicable local laws.

We must cooperate fully with the Group’s external and internal auditors, and ensure that all information held by them which is relevant to the audit of any Group Companies (relevant audit information) is made available to that company’s external auditors.

Our obligation to cooperate fully with external auditors is subject to legal constraints, for example, in the case of legally privileged documents.

Otherwise, we should respond promptly to any request by external auditors and allow them full and unrestricted access to relevant staff and documents.

Under no circumstances should we provide information to external or internal auditors which we know (or ought reasonably to know) is misleading, incomplete or inaccurate.

Financial data (e.g. books, records and accounts) must conform both to generally accepted accounting principles and to the Group’s accounting and reporting policies and procedures.

Group Companies’ financial data must be maintained in line with the generally accepted accounting principles applying in their country of domicile.

For Group reporting, data must be in line with the Group’s accounting policies (IFRS) and procedures.