INFORMATION SECURITY POLICY

Statement of Policy

Wiin Ltd is committed to the highest standards of information security and treats data security and confidentiality extremely seriously.This Policy and the rules contained in it apply to all staff of the Employer, irrespective of seniority, tenure and working hours, including all employees, directors and officers, consultants and contractors, temporary and agency workers, trainees, casual and fixed-term staff, apprentices, interns and any volunteers (Staff or you).All Staff must familiarise themselves with this Policy and comply with its terms.

Purpose of Policy

In relation to personal data, under the UK General Data Protection Regulation (theUK GDPR), the Employer must:ensure the security of personal data, including protection against any unlawful or unauthorised data processing and accidental loss, damage or destruction, by utilising appropriate technical or organisational measures; demonstrate the consideration and integration of data compliance measures into the Employer’s data processing activities, by implementing appropriate technical or organisational measures; and be able to demonstrate the use and implementation of such appropriate technical or organisational measures.The purpose of this Policy is to:protect against any potential breaches of confidentiality; protect the Employer’s informational assets and IT systems and facilities against any loss, damage or misuse; supplement the Employer’s Data Protection and Security Policy in ensuring that Staff are aware of and comply with UK laws and the Employer’s policies and procedures on the processing of personal data; and raise awareness of and clarify the responsibilities and duties of Staff in respect of information security, data security and confidentiality.This is a statement of policy only and does not form part of your contract of employment. The Employer may amend this Policy at any time, in our absolute discretion, and we will do so in accordance with our data protection and other obligations. A new copy of the Policy will be circulated whenever it is changed.For the purposes of this Policy:Business Information means any of the Employer’s business-related information other than personal data about customers, clients, suppliers and other business contacts;Confidential Information means any trade secrets or other confidential information (belonging to the Employer or third parties) processed by the Employer;Personal Data means any information that relates to an individual who can be identified from that information, either directly or indirectly; and Sensitive Personal Data means information about an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership (or non-membership), health, sex life, sexual orientation, genetic information or biometric information (where this is used to identify an individual).

Roles and Responsibilities

All Staff have a responsibility for information security. TheEmployer’s Data Protection Officer (DPO)has overall responsibility for this Policy. Specifically, they must:implement and maintain this Policy; monitor potential and actual security breaches; ensure Staff are aware of their responsibilities in relation to information security and confidentiality; and ensure compliance with the UK GDPR and all other relevant legislation and guidance.

Scope of This Policy

This Policy covers all written, verbal and digital information held, used or transmitted by or on behalf of the Employer, irrespective of media. This includes, but is not limited to:paper records; hand-held devices; telephones; information stored on computer systems; and information passed on verbally.The information covered by this Policy may include:Personal Data relating to Staff, customers, clients or suppliers; other Business Information; and Confidential Information.This Policy supplements the Employer’s Data Protection and Security Policy and other policies relating to data protection, internet, email and communications, and document retention, including the Employer’s:

General Principles

All information must be:treated as commercially valuable; and protected from loss, theft, misuse or inappropriate access or disclosure.Through the use of appropriate technical and organisational measures all Personal Data, including Sensitive Personal Data, must be protected against:unauthorised and/or unlawful processing; and accidental loss, destruction or damage.Staff and line managers should discuss what security measures (including technical and organisational measures) are appropriate and which exist to protect any information accessed by Staff in the course of employment.Any information, apart from Personal Data, is owned by the Employer and not by an individual or team.Any information must only be used in connection with work being undertaken for the Employer. It must not be used for any other personal or commercial purposes.Any Personal Data must only be processed for the specified, explicit and legitimate purpose for which it is collected.

Information Management

Any Personal Data must be processed in accordance with:the data protection principles; the Employer’s policies on data protection generally(including the Data Protection and Security Policy); and the Employer’s other relevant policies. All Personal Data collected, used and stored must be:adequate, relevant and limited to what is necessary for the relevant purposes; and kept accurate and up to date.The Employer will take appropriate technical and organisational measures to ensure that Personal Data is kept secure and protected against unauthorised or unlawful processing, and against accidental loss, destruction or damage. These measures include:The encryption of Personal Data.Dual-factor authentication.The use of strong passwords.Any Personal Data and Confidential Information must not be kept any longer than is necessary and will be stored and destroyed in accordance with ourpolicies on data retention.

Human Resources (HR) Information

Due to the internal confidentiality of personnel files, access to these files and any information contained therein is limited to the HR Department. Non-HR Staff are not authorised to access HR information, except as provided for in any individual roles.Personnel information must also be kept strictly confidential by any Staff involved in:the recruitment process; a management role; or a supervisory role.Under the UK GDPR and other relevant legislation, Staff may ask to see their personnel files and obtain access to any other Personal Data about them.

Access to Offices and Information

All office doors, office keys and access codes must, at all times, be kept secure. Office keys and access codes must at no time be given to or communicated to any third parties. All documents containing and any equipment displaying Confidential Information should be placed and positioned so that anyone passing by cannot see them (e.g. through office windows or glass doors). Any visitors must:sign it at reception; be accompanied by Staff at all times; and not be left alone in areas or situations where they may have access to Confidential Information.Meetings with visitors must, where possible, take place in meeting rooms. If a visitor meeting takes place outside a meeting room, in an office or other room containing Employer information, steps must be taken to ensure no Confidential Information is visible and accessible to the visitors.All paper documents, backup systems and devices containing Confidential Information must be securely locked away: whenever desks are unoccupied; and at the end of the working day.

Computers and IT

Where available on our systems, password protection and encryption must be used to maintain confidentiality. All computers and other electronic devices must be password protected. Such passwords must be changed regularly and must not be recorded anywhere (e.g. written down) or made available to others. To minimise the risk of accidental loss or disclosure, all computers and other electronic devices must be locked when not in use, including when left unattended at a desk.All data held electronically must be securely backed up as soon as possible in accordance with the Employer’s internal backup procedure.Confidential Information must not be copied onto removable hard drives, CDs or DVDs, floppy disks or memory sticks, without the express permission of theThe person responsible for computers and IT is Peter Withers.. Any Personal Data held on such devices must, as soon as possible, be transferred to the Employer’s computer network to be backed up and then deleted from the device.Staff must: ensure that they do not introduce viruses, malware or malicious codes onto the Employer’s systems. not install or download from the internet any software without it first being checked for viruses.

The person responsible for computers and IT is Peter Withers.

Communications and Transfer of Information

When speaking in public places (e.g. when speaking on a mobile phone), Staff must take care in maintaining confidentiality.Confidential Information must be marked ‘strictly private and confidential’ and circulated only to those who need to know the information in the course of their work Confidential Information must not be removed from the Employer’s offices (and systems) unless required for authorised business purposes, and then only in accordance with the subsequent paragraph.If the removal of Confidential Information from the Employer’s offices is permitted, all reasonable steps must be taken to maintain the confidentiality and integrity of the information. This includes, but is not limited to, Staff ensuring that Confidential Information is:stored with strong password protection, with devices and files kept locked when not in use; not transported in see-through or other unsecured bags or cases, when in paper copy; not read in public places when working remotely (e.g. in waiting rooms or on trains); and not left unattended or in any place where it is at risk (e.g. in airports or conference centres).Care must be taken to verify all postal and email addresses before any information is sent to them. Particular care must be taken when checking and verifying email addresses where auto-complete features may have inserted incorrect email addresses.Before being sent by email or recorded delivery, all sensitive or particularly confidential information should be encrypted.

Personal Email and Cloud Storage Accounts

Personal email accounts (e.g. Google, Hotmail and Yahoo) and cloud storage services (e.g. Google Drive, iCloud and OneDrive) are vulnerable to hacking and do not provide the same level of security as the services provided by the Employer’s IT systems.Staff must not use personal email accounts or cloud storage accounts for work purposes.If large amounts of data need to be transferred, Staff should speak to theThe person responsible for computers and IT is Peter Withers..

Data Protection and Security MeasuresTwo-Factor Authentication (2FA):

To enhance the security of our clients' customer data, we require the use of Two-Factor Authentication (2FA) for all access to our systems where customer data is processed or stored. This additional security layer helps ensure that access to sensitive data is granted only to verified individuals.

2FA protects against unauthorised access resulting from compromised credentials by requiring a second form of verification beyond just a password, namely a 6 digit code that is sent to a users registered email address, that must then be inputted for access to the AutoEngage dealer account.

Secure Data Storage:

All client customer data is securely stored on industry-leading cloud services provided by Amazon Web Services (AWS) and Google Cloud Platform (GCP). These platforms are designed with multiple layers of operational and physical security to ensure the integrity and safety of data:

Amazon Web Services (AWS): We utilise AWS's secure data centres and network architecture built to meet the requirements of the most security-sensitive organisations. Data is stored in highly secure AWS facilities that maintain various levels of security certifications, ensuring that data is safeguarded against unauthorised access and data breaches.

Google Cloud Services: Similarly, our use of Google Cloud Services includes comprehensive security features that comply with international security and data protection standards. Data is encrypted in transit and at rest, using robust cryptographic protocols.

Compliance and Monitoring:

We continuously monitor compliance with our security policies and conduct regular security reviews and audits to adapt to new security threats or compliance requirements. Both AWS and Google Cloud provide tools that assist in these monitoring activities to ensure our security measures are always up to date and effective.

By implementing these practices, we are committed to protecting the security and privacy of our clients' customer data from unauthorised access and breaches.

Downloading of Client Customer Data

Strict Prohibition on Data Downloading:

At AutoEngage, we maintain a stringent policy that prohibits the downloading of client customer data by any party. This policy is a crucial component of our commitment to data security and privacy protection.

Implementation of Technical Barriers:

To enforce this policy, our systems are equipped with technical controls that prevent the downloading, extraction, or copying of any customer data. These measures are designed to ensure that all customer data remains secure within our managed environments without the risk of unauthorised removal or disclosure.

Access Controls:

Access to our systems is strictly regulated through role-based access controls (RBAC) that ensure only authorised personnel have access to the data they need to perform their job functions. This access does not include the ability to export or download sensitive customer information.

Audit and Monitoring:

Our security systems continuously log and monitor all activity concerning customer data. Any attempt to download or export data triggers automatic alerts and initiates an immediate review to assess and respond to the unauthorized activity. This monitoring helps to maintain the integrity and confidentiality of all client customer data.


Working From Home

Unless required for authorised business purposes, and then only in accordance with the subsequent paragraph, Staff must not take information home with them.Where information is permitted to be taken home, Staff must ensure that appropriate technical and practical measures are in place within the home to maintain the continued security and confidentiality of that information. In particular, all Confidential Information and Personal Data must be:kept in a secure and locked location, where it cannot be accessed by others (including family members and guests); and retained and disposed of in accordance with paragraph 21 above.Staff must not store any Confidential Information on their home computers or other devices (e.g. laptops, PCs or tablets).

Transfers to Third Parties

Third party service providers should only be engaged to process information where appropriate written agreements are in place to ensure that they offer appropriate data protection, confidentiality and information security protections and undertakings. Care must be taken to consider whether any such third party service providers will be considered data processors for the purpose of the UK GDPR.Staff involved in the process of setting up new arrangements or altering existing arrangements with third parties should speak to and consult with the DPO for more information and guidance.

International Data Transfers

There are restrictions on (onward) transfers of Personal Data to international organisations outside of the UK.Staff may only transfer Personal Data outside the UK (including to international organisations outside the UK) if there are sufficient and adequate protections in place. Before making any transfers, Staff should speak to, and seek written authorisation from, theDPO.For more information,see the Employer’s Data Protection and Security Policy available from the DPO and online at: https://autoengage.co.uk/data-protection-policy. If you have any questions or concerns please contact the DPO or Legal Department.

Training

The Employer will provide training on the concepts and measures contained in this Policy to all Staff as part of the induction process and at regular intervals thereafter or whenever there is a substantial change in the law or our policies and procedures training is provided online. The completion of such training is compulsory. The Employer will continually monitor training needs but if you feel that you need further training on any aspect of the relevant law or this Policy, please contact the DPO.

Reporting Data Breaches

All Staff are under an obligation to report actual or potential data protection compliance breaches to enable the Employer to:investigate the breach and take any necessary remedial actions; maintain a register of compliance breaches; and make any applicable notifications (e.g. to the Information Commissioner’s Office).For more information on the Employer’s reporting procedure, contact theDPO.

Consequences of Non-compliance

The Employer takes compliance with this Policy very seriously and failure to comply with this Policy puts Staff and the Employer alike at significant risk.Due to the importance of this Policy, failure to comply with any of its procedures and requirements may result in disciplinary action and dismissal.If you have any questions or concerns about anything in this Policy, please contact the DPO at [email protected].