Skip to content

Latest commit

 

History

History
123 lines (84 loc) · 4.42 KB

POL-013-confidentiality-policy.md

File metadata and controls

123 lines (84 loc) · 4.42 KB

POL-013 - Confidentiality Policy

Revision Revision Date Author Description of changes
v0.0.1 2017-07-06 Vladimir Ursu Initial Document
v0.0.2 2017-07-07 Eugene Istrati Approved

1. OVERVIEW

See Purpose.

2. PURPOSE

We designed Mitoc Group (the "Company") confidentiality policy to explain how we expect our employees to treat confidential information. Employees will unavoidably receive and handle personal and private information about clients, partners and the Company. We want to make sure that this information is well-protected.

We must protect this information for two reasons. It may:

  • Be legally binding (e.g. sensitive customer data)
  • Constitute the backbone of our business, giving us a competitive advantage (e.g. business processes)

3. SCOPE

This policy affects all employees, including board members, investors, contractors and volunteers, who may have access to confidential information.

4. POLICY

4.1 Policy elements

Confidential and proprietary information is secret, valuable, expensive and/or easily replicated. Common examples of confidential information are:

  • Unpublished financial information
  • Data of Customers/Partners/Vendors
  • Patents, formulas or new technologies
  • Customer lists (existing and prospective)
  • Data entrusted to our company by external parties Pricing/marketing and other undisclosed strategies
  • Documents and processes explicitly marked as confidential Unpublished goals, forecasts and initiatives marked as confidential

Employees may have various levels of authorized access to confidential information.

4.2 What employees should do

  • Lock or secure confidential information at all times
  • Shred confidential documents when they're no longer needed
  • Make sure they only view confidential information on secure devices
  • Only disclose information to other employees when it's necessary and authorized Keep confidential documents inside our company's premises unless it's absolutely necessary to move them

4.3 What employees shouldn't do

  • Use confidential information for any personal benefit or profit
  • Disclose confidential information to anyone outside of our company
  • Replicate confidential documents and files and store them on insecure devices

When employees stop working for our company, they're obliged to return any confidential files and delete them from their personal devices.

4.4 Precautionary Measures

We'll take measures to ensure that confidential information is well protected. We'll:

  • Store and lock paper documents
  • Encrypt electronic information and safeguard databases
  • Ask employees to sign non-compete and/or non-disclosure agreements (NDAs)
  • Ask for authorization by senior management to allow employees to access certain confidential information

4.5 Exceptions

Confidential information may occasionally have to be disclosed for legitimate reasons. Examples are:

  • If a regulatory body requests it as part of an investigation or audit
  • If our company examines a venture or partnership that requires disclosing some information (within legal boundaries)

In such cases, employees involved should document their disclosure procedure and collect all needed authorizations. We're bound to avoid disclosing more information than needed.

4.6 Disciplinary Consequences

Employees who don't respect our confidentiality policy will face disciplinary and, possibly, legal action.

We'll investigate every breach of this policy. We'll terminate any employee who willfully or regularly breaches our confidentiality guidelines for personal profit. We may also have to punish any unintentional breach of this policy depending on its frequency and seriousness. We'll terminate employees who repeatedly disregard this policy, even when they do so unintentionally.

This policy is binding even after separation of employment.

5. POLICY COMPLIANCE

5.1 Compliance Measurement

The Information Security Team will verify compliance to this policy through various methods, including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.

5.2 Exceptions

Any exception to the policy must be approved by the Information Security Team (security@mitocgroup.com) in advance.

5.3 Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.