1. Purpose
This procedure sets out how NicoByte Solutions will protect customer information when providing IT support and technology services. It applies to customer information stored by NicoByte Solutions and information that may be accessed while working on customer computers, phones, networks or other devices. NicoByte Solutions will take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.
2. Basic Security Principles
- Only access information that is reasonably necessary to perform the agreed work.
- Do not browse through personal files without a legitimate reason.
- Do not copy customer information unless it is necessary for the agreed service.
- Do not disclose customer information to anyone who is not authorised to receive it.
- Keep customer information secure during and after every job.
- Use the minimum level of access necessary to complete the work.
- Remove temporary copies of customer information when they are no longer required.
- Keep software and security systems used by NicoByte Solutions appropriately updated.
3. Customer Devices
- Confirm the customer’s identity where reasonably necessary.
- Confirm what work has been requested.
- Explain if the work may require access to personal files or information.
- Obtain the customer’s approval before carrying out additional work.
- Only access information reasonably necessary for the agreed service.
- Avoid opening personal documents, photographs, emails or other private information unless doing so is necessary to diagnose or resolve the agreed problem.
- Do not intentionally copy or retain customer files unless required for the service.
- Remove temporary files created during the job when they are no longer required.
4. Customer Passwords
- NicoByte Solutions should avoid receiving or storing customer passwords whenever reasonably possible. Preferred methods include asking the customer to enter their own password, using temporary access codes, official account-recovery procedures, or secure remote-support authentication.
- If a password must temporarily be provided, it must not be written down unnecessarily, stored in plain text or shared with another person. The customer should be advised to change the password after the work where appropriate.
- NicoByte Solutions will never intentionally request a customer’s banking PIN, payment-card PIN or similar highly sensitive authentication information.
5. Remote Support
- Remote support must only take place with the customer’s permission. Before connecting, explain that remote access will be used, explain the purpose, obtain approval, use reputable remote-support software and ensure the customer can understand when the session is active where possible.
- During the session, only access information necessary for the agreed work, do not intentionally browse unrelated files or accounts, do not download customer information unnecessarily and do not leave remote access active after the job has finished.
- After the session, end the remote-support connection, remove temporary access where possible and confirm completion with the customer.
6. Customer Data Transfers
- Confirm which files are being transferred.
- Use secure transfer methods where reasonably possible.
- Avoid using unsecured public file-sharing services.
- Do not retain copies longer than necessary.
- Confirm successful transfer before deleting an original copy.
- Customers should be encouraged to maintain their own backups.
7. Backups
- Confirm what is being backed up and where the backup will be stored.
- Explain that a backup does not guarantee recovery from every possible failure.
- Do not delete the customer’s original files unless specifically authorised.
- Where practical, verify that the backup has completed successfully.
- NicoByte Solutions should not describe a service as a guaranteed backup or guaranteed data-recovery service unless the appropriate processes and technology are in place.
8. NicoByte Business Information
- Business accounts should use strong, unique passwords.
- Multi-factor authentication should be enabled wherever available.
- Devices used for business activities should have appropriate security updates.
- Important business information should be backed up.
- Business devices should use screen locks.
- Customer information should not be stored unnecessarily on personal devices.
9. Physical Security
- Equipment should not be left unattended unnecessarily.
- Devices should be transported securely.
- Customer paperwork should not be left visible to unauthorised people.
- Equipment should be returned to the correct customer.
- Any loss or theft of customer equipment should be reported and assessed immediately.
10. Third-Party Software
- NicoByte Solutions may use third-party software to provide services, including remote-support, cloud-storage, invoicing, communication or security tools. Before using a third-party service to process customer information, NicoByte Solutions should consider what information the service receives, why it receives the information, where it is stored, what security measures are available, and whether the provider has appropriate contractual/data-protection arrangements.
- Where NicoByte Solutions is acting as a processor for a business customer, third-party processors should only be used in accordance with the customer’s instructions and any required contractual authorisation.
11. Business Customer Data
- When providing IT services to a business, NicoByte Solutions must determine whether it is acting as a data controller, a data processor, or potentially another legally recognised role.
- Where NicoByte Solutions is processing personal data on behalf of a business customer as a processor, an appropriate written data-processing agreement must be put in place before the relevant processing begins.
12. Data Retention
NicoByte Solutions will avoid keeping customer information longer than necessary. Temporary information created during technical support should be deleted when the work is complete, the information is no longer required and there is no legitimate reason to retain it. Business and financial records will be retained where necessary to meet legal or accounting requirements.
13. Data Breaches
A suspected data breach must be treated seriously. If a breach occurs: stop or contain the incident where possible; identify what information may have been affected; record what happened; assess the potential risk to affected individuals; notify the relevant customer where appropriate; consider whether the ICO must be notified; and take steps to prevent the incident happening again.
14. Security Incident Records
NicoByte Solutions should maintain a basic record of security incidents, including date and time, what happened, information potentially affected, customers affected, immediate action taken, whether the customer was notified, whether the ICO was notified, and steps taken to prevent recurrence.
15. Staff & Future Contractors
If NicoByte Solutions later employs staff or uses contractors who may access customer information, they must receive appropriate security instructions, access must be limited to what they need, they must understand confidentiality obligations, appropriate contracts should be put in place, and access should be removed when they no longer work with NicoByte Solutions.
16. Review
This procedure should be reviewed at least annually and whenever NicoByte Solutions introduces a significant new service, starts processing new categories of personal information, introduces new technology, employs staff or contractors, experiences a significant security incident, or becomes subject to new legal or regulatory requirements.
Contact
NicoByte Solutions
Website: nicobytesolutions.co.uk
Email: contact@nicobytesolutions.co.uk
Telephone: 07742 067582