PRIVACY POLICY
Information we collect
We may collect and process the following information:
How we collect information and why
Most of the information we process is provided to us directly by you as required to enjoy the services we offer.
We also collect information directly from any social media posts or activity you engage in which tags us, mentions us or the products and services we sell.
We use all the information we collect to help match our services to your needs and to align you with a community of similar users in our system.
We do not share this information with anyone.
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:
How we store information
All the information we collect is stored on secure clouds globally (in the UK and USA). Where applicable these systems are also PCI compliant. Access to these secure cloud locations is restricted to company employees only.
Your data protection rights
Under UK data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal inform you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us if you wish to make a request.
How to contact us
Infratech Digital (UK) Limited – [email protected]
How to complain:
If you have any concerns about our use of your personal information, you can make a complaint to us directly.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Cheshire, SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Purpose
Information that’s collected, analysed, stored, communicated and reported upon may be subject to theft, misuse, loss and corruption. Information may be put at risk by poor education and training, and the breach of security controls.
Information security incidents can give rise to embarrassment, financial loss, non-compliance with standards and legislation, as well as possible judgements being made against Infratech Digital (UK) Limited (‘Infratech’).
This high level Information Security Policy sits alongside the ‘Information Risk Management Policy’ and ‘Data Protection Policy’. This is to provide the high-level outline of, and justification for, Infratech’s risk-based information security controls.
Objectives
Infratech’s security objectives are that:
Scope
The Information Security Policy and its supporting controls, processes and procedures apply to all information used at Infratech, in all formats. This includes information processed by other organisations in their dealings with Infratech.
The Information Security Policy and its supporting controls, processes and procedures apply to all individuals who have access to Infratech’s information and technologies. This includes external parties that provide information processing services to Infratech.
Compliance monitoring
Compliance with the controls in this policy will be monitored by the Information Security Team, and reported to the Information Governance Board.
Review
A review of this policy will be undertaken by the COO. This will be annually or as required, and will be approved by the CTO.
Policy Statement
It is Infratech’s policy to ensure that information is protected from a loss of:
Infratech will implement an Information Security Management System based on certified standards as required. Infratech will be mindful of the approaches adopted by its stakeholders, including research partners.
Infratech will adopt a risk-based approach to the application of the following controls:
A set of lower-level controls, processes and procedures for information security will be defined, in support of the high-level Information Security Policy and its stated objectives. This suite of supporting documentation will be approved by the COO, published and communicated to Infratech users and relevant external parties.
Infratech will define and implement suitable governance arrangements for the management of information security. This will include identification and allocation of security responsibilities, to initiate and control the implementation and operation of information security within Infratech.
Infratech will appoint:
Infratech’s security policies and expectations for acceptable use will be communicated to all users to ensure that they understand their responsibilities. Information security education and training will be made available to all staff. Poor or inappropriate behaviour will be addressed.
Where practical, security responsibilities will be included in role descriptions, person specifications and personal development plans.
All assets will be documented and accounted for. This includes:
Owners will be identified for all assets and they will be responsible for the maintenance and protection of their assets.
All information assets will be classified according to their legal requirements, business value, criticality and sensitivity. Classification will indicate appropriate handling requirements. All information assets will have a defined retention and disposal schedule.
Access to all information will be controlled and will be driven by business requirements. Access will be granted or arrangements made for users according to their role and the classification of information, only to a level that will allow them to carry out their duties.
A formal user registration and de-registration procedure will be maintained for access to all information systems and services. This will include mandatory authentication methods based on the sensitivity of the information being accessed, and will include consideration of multiple factors as appropriate.
Specific controls will be implemented for users with elevated privileges, to reduce the risk of negligent or deliberate system misuse. The separation of duties will be implemented, where practical.
Infratech will provide guidance and tools to ensure proper and effective use of cryptography to protect the confidentiality, authenticity and integrity of information and systems.
Information processing facilities are housed in secure areas, physically protected from unauthorised access, damage and interference by defined security perimeters. Layered internal and external security controls will be in place to deter or prevent unauthorised access and protect assets. This includes those that are critical or sensitive, against forcible or hidden attacks.
Infratech will ensure the correct and secure operations of information processing systems. This will include:
Infratech will maintain network security controls to ensure the protection of information within its networks. Infratech will also provide the tools and guidance to ensure the secure transfer of information both within its networks and with external entities. This is in line with the classification and handling requirements associated with that information.
Information security requirements will be defined during the development of business requirements for new information systems or changes to existing information systems.
Controls to reduce any risks identified will be implemented where appropriate.
Systems development will be subject to change control and separation of test, development and operational environments.
Infratech’s information security requirements will be considered when establishing relationships with suppliers, to ensure that assets accessible to suppliers are protected.
Supplier activity will be monitored and audited according to the value of the assets and the associated risks.
Guidance will be available on what constitutes an information security incident and how this should be reported. Actual or suspected breaches of information security must be reported and will be investigated. The appropriate action to correct the breach will be taken, and any learning built into controls.
Infratech will have in place arrangements to protect critical business processes from the effects of major failures of information systems or disasters. This is to ensure their timely recovery in line with documented business needs. This will include appropriate backup routines and built-in resilience.
Business continuity plans must be maintained and tested in support of this policy. Business impact analysis will be undertaken, detailing the consequences of:
The design, operation, use and management of information systems must comply with all statutory, regulatory and contractual security requirements.
Currently this includes:
Infratech will use a combination of internal and external audits to demonstrate compliance against chosen standards and best practice, including against internal policies and procedures. This will include:
Review of this document: annually by COO
Next review date: August 2025.