Information Security Policy
“Our clients trust us with their information. Protecting it is part of doing the job properly.”
– Guy Dawson, CEO
Purpose
This policy sets out how Payless Promotions protects its systems and the information it holds about clients, suppliers and staff from loss, misuse and unauthorised access. It works alongside our Privacy and Cookie Policy, which sets out how we collect, use and disclose personal information.
Scope
This policy applies to all staff and contractors in Australia and overseas, and to all Payless Promotions systems, devices, email, software and data, including information supplied to us by clients.
Information We Hold
We hold business contact details, order and artwork files, and delivery details (names, phone numbers and addresses of recipients) needed to fulfil orders. We do not intentionally collect sensitive information, and we do not store full payment card details.
How We Protect Our Systems
- Managed network security – our network and cyber security are managed by an external network provider under a paid service agreement.
- Vulnerability scanning – our cyber insurer’s security software regularly scans our systems for weaknesses. Any issue identified is fixed promptly.
- Cyber insurance – we hold cyber insurance to support response and recovery if an incident occurs.
- Access control – staff and contractors are given access only to the systems and information they need for their role. Access is removed promptly when someone leaves or changes role.
- Passwords and logins – each person uses their own login. Passwords are not shared, and multi-factor authentication is used wherever our systems support it.
- Devices and software – work devices are kept up to date with security updates and protected by security software.
- Backups – business-critical data is backed up so it can be restored if lost or compromised.
Sharing Information With Suppliers
We share client information with suppliers, decorators and freight providers only to the extent needed to fulfil an order, such as delivery details. We do not sell or otherwise disclose client information.
Staff Responsibilities
- Keep logins secure and never share passwords
- Be alert to phishing and suspicious emails, links and attachments, and report them
- Lock devices when unattended and report lost or stolen devices immediately
- Handle client information only for the purpose it was provided
Incident Response
- Our network provider monitors for security alerts, including outside business hours, and responds immediately.
- Any suspected incident must be reported straight away to the CEO.
- We will contain the incident, investigate, and notify our cyber insurer.
- Affected clients will be notified promptly. Where an incident is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.
Responsibilities
- CEO – owns this policy and ensures it is resourced and reviewed.
- Network provider – manages network security, monitoring and incident response under our service agreement.
- Leadership team – ensures staff follow this policy and that access is managed when staff start or leave.
- All staff – follow this policy and report any concern immediately.
Monitoring and Review
- We act on vulnerability scan findings as they are reported.
- This policy is reviewed annually, or sooner after an incident or a significant change to our systems.
