Information Security Policy

1. Purpose

ProMediate (UK) Limited is committed to protecting the confidentiality, integrity and availability of all information entrusted to us by consumers, traders, ADR Officials, staff and other stakeholders.

This Policy sets out the measures taken to safeguard information, reduce the risk of unauthorised access and ensure compliance with applicable legal and regulatory obligations.

2. Scope

This Policy applies to:

• Directors;
• ADR Officials;
• employees;
• consultants;
• contractors; and
• any person handling information on behalf of ProMediate.

It applies to both electronic and paper records.

3. Information Security Principles

ProMediate will:

4. Access Controls

Access to case information and personal data will only be granted where necessary for the performance of an individual's role.

User accounts, passwords and permissions will be managed to minimise unauthorised access.

Access will be removed promptly when no longer required.

5. Password Security

Users must:

• use strong passwords;
• keep passwords confidential;
• avoid sharing passwords;
• change passwords where compromise is suspected; and
• enable multi-factor authentication where available.

6. Secure Storage

7. Remote Working

Where information is accessed remotely:

• secure internet connections should be used;
• devices should be password protected;
• confidential information should not be left unattended; and
• appropriate care should be taken when working in public locations.

8. Email and Electronic Communications

Care should be taken to ensure that emails are sent to the correct recipients.

Confidential information should only be shared where necessary and appropriate.

9. Data Breaches

Appropriate steps will be taken to:

• investigate the incident;
• minimise any risk;
• comply with legal reporting obligations where applicable; and
• prevent recurrence.

10. Business Continuity

ProMediate will take reasonable steps to ensure that information remains available in the event of system failure or other disruption.

Appropriate backup arrangements and recovery procedures will be maintained where reasonably practicable.

11. Disposal of Information

Information will be securely disposed of in accordance with the Data Retention Policy.

Electronic records will be securely deleted.

Paper records will be confidentially shredded or otherwise securely destroyed.

12. Responsibilities

All Directors, ADR Officials, employees and contractors are responsible for protecting confidential information.

The Directors have overall responsibility for maintaining appropriate information security arrangements.

13. Review

This Policy will be reviewed annually or sooner if required by changes in legislation, regulatory guidance or operational requirements.

Version History