Information Security Policy | RoyaltyStatistics

Introduction

We all hold personal data about our employees, clients, suppliers and other individuals for a variety of business purposes. The information security system within our company is aimed at protecting employees, partners and customers of the company from illegal or damaging actions by individuals, either directly or implied, knowingly or unknowingly, when processing information and data which come at their disposal, as well as using certain equipment for the fulfilment of their work duties.

This policy sets out how we seek to protect personal data and ensure that staff understand the rules governing their use of personal data to which they have access to in the course of their work.

The policy shall apply to the processing of information within any systems or held on any media involved in the data/information processing within the company, irrespective of whether data/information processing is related to internal business operations of the company or to external relations of the company with any third parties.

This policy applies to all staff. We may supplement or amend this policy with additional policies and guidelines from time to time. Our Data Controller has overall responsibility for the day-to- day implementation of this policy.

More details can be found in the following documents:

Data Retention and Erasure Policy
Information Classification Policy

It is our policy to use all reasonably practicable measures to ensure that:

Information will be protected against unauthorised access
Confidentiality of information is assured
Integrity of information is maintained
Regulatory and legislative requirements will be met
Where necessary Business Continuity plans will be produced, maintained and tested
RoyaltyStat LLC requirements for availability of information and information systems will be met
The rights of all data subjects are protected at all times
We are able to respond to requests from data subjects professionally and courteously

This statement should be read in conjunction with other policies that relate in whole or in part to the following:

The use of the computer resources (including Internet & Email)
The use of computer systems
Data Protection

We aim to conduct our business in compliance with the relevant data protection laws and regulations, including, but not limited to the EU General Data Protection Regulation.

All managers are responsible for implementing the Policy within their areas, and for adherence by their staff. Staff should report breaches of information security, actual or suspected, to their manager. Breaches of the security policies will be investigated in accordance with the company's HR procedures.

In the event, when a reportable data breach occurs and US residents are affected, we shall report it to the competent supervisory authority in accordance with the USA national data protection laws. In case the data breach affects EU residents we shall report it to the competent authority in the respective Member States.

Our policy is based on implementation and ongoing management of the Cyber Essentials framework across the organisation as a minimum.

We will ensure an appropriate firewall is in place to protect our internet connection
A boundary firewall and/or personal device firewall will be installed

We will ensure the highest level of security setting on all devices (PC/Laptops, mobile phones, tablets, CCTV)
We will remove devices and services we do not use from the network
We will use appropriate user access / password controls
We will use 2 factor authentication for email accounts which process sensitive data

We will establish appropriate access control processes and mechanisms
We will only use licensed software and devices

We will install appropriate virus and malware protection mechanisms.

We will ensure software and devices are updated regularly

The following sections define these requirements in more detail.

The purposes for which personal data may be used by us includes, but is not limited to

Personnel
Administrative
Financial
Regulatory
Payroll and business development purposes
Business operation hand business development
Providing our PR services to our clients

Business purposes include the following

Providing our services to our clients
Compliance with our legal, regulatory and corporate governance obligations and good practice
Ensuring business policies are adhered to (such as policies covering email and internet use)
Operational reasons - providing our services to our clients and Investigating complaints
Investigating complaints
Checking references, ensuring safe working practices, monitoring and managing staff access to systems and facilities and staff absences, administration and assessments
Monitoring staff conduct
Marketing our business
Improving services
Security of our premisses including CCTV

Information relating to identifiable individuals, such as

job applicants
current and former employees
agencies
contractors and other staff
clients
suppliers, partners, and other third parties
marketing contacts
details of data subjects / individuals collected as part of our sales, lead generation and marketing activities
target data subjects involved in our campaigns
media / press / company representatives
CCTV video and audio
all other data subjectsSensitive Personal Data

Personal data we gather may include: individuals' contact details, demographic information, life-style, gender, sexuality, educational background, financial and payment information, details of certificates and diplomas, education and skills, family information, marital status, nationality, job title and CV etc.

Although we do not generally collect sensitive data in some cases we may hold personal data about an individual's racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership (or non-membership), physical or mental health condition, criminal offences or related proceedings. Any use of sensitive personal data should be strictly controlled in accordance with this policy. We will take appropriate precautions to protect sensitive personal data at all times.

We must process personal data fairly and lawfully in accordance with individuals' rights. This generally means that we should not process personal data unless the individual whose details we are processing has consented to this happening or where we are confident that the balance of legitimate interest is a reasonable lawful basis on which to operate. We will complete a Legitimate Interest assessment and where necessary a DPIA to ensure we take appropriate care of all data.

In most cases where we process sensitive personal data, we will require the data subject's explicit consent to do this unless exceptional circumstances apply or we are required to do this by law and to comply with legal obligations, for example Health And Safety at Work regulations. Any such consent will need to clearly identify what the relevant data is, why it is being processed and to whom it will be disclosed.

We will ensure that any personal data we process is accurate, adequate, relevant and not excessive, given the purpose for which it was obtained. We will not process personal data obtained for one purpose for any unconnected purpose unless the individual concerned has agreed to this or would otherwise reasonably expect this.

Staying updated on data protection responsibilities, risks and issues
Reviewing all data protection procedures and policies on a regular basis
Arranging data protection training and advice for all staff
Ensuring all systems, services, software and equipment meet acceptable security standards
Checking and scanning security hardware and software regularly to ensure it is functioning properly
Approving data protection statements attached to emails and other marketing copy
Addressing data protection queries from clients, target audiences or media outlets
Coordinating with the other team members to ensure all marketing initiatives and PR campaigns adhere to data protection law and the company's data protection policy
Researching third-party services (such as cloud services) that the company is considering using to store or process data members and those included in this policy
Answering questions on data protection from staff, board members and other stakeholders
Responding to individuals such as clients and employees who wish to know which data is being held on them by RoyaltyStat LLC
Checking and approving with third parties that handle the company's data, any contracts or agreement regarding data processing

It is the responsibility of everyone to keep personal data secure against loss or misuse. Where other organisations process personal data as a service on our behalf, it will be established what, if any, additional specific data security arrangements need to be implemented in contracts with those third party organisations.

All staff will receive training on this policy. New joiners will receive training as part of the induction process. Further training will be provided whenever there is a substantial change in the law or to our policy and procedure. Completion of training is compulsory.

The importance of this policy means that failure to comply with any requirement may lead to disciplinary action under our procedures which may result in dismissal. If you have any questions or concerns about anything in this policy, do not hesitate to contact the data controller.

The following to be applied as appropriate to our organisation:

Confidentiality of all company data is to be maintained through discretionary and mandatory access controls
External service access is restricted to authorised personnel only
Access to data on all laptop computers is to be secured through encryption or other means to provide confidentiality of company data in the event of loss or theft of company equipment
Only authorised software may be installed
The use of unauthorised software is prohibited. In the event of unauthorised software being discovered it will be removed immediately
Data may only be transferred for approved purposes
All removable media from external sources must not be attached to our computer equipment unless prior approval is granted
Passwords must consist of a mixture of at least 8 alphanumeric characters
The physical security of computer equipment will conform to company requirements
To prevent the loss of availability of company IT resources measures must be taken to backup data, applications and the configurations of all workstations.

Care should be taken when using USB or other types of media brought in from outside the company
Management strongly endorse the company's anti-virus policies and will make the necessary resources available to implement them
Users will be kept informed of current procedures and policies
Users will be notified of virus incidents
Employees will be accountable for any breaches of the company's antivirus policies
Antivirus policies and procedures will be reviewed regularly
In the event of a possible virus infection the user must inform management immediately. Arrangements will be made to scan the infected machine and any servers or other workstations to which the virus may have spread and eradicate it.

Users will only be given sufficient rights to all systems to enable them to perform their job function. User rights will be kept to a minimum at all times
Where possible no one person will have full rights to any system
Access to the network/servers and systems will be by individual username and password
Usernames and passwords must not be shared by users
Usernames and passwords should not be written down
Intrusion detection will be implemented where considered necessary and/or at the request of our clients
Users will be given a username and password to login to systems, servers, applications as appropriate
We will be notified of all employees leaving the company's employment. We will then remove the employees' rights to all systems
Network/server supervisor passwords and system supervisor passwords will be stored in case of an emergency
Use of the admin usernames on systems are to be kept to a minimum
Default passwords on systems and other resources will be changed after installation.

LAN (Local area network) equipment, hubs, bridges, repeaters, will be secure.

All unused workstations must be switched off outside working hours.
Users must comply with the terms of our Bring Your Own Device police where applicable

All cloud storage will be made securely with all appropriate measures taken to ensure data is protected, backed-up, and safe at all times

Managers will keep a full inventory of all computer equipment and software in use throughout the company

Connections to the Internet will be via the means of a firewall to regulate network traffic

If an email is received from an unknown source and you are unsure of its legitimacy then delete it and please inform your manager
When you start to type in the name of the recipient, email software will suggest similar addresses you have used before. If you have previously emailed several people, whose name or address starts the same way - e.g. "Dave" - the auto- complete function may bring up several "Daves". Make sure you choose the right address before you click send
If you want to send an email to a recipient without revealing their address to other recipients, make sure you use blind carbon copy (bcc), not carbon copy (cc). When you use cc every recipient of the message will be able to see the address it was sent to
Be careful when using a group email address. Check who is in the group and make sure you really want to send your message to everyone
When forwarding emails ensure that company privacy is protected at all times, especially when forwarding a chain of emails
Email should always be constructed in a professional manner as the email you are sending is representing the company and the brand the recipient could forward that email onto another party. When sending company data, you must avoid doing so in an anti-competitive way. This includes but is not limited to, price fixing, restricting competitors selling your product, bid rigging, failure to abide by this rule will be dealt with through the disciplinary system.

All data and information collected and processed in any form (paper, electronic etc.) shall be subject to the requirements of this policy. Any regulation in respect to collection, processing, protection and retention of data/information and such documents shall be stored in a safe place as designated by the company for a retention period provided for by applicable laws and/or indicated by the company
Employees are not permitted to keep any confidential information on mobile devices except information which is temporarily needed for specific, work related activity. Any download of such files to local devices should be avoided or limited only to necessity related with information processing for work purposes
Internet access and operations performed by employees according to the requirements of the applicable laws and regulations may be filtered and monitored by duly authorised IT personnel of or on behalf of the company
Any mobile, portable devices (including laptops, tablets, smartphones and other handheld computing devices) as well as any cloud information storage places should be approved by the company and secured to prevent unauthorised access
Only systems and program software licensed and authorised by the company can be installed and used on equipment and tools used within the company. Before downloading or installing any software to devices held and used by employees for the purposes described in this policy permission from the management team shall be obtained
In cases when employees use home devices the employees shall be obliged to comply with the requirements of this policy; equally as if they were using equipment provided by the company. Accordingly, it shall be prohibited to store any data and information related to the company on the device; any processing of the data shall be permitted only through cloud and online storage places used by the company
In case access is granted to the employee to a system of a client or cooperation partner of the company; the employee shall be obliged to use the access tools provided by the client or partner and follow provided guidelines on secure information/data processing requirements (including use of encryption systems, passwords, data use limitations, using dedicated locations etc.)
No information/data referred to in this policy shall be sent, forwarded or otherwise submitted to any third party, unless it is necessary for the accomplishment of work duties of the employee. In the case of forwarding and submission of data to third parties, it shall be ensured that the data is protected and corresponding security measures have been taken
The company shall audit the systems used in the processing of information/data to control ongoing compliance with this policy and applicable statutory requirements

We will retain personal data for no longer than is necessary. What is necessary will depend on the circumstances of each case, taking into account the reasons why that personal data was obtained, but should be determined in a manner consistent with our data retention guidelines. For more information refer to the data retention and erasure policy document.

Encryption protects information stored on mobile and static devices and in transmission. It is a way of safeguarding against unauthorised or unlawful processing of data. There are a number of different encryption options available.

Anonymisation of personal data should be considered where possible and desirable. Anonymisation ensures the availability of rich data resources, whilst protecting individuals' personal data.

The company will consider encryption alongside other technical measures, taking into account the benefits and risks that it can offer. Appropriate technical and organisational measures will be taken against unauthorised or unlawful processing of personal data and against accidental loss, destruction or damage to personal data.

There are restrictions on international transfers of personal data. You must not transfer personal data anywhere outside the UK without first consulting the Data Controller.

Save for exceptions specifically established; in no case and under no circumstances should any equipment, systems or tools owned by the company, its clients or cooperation partners be used for purposes not related to work duties of the employee or not related to business operation of the company.

Breach of this policy can lead to disciplinary action and other legal action.

Installation, copying, distribution or storage on any RoyaltyStat LLC systems or equipment of any illegal software, online platforms, any other electronic contents which are not licensed for use of by RoyaltyStat LLC
Violation of the rights of any person by excessive and unnecessary collection and processing of personal data
Accessing data, storage or an account for a purpose other than conducting business operation of RoyaltyStat LLC or performance of work duties of the particular employee
Exporting company information in breach of applicable international or national laws and regulations and/or directions of RoyaltyStat LLC
Exporting of any data or information which is of proprietary and/or confidential value to the company, if such exporting is not required in the course of business operation of RoyaltyStat LLC or performance of work duties of the employee and/or is in breach of internal regulations of the company, applicable laws or regulations
Revealing an employee's account password to others and allowing the use of such account by others (including but not limited to employee's family members)
Effecting security breaches or disruptions of network communication. Such security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account which the employee is not expressly authorised to access, unless such access rights are granted to the employee due to him/her being involved in a specific project of the company

All information/data processing security incidents or threatened incidents shall be immediately reported to management, which accordingly shall take all measures for prevention of potential damage, elimination of the damage caused and restitution of previous security status
If applicable, it shall be the obligation of the management to ensure further reporting on data/information security breach to all relevant authorities and individuals involved as provided for by applicable laws and regulations and/or laws of the European Union

This document should be reviewed and amended regularly to ensure compliance.

Introduction

Scope

Information Security Policy Statement

Our approach to Data Protection

Data Breach and Reporting

Cyber Essentials

Firewall

Devices

Access Control

Virus and Malware Protection

Updates

Definitions

Purposes Of Personal Data

Business purposes

Personal Data

Fair processing

Roles and Responsibilities

Company responsibilities

Data Security - Personal Responsibilities

Security Policies

Summary of Main Security Policies

Virus Protection

Access Control

Physical LAN Security

Hubs/Switches

Workstations

Servers [including cloud services]

Inventory Management

Internet Security

Email Security

Data Storage

Data Retention

Encryption And Anonymisation Policy

Transferring Data Internationally

Prohibited Activities

The Following Activities Are Prohibited, With No Exceptions

Reporting Security Incidents

Review