Information security and data protection standards

Information security and data protection standards

Scope Company and customer information handled through business systems, devices, support activity, site work, communications and approved suppliers.

Purpose and standard

Phone Guys will protect information from unauthorised access, loss, alteration and misuse, and handle personal data for defined and lawful purposes. Controls must reflect the information, service and risk.

Accountability and data roles

The director is accountable for approving information risks, resources and responsibilities. The operations lead must identify the systems, information, owners and suppliers used for each service. Before processing customer data, record whether Phone Guys acts as controller or processor, the permitted purpose, instructions, access, retention and incident responsibilities. Put the required contract and data terms in place before access.

Access and working practices

• Use individual authorised accounts, the minimum access needed and strong authentication appropriate to risk. Enable multifactor authentication where available, prioritising privileged and remote access. Record any exception and compensating control.
• Use approved devices and software, protect stored and transmitted information appropriately, lock unattended devices and apply supported security updates. Verify implementation rather than assuming a product provides protection by default.
• Keep passwords, recovery codes and keys in an approved controlled method. Do not send them through public forms, chat, shared documents or ordinary support correspondence.
• Approve and record remote customer access, confirm the person requesting a sensitive change and end access when the work, role or relationship ends.
• Collect only necessary personal information, keep it accurate and apply a documented retention and secure disposal decision. Handle sensitive and criminal-record information with additional care.

Continuity suppliers and service records

Identify information and configurations needed for recovery, choose proportionate backup and restoration arrangements and record actual test results. Assess suppliers before sharing data or granting access, including contractual, security, retention and any international transfer requirements. Customer monitoring, logs, recovery targets and subcontractor arrangements must be defined for the actual service; none are guaranteed by this public policy.

Incident and concern procedure

• Report a suspected loss, unauthorised access, phishing attempt, disclosure or material service risk to the operations lead promptly. Preserve evidence and avoid unauthorised changes that could destroy it.
• The operations lead will assess and contain the incident with authorised assistance, record affected information and services, and escalate significant risks to the director and relevant customer contact.
• The director will assess notification duties and applicable deadlines promptly, using current ICO guidance and specialist advice where needed. A processor must support the controller and follow the agreed incident terms. Record the notification decision and its basis.
• Agree recovery action, verify restoration and permissions, record the cause where established and assign corrective actions. Do not claim an incident is resolved solely because a service restarts.

Privacy requests and public reporting

Use [email protected], 03300 557 595 or written contact to the director for policy or privacy questions and to request a secure reporting route. Do not send passwords, camera credentials, payment details or sensitive evidence through the public Concierge. For an urgent incident, use the agreed customer incident contact and escalate if no response is obtained; public contact channels are not an emergency or continuously monitored service.

Existing notices and review

The current privacy notice, cookie notice, CCTV page and customer data terms continue to explain their specific purposes and boundaries. The operations lead must maintain records of actual providers, data roles, lawful purposes, retention and authorised access. Review these standards annually and after a significant incident, system change or relevant legal change.

Questions about this policy

For a policy question or correction, use the Phone Guys contact page. Do not send confidential customer, employee, security or incident information through a public enquiry.