IT SECURITY POLICY

IT/Cyber security is a critical issue for Liasion Onecall and unlike large organisations, small businesses often lack the resources (physical, human and financial) to cope with the challenge of becoming cyber secure.

At Liaison Onecall, we have adopted the UK governments Cyber Security framework and we protect our information and our clients data with the implementation of critical security controls as well as a method of demonstrating to clients and stakeholders that Liaison Onecall is secure.

According to the framework, the critical cyber security controls organisations need to implement are:

• Secure configuration – all Liaison Onecall devices are built with security measures (encryption) and users have specific devices that are password protected
• Boundary firewalls and internet gateways – these provide a basic level of protection using windows firewall when we connect to the internet. We only using client internet connections and tethering to Liaison Onecall mobile devices as hotspots. We do not use public WiFi
• Patch management – Liaison Onecall keeps it's software used on computers and network devices up-to-date, therefore resisting low-level cyber attacks
• Malware protection – We install and regularly update anti-virus/malware protection software

DATA RETENTION POLICY

Data Storage:

• We are committed to ensuring personal data is only obtained, processed and stored when there is a specific need, for the relevant timeframe and with appropriate consent
• We have conducted a review to identify how personal data is obtained, stored and processed when delivering our services to clients and prospective clients and carrying out the day-to-day operations of the business (Data Map)
• We commit to remove data if consent is not obtained
• We commit to respecting the individual rights under the GDPR regulations

Data Retention Periods:

• Personal data is only retained for as long as is necessary and according to the terms of consent obtained
• We have conducted a review to identify the timeframe personal data is required for processing (Data Map)

During the Retention Period:

• We conduct regular reviews of the personal data held
• Our data map is updated following each review, and additional consent is obtained to reflect any changes

After the Data Retention Period:

• After the expiry of the applicable retention period, we will erase or anonynise the data. This can be achieved by:
• erasing the elements which can identify a data subject
• erasing single pieces of information that identify the data subject (whether alone or in combination with other pieces of information);
• separating personal data from non-identifying information (e.g. an order number from the customer’s name and address); or
• aggregating personal data in a way that no individual can be identified
• In some cases, no action will be required if data cannot be allocated to an identifiable person at the end of the retention period, for example, because the pool of data has grown so much that personal identification is not possible based on the information retained; or the identifying data has already been deleted.

Information Obligations:

• We will notify data subjects:
• the retention period;
• if no fixed retention period can be provided – the criteria used to determine that period; and
• the new retention period if the purpose of processing has changed after personal data has been obtained.