Data Protection Policy
Last updated on February 1, 2022
1. Introduction
Our Data Protection policy indicates that we are dedicated to and responsible of processing the information of our employees, customers, stakeholders and other interested parties with absolute caution and confidentiality. This policy describes how we collect, store, handle and secure our data fairly, transparently, and with confidentiality.
This policy ensures that MSECB follows good practices to protect the data gathered from its customers, employees, and stakeholders. The rules outlined in this document apply regardless of whether the data is stored electronically, on paper or on any other storage device.
2. Policy Elements
As a key part of our operations, we gather and process any information or data that makes an individual identifiable such as names, addresses, usernames and passwords, digital footprints, photographs, etc.
This information is collected only with the full cooperation and knowledge of interested parties. Once this information is available to us, the following rules apply to our company.
Our data will:
- Be precise and consistently updated,
- Is collected legitimately and with a clearly stated purpose
- Be processed by the company in line with its legal and ethical binds
- Have protection measure that protects it from any unauthorized or illegal access occurring by internal or external parties
Our data will NOT:
- Be communicated informally
- Exceed the specified amount of time stored
- Therefore, personal data of employees, customers, and affiliates who no longer use MSECB services will be archived for 3 years, and deleted afterwards
- Be transferred to organizations, states or countries that do not acquire proper data protection policies
- Be spread to any party unless approved by the data’s owner (except for the legitimate requests demanded from law enforcement authorities)
3. Roles and Responsibilities
Everyone who works for or with MSECB is responsible for ensuring that the collection, storage, handling, and protection of data is being done appropriately. The contact person responsible for managing the Data Protection process is:
Person: Information Security Manager
Email: [email protected]
In addition, the following people/departments have key areas of responsibility:
Information Security Manager is responsible for:
- Providing oversight and continuous enhancement of cyber security awareness programs and improvements on risk management;
- Collaborating with the Security Committee and leading the design, implementation, operation and maintenance of the Information Security Management System based on the ISO/IEC 27000 series standards;
- Ensuring periodic testing is conducted to evaluate the security posture of IS by conducting periodic reviews of ISs to ensure compliance with the System Security Plans (SSP);
- Leading the design and operation of related compliance monitoring and improvement activities to ensure compliance both with internal security policies, and applicable laws and regulations;
- Developing and managing controls to ensure compliance with the wide variety and ever changing requirements resulting from laws, standards and regulations.
IT Systems Manager is responsible for:
- Strictly complying with all MSECB policies related to non-disclosure, non-competition and confidentiality of information;
- Constantly staying up to date on various web technologies and tools;
- Performing networking systems hardware and software upgrades, and installing security patches as needed;
- Checking and monitoring the general health of networks and networking devices;
- Performing daily system monitoring, verifying the integrity and availability of all hardware, server resources, systems and key processes, reviewing system and application logs, and verifying completion of scheduled jobs such as backups;
- The implementation, configuration and maintenance of computer networks, software, and digital security.
Compliance Department is responsible for:
- Ensuring that the data of the certified organizations and auditors is only accessible for authorized personnel;
- Ensuring that the access to certified organizations and auditors personal data will not be shared with or provided to unauthorized personnel;
- Ensuring the additional documents and data provided by applicant organizations and auditors is being stored appropriately and centralized to ensure the confidentiality, availability, and integrity of the data.
Commercial Department is responsible for:
- Ensuring that access to MSECB Authorized Distributors and Partners personal data is restricted only for authorized personnel;
- Ensuring that the access to MSECB Authorized Distributors and Partners personal data will not be shared with or provided to unauthorized personnel;
4. General guidelines
- Access to data covered by this policy should be restricted only to those who need it for their work.
- Data should not be shared informally. When access to confidential information is required, employees can request it from their line managers.
- MSECB provides comprehensive training to all employees to help them understand their responsibilities when handling data.
- Employees should keep all data secure, by taking sensible precautions and following the Data Storage guidelines specified below.
- In particular, strong passwords must be used and they should never be shared.
- Personal data should not be disclosed to unauthorized people, neither within the company or externally.
- Employees should request help from their line manager or the data protection officer if they are unsure about any aspect of data protection.
5. Data Storage
These rules describe how and where data should be safely stored. When data is stored on paper, it should be kept in a secure place where unauthorized people are not allowed access.
These guidelines also apply to data that is usually stored electronically but has been printed out for certain reasons:
- The paper or files should be kept in a locked drawer or filing cabinet.
- Employees should make sure paper and printouts are not left where unauthorized people access them, such as on a printer, or desk.
- Data printouts should be securely shredded and disposed of when no longer required.
When data is stored electronically, it must be protected from unauthorized access, accidental deletion and malicious hacking attempts:
- Data should be protected by strong passwords that are changed regularly and never shared between employees.
- If data is stored on removable media (like a CD or DVD), these should be kept locked away securely when not being used.
- Data should only be stored on designated servers at MSECB premises, and should only be uploaded on to approved cloud computing services.
- Minimum requirements for encryption are AES 128 Bit. This is for data in transport or at rest. In premises or in cloud.
- Secure communication is empowered in MSECB with TLS (Transport Layer Security) using Office 365 or Sendinblue while communicating via email.
- Servers containing personal data must be sited in a secure location, where access is restricted for authorized personnel only. Should be monitored and access controlled.
- Data should be backed up daily. Those backups should be tested regularly, in line with the company’s standard backup procedures.
- Data should never be saved directly to laptops or other mobile devices like tablets or smart phones.
- All servers and computers containing data should be protected by approved security software and a firewall.
- All data entering into MSECB systems and website is stored as unique and measures to prevent privilege escalation are taken.
- All data entering into the database of the MSECB website are protected with certificates that ensure encrypted communication when receiving and sending information is being used.
6. Data Usage
- All data collected by MSECB is strictly for MSECB-related services required to ensure a complete response/service is being provided by MSECB. No other non-MSECB related service will be offered from the data collected.
- When working with personal data, employees should ensure their computer screens are always locked when left unattended.
- Personal data should not be shared informally. In particular, it should never be sent by email, uploaded in cloud drives, or transferred in external drives as this form of communication is not secure.
- Data must be encrypted before being transferred electronically.
- Employees should not save copies of personal data to their own computers. Always access and update the central copy of any data.
7. Data accuracy and action
To exercise data protection, MSECB takes reasonable steps and is committed to:
- Restrict and monitor access to sensitive data, and keep it in as few places as necessary
- Establish effective data collection procedures
- Provide employees with online privacy and security measures training
- Build secure networks to protect online data from cyberattacks
- Establish clear procedures for reporting privacy breaches or data misuse
- Include contract clauses or communicate statements on how we handle data
- Update the data continuously and as mistakes are discovered
- Ensure the marketing databases are checked against industry suppression files
- Install tracking logs to monitor employee’s activities ensuring data is not being misused
- Install firewall and protection software that prevents employees to share and distribute data from MSECB devices externally, by detecting when a large amount of data is being transferred either through email, or via external drives.
- Establish data protection practices (document shredding, secure locks, data encryption, frequent backups, access authorization etc.)
8. Subject Access Requests
All individuals and organizations who are the subject of personal and other data held by MSECB are entitled to:
- Ask what information MSECB holds about them and why.
- Ask how to gain access to it.
- Be informed how to keep it up to date.
- Be informed how the company is meeting its data protection obligations.
If an individual contacts the company requesting this information, this is called a subject access request. Requests from individuals should be made by email, addressed to the data protection officer at [email protected]. The data controller can supply a standard request form, although individuals do not have to use this.
Our clients can contact us directly requesting these information through the subject access request. Such requests can be made via email addressed at our Data Protection Officer at [email protected]. We will always verify the identity of anyone making a subject access request before handing over any information.
The first copy of a data subject will be provided free of charge by. However, a fee of 30$ will be charged for further copies requested by the data subject. We will aim to provide the relevant data within 14 days.
8.1 Data Modification
Our clients can contact us requesting data modification and/or correction by sending an email to [email protected]. MSECB will verify the identity of anyone making a data subject access request before modifying or correcting any information.
8.2 Data Erasure
Our clients can contact us requesting data erasure via email at [email protected]. In addition, data subject will be provided with all necessary information before proceeding with erasure.
Before proceeding with the erasure, the data subject will read the statement of our data protection officer, explaining the outcome of the data being deleted. Erasure of data can be requested at any time.
9. Cross Border data transfer
Adequacy decisions by the European Commission in regard to cross border data transfer. The European Commission has so far recognized Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the US (limited to the Privacy Shield framework) as providing adequate protection. In addition, we ensure data protection and privacy for the information it possess for natural persons, therefore we are in compliance with the legislative requirements. The point of contact for all Data Protection Authorities (DPAs) and individuals in the EU on all issues related to data processing is [email protected].
10. Children
Our website is not appealing to children, nor are they directed to children younger than 16. MSECB does not knowingly collect personally identifiable data from persons under the age of 16, and strives to comply with the provisions of The Office of the Privacy Commissioner of Canada (OPC) and European Union General Data Protection Regulation (EU GDPR). If you are a parent of a child under 16, and you believe that your child has provided us with information about him or herself, please contact us at [email protected].
11. Disclosing data
In certain circumstances, when required, MSECB can disclose data to law enforcement agencies without the consent of the data subject. However, the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.
12. Privacy Policy
We have a privacy policy available on our website, stating out how data relating to customers, stakeholders, employees, and other parties involved is used in our company. Our data privacy policy is available here: Privacy Policy – MSECB