Data Protection & Information Security Policy

Document Version: 2026.1
Last Updated: 01 May 2026
Review Date: 01 May 2027

1. Purpose

Edworthy Media and Technology Limited is committed to protecting the confidentiality, integrity and availability of all information entrusted to us by clients, suppliers, staff and third parties.

This policy outlines the measures implemented to ensure sensitive and personal data is processed securely and in accordance with applicable UK legislation and recognised cybersecurity best practices.

This policy applies across all company operations and services including:

• IT support and technology sales
• Website development and maintenance
• Search Engine Optimisation (SEO)
• Social media marketing
• Paid advertising management
• Software and portal development
• CRM and business system development
• Technical consultancy and support services

2. Legislative Compliance

Edworthy Media and Technology Limited operates in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)
• Applicable cybersecurity and data protection best practices

Where third-party systems or providers are used as part of service delivery, reasonable steps are taken to ensure suppliers maintain appropriate security standards and GDPR compliance.

3. Information Security Principles

The company follows the core principles of:

• Confidentiality — ensuring information is accessible only to authorised individuals
• Integrity — safeguarding the accuracy and completeness of information
• Availability — ensuring systems and data remain accessible when required

4. Data Collection & Processing

We only collect and process data necessary for:

• Delivering contracted services
• Customer support and account management
• Billing and administration
• Security monitoring and fraud prevention
• Legal and regulatory obligations

Depending on the services provided, data processed may include:

• Contact information
• Business information
• Website content and credentials
• CRM and portal data
• Email communications
• Marketing and advertising analytics
• Technical support records
• User account information

Sensitive or confidential data provided by clients is handled only where necessary for service delivery.

5. System & Application Security

Systems and applications developed or managed by Edworthy Media and Technology Limited are protected using appropriate security controls, including where applicable:

• Role-based access permissions
• Secure authentication methods
• Password protection policies
• Multi-factor authentication where applicable
• Firewall and web application security measures
• Malware protection
• Software update and patch management
• Activity logging and monitoring
• Restricted administrative access

Administrative access to systems and client data is restricted to authorised personnel only.

6. Encryption & Secure Transmission

Where applicable, data transmitted between systems, websites and users is encrypted using industry-standard SSL/TLS encryption.

Secure authentication methods are used to protect administrative and client access systems.

7. Access Control

Access to company systems and client information is controlled through:

• Individual user accounts
• Role-based permissions
• Strong password requirements
• Multi-factor authentication where applicable
• Audit and access logging

Access privileges are restricted to the minimum level required for operational duties.

8. Protection of Data Within Client Systems During Support

Edworthy Media and Technology Limited develops systems such as CRMs, portals, forms and other business applications for clients. These systems may contain personal, confidential or sensitive information entered by the client, their staff, their customers, service users or other authorised users.

When a client requests technical support, troubleshooting, maintenance or development changes, authorised Edworthy Media and Technology Limited personnel may need to access the system to investigate or resolve the issue. During this process, information stored within the system may be visible.

To protect this information:

• Access is only undertaken where required to provide requested support, maintenance or development work.
• Access is limited to authorised personnel involved in resolving the support request.
• Staff do not browse, search or review client data unless it is necessary to understand or resolve the issue.
• Screenshots, exports, reports or database copies containing sensitive information are not taken unless specifically required and authorised by the client.
• Information viewed during support is not copied, repeated, disclosed, stored separately or used for any purpose outside the support request.
• Where test data is sufficient, real client data is avoided.
• Where practical, clients are asked to provide example record IDs or non-sensitive examples rather than sending sensitive information by email.
• Any credentials or temporary access provided for support are handled securely and removed or disabled when no longer required.
• Support access is treated as confidential and subject to internal access controls.

Where a fault requires deeper investigation using live data, Edworthy Media and Technology Limited will keep access limited to the minimum necessary to diagnose and resolve the issue. Sensitive data will not be extracted from the system unless there is a clear technical need and the client has authorised this.

9. Third-Party Platforms & Providers

Where third-party providers or platforms are used as part of service delivery, reasonable steps are taken to ensure providers maintain appropriate security standards and GDPR compliance.

Examples may include:

• Cloud software providers
• Advertising platforms
• CRM systems
• Website platforms
• Email and communication systems

Third-party access is limited to the services required for operational delivery.

10. Backup & Business Continuity

Where systems or applications are managed directly by Edworthy Media and Technology Limited, reasonable measures are taken to support:

• Business continuity
• Disaster recovery
• Restoration following technical failure

Where backups are maintained, access is restricted to authorised personnel only.

11. Staff & Operational Security

Personnel with access to company systems or client information are expected to:

• Follow secure working practices
• Maintain confidentiality
• Use authorised systems and devices only
• Report suspected security incidents promptly

Administrative activities are restricted to authorised users.

12. Data Retention

Information is retained only for as long as necessary to:

• Deliver contracted services
• Meet legal and accounting obligations
• Maintain operational records
• Resolve disputes or security matters

Data no longer required is securely removed or anonymised where appropriate.

13. Security Incidents & Data Breaches

Any suspected data breach or security incident is investigated promptly.

Where required under UK GDPR, appropriate reporting procedures will be followed, including notification to the Information Commissioner’s Office (ICO) and affected parties where legally necessary.

14. Remote Working & Device Security

Remote administrative access is secured using encrypted protocols and restricted authentication controls.

Devices used to access company systems are expected to maintain:

• Updated operating systems
• Password protection
• Anti-malware protection where applicable
• Secure network connections

15. Policy Review

This policy is reviewed periodically and may be updated to reflect operational, legal or security changes.

16. Contact Information

For data protection or information security enquiries, please contact:

Edworthy Media and Technology Limited
Website: Edworthy Media and Technology Limited
Email: info@edworthymedia.co.uk