Information Security Policy

Purpose and scope

This policy applies to all Helvino staff, contractors and partners, and to all systems we build, host or support. Its aim is to protect the confidentiality, integrity and availability of information, and to meet our duties under the Data Protection Act, 2019, including data protection by design and by default under section 41.

Responsibilities

• The Directors are accountable for information security and for resourcing it.
• The Data Protection Officer oversees compliance, advises staff and is the contact point for clients and the ODPC.
• Every member of staff must follow this policy and report suspected incidents immediately.

Access to information

• Access is granted by role and limited to what the job requires.
• Staff access client data only to deliver or support the service, or on the client's instruction.
• Accounts are individual, and credentials must never be shared.
• Access is removed promptly when someone leaves or changes role.
• Everyone with access to personal data is bound by written confidentiality obligations.

Handling data

• Personal data must not be copied to personal devices or personal accounts.
• Live client data must not be used for testing or training when test data can be used instead.
• Credentials and secrets are kept out of source code.
• Personal data is shared with third parties only under a contract, an instruction from the client, or a legal requirement.

Suppliers

We assess the security of a supplier before it handles personal data, and we publish the suppliers that act as our sub-processors.

Incidents and breaches

Any suspected incident must be reported at once to the Data Protection Officer and handled under our Data Breach Response Policy.

Compliance and review

Breach of this policy may lead to disciplinary action. The policy is reviewed at least once a year, and after any significant incident or change in the law.