Information Security Policy

INFORMATION SECURITY POLICY

Statement of Policy Toby Sinclair Coaching Limited (the Employer, we or our) is committed to the highest information security standards and treats data security and confidentiality extremely seriously. This Policy and the rules contained in it apply to all staff of the Employer, irrespective of seniority, tenure and working hours, including all employees, directors and officers, consultants and contractors, temporary and agency workers, trainees, casual and fixed-term staff, apprentices, interns and any volunteers (Staff or you). All Staff must familiarise themselves with this Policy and comply with its terms.

Purpose of Policy Under the UK General Data Protection Regulation (UK GDPR), the Employer must ensure the security of personal data by using appropriate technical or organisational measures, protect against unlawful or unauthorised data processing and accidental loss, and demonstrate integration of data compliance measures into processing activities. This Policy is designed to protect against potential breaches of confidentiality, safeguard the Employer’s information assets and systems, reinforce compliance with UK laws and internal policies, and clarify the responsibilities of Staff in relation to information and data security.

This Policy does not form part of your employment contract and may be amended at any time at our discretion. Updated versions will be circulated accordingly.

Definitions Business Information refers to any business-related information of the Employer other than personal data. Confidential Information includes any trade secrets or confidential information, whether belonging to the Employer or third parties. Personal Data means any information related to an identifiable individual. Sensitive Personal Data refers to information about a person’s race, political opinions, religious beliefs, union membership, health, sex life, sexual orientation, and biometric or genetic data used for identification.

Roles and Responsibilities All Staff are responsible for maintaining information security. The Data Protection Officer (DPO) has overall responsibility for this Policy, including its implementation and maintenance, monitoring breaches, educating Staff, and ensuring compliance with UK GDPR and related laws.

Scope of the Policy This Policy covers all forms of information, regardless of media, including paper, handheld devices, telephones, computer systems, and verbal communication. It applies to Personal Data, Business Information, and Confidential Information.

This Policy complements other policies, including the Data Retention Policy, and all must be followed together.

General Principles All information is to be treated as valuable and protected against loss, theft, misuse, or unauthorised access. Appropriate technical and organisational measures must be used to secure all Personal Data, especially Sensitive Personal Data, from unlawful processing or accidental damage. Information is owned by the Employer and must only be used for authorised business purposes. Personal Data must be processed only for specified, legitimate purposes.

Information Management Personal Data must comply with data protection principles and internal policies. It must be relevant, limited, accurate, and up to date. Measures to keep data secure include encryption, dual-factor authentication, strong passwords, and password protection on sensitive documents. Personal Data and Confidential Information must be stored and disposed of in line with the Data Retention Policy.

Human Resources (HR) Information Personnel files are confidential and accessible only to HR. Other Staff may access them only as required by their roles. Recruitment and managerial staff must also treat such information as strictly confidential. Staff may request access to their own files and data under UK GDPR.

Access to Offices and Information Office access must be secured. Keys and codes must not be shared. Confidential materials must be placed away from view. Visitors must sign in, be escorted at all times, and not be exposed to confidential materials. Meetings should occur in designated spaces, and any documents or devices must be locked when not in use.

Computers and IT All devices must be password-protected and locked when unattended. Passwords must be strong, regularly updated, and not written down or shared. Data must be backed up according to internal procedures. Confidential data must not be copied to removable media without approval. Any such data must be promptly moved to the Employer’s systems and then deleted from the device. Staff must avoid downloading unauthorised software and ensure antivirus protections are in place. For guidance, speak with the Founder, who is responsible for IT.

Communications and Transfer of Information When speaking in public places, Staff must protect confidentiality. Confidential documents must be clearly marked and only shared on a need-to-know basis. If documents are taken off-site, security precautions must be taken, including password protection and secure storage. Care must be taken when emailing information to ensure accuracy, especially with autocomplete functions. Sensitive content should be encrypted before transmission.

Personal Email and Cloud Storage Accounts Staff must not use personal email or cloud storage accounts for work due to lower security. Large data transfers should be discussed with the Founder.

Working From Home Staff must not take information home unless authorised. At home, data must be securely stored and inaccessible to others. Home devices must not be used to store Confidential Information. Information must be disposed of according to internal policies.

Transfers to Third Parties Third-party processors must have written agreements in place to ensure adequate data security. Staff working with such providers must consult the DPO to confirm compliance with UK GDPR.

International Data Transfers Transfers outside the UK are restricted unless adequate protections are in place. Staff must consult and obtain written approval from the DPO before any such transfers. More details are available in the Data Protection and Security Policy online at https://www.realtalkstudio.com/policies. Any questions should be directed to the DPO or Legal.

Training All Staff will receive data protection training at induction and at regular intervals, especially after policy or legal changes. This training is mandatory. Staff may request additional training from the DPO if needed.

Reporting Data Breaches Staff must report actual or suspected data breaches immediately. This enables prompt investigation, recording, and notification to relevant authorities when required. Contact the DPO for procedures.

Consequences of Non-compliance Breaches of this Policy are taken seriously and may lead to disciplinary action, including dismissal. Questions should be directed to the DPO at toby@realtalkstudio.com.

Attribution This Policy was created using a document from Rocket Lawyer (https://www.rocketlawyer.com/gb/en).