Title: Data Security and Protection Policy Author: Kriko Published: Jul 5, 2026 Last modified: Aug 13, 2026 --- 1. [Home](https://kriko.io/) / 2. [Company Policies](https://kriko.io/company-policies) / 3. [Information Technology and Data Management Policies](https://kriko.io/company-policies/information-technology-and-data-management-policies)/ 4. Data Security and Protection Policy # Company Policies The principles that guide every team at Kriko. From how we hire and protect data to how we uphold quality and sustainability. ## Data Security and Protection Policy ## Data Classification ### a. Sensitive Data The Company identifies and classifies sensitive data. Appropriate security measures are implemented to protect sensitive data against unauthorised access, disclosure, alteration or loss. ### b. Personal Data The Company processes and protects personal data in accordance with applicable data protection and privacy laws. All required consents, authorisations and legal grounds are obtained for the collection, use, processing and sharing of personal data. ### c. Commercial and Internal Business Data The Company protects the confidentiality, integrity and availability of commercial and internal business data. Appropriate measures are implemented to safeguard trade secrets, business strategies and other critical Company information. ## Data Security and Access Controls ### a. Data Encryption The Company uses appropriate encryption methods to protect sensitive data. Encryption technologies are applied to data both in transit and at rest. ### b. Authorisation and Access Controls Access to data is restricted through authorisation controls and role-based access policies. Users are granted access only to the data required to perform their duties. ### c. Monitoring and Logging The Company monitors its systems and regularly reviews system logs. Logs are maintained to detect suspicious or unauthorised activities and to support investigations where necessary. ## Data Backup and Recovery ### a. Data Backup The Company performs regular backups of its data. Backup procedures and schedules are designed to support the prompt recovery of data in the event of data loss. ### b. Disaster Recovery The Company develops disaster recovery plans to prepare for emergencies and major disruptions. Data centre backups, business continuity plans and disaster recovery tests are implemented to support operational resilience. ## Data Breaches and Incident Management ### a. Data Breach Notification When a data breach is identified, the Company acts promptly and effectively to notify the relevant parties where required. Appropriate containment, corrective and preventive measures are implemented following a breach. ### b. Incident Management The Company maintains an effective incident management process for responding to security incidents and data breaches. Incidents are investigated, corrective actions are taken, and improvement measures are implemented to prevent recurrence. ## Data Disposal and Retention Periods ### a. Data Disposal Policy The Company complies with its established data retention periods and disposal procedures. Data that is no longer required for legal, regulatory, contractual or business purposes is securely deleted or destroyed on a regular basis. ### b. Data Retention Periods The Company ensures that data is retained in accordance with applicable legal and regulatory requirements. Data retention periods and related requirements are defined, documented and monitored. ## Communication Policies * [Internal Communication and Collaboration Policy](https://kriko.io/company-policies/communication-policies/internal-communication-and-collaboration-policy) * [Internal Communication Channels and Meeting Policy](https://kriko.io/company-policies/communication-policies/internal-communication-channels-and-meeting-policy) * [Social Media Policy](https://kriko.io/company-policies/communication-policies/social-media-policy) ## Crisis and Incident Management Policies * [Crisis Communication and Reputation Management Policy](https://kriko.io/company-policies/crisis-and-incident-management-policies/crisis-communication-and-reputation-management-policy) * [Emergency Planning and Response Policy](https://kriko.io/company-policies/crisis-and-incident-management-policies/emergency-planning-and-response-policy) ## Disciplinary Policies * [Disciplinary Policy](https://kriko.io/company-policies/disciplinary-policies/disciplinary-policy) ## Human Resources Policies * [Diversity, Equity and Inclusion Policy](https://kriko.io/company-policies/human-resources-policies/recruitment-policy) * [Employee Training and Development Policy](https://kriko.io/company-policies/human-resources-policies/termination-policy) * [Anti-Discrimination and Diversity Policy](https://kriko.io/company-policies/human-resources-policies/anti-discrimination-and-diversity-policy) * [Occupational Health and Safety Policy](https://kriko.io/company-policies/human-resources-policies/remote-hybrid-work) * [Recruitment and Termination Policy](https://kriko.io/company-policies/human-resources-policies/recruitment-and-termination-policy) * [Working Hours, Leave and Absence Policy](https://kriko.io/company-policies/human-resources-policies/working-hours-leave-and-absence-policy) ## Business Ethics and Compliance Policies * [Password Creation and Use Policy](https://kriko.io/company-policies/business-ethics-and-compliance-policies/data-protection-policy) * [Transparency and Reporting Policy](https://kriko.io/company-policies/business-ethics-and-compliance-policies/acceptable-use-policy) * [Conflict of Interest and Anti-Bribery Policy](https://kriko.io/company-policies/business-ethics-and-compliance-policies/conflict-of-interest-and-anti-bribery-policy) * [Data Privacy and Security Policy](https://kriko.io/company-policies/business-ethics-and-compliance-policies/data-privacy-and-security-policy) * [Ethical Conduct and Integrity Policy](https://kriko.io/company-policies/business-ethics-and-compliance-policies/ethical-conduct-and-integrity-policy) * [Legal and Regulatory Compliance Policy](https://kriko.io/company-policies/business-ethics-and-compliance-policies/incident-response) ## Customer Relations Policies * [Customer Data Privacy and Security Policy](https://kriko.io/company-policies/quality-compliance/quality-management) * [Complaint Management and Feedback Policy](https://kriko.io/company-policies/quality-compliance/anti-bribery-corruption) * [Customer Satisfaction Policy](https://kriko.io/company-policies/quality-compliance/code-of-conduct) ## Information Technology and Data Management Policies * [Ransomware, Phishing Attacks, Email and Internet Use Policy](https://kriko.io/company-policies/information-technology-and-data-management-policies/environmental-policy) * [Vulnerability Disclosure Policy](https://kriko.io/company-policies/information-technology-and-data-management-policies/vulnerability-disclosure-policy) * [Software Licensing and Usage Policy](https://kriko.io/company-policies/information-technology-and-data-management-policies/social-responsibility) * [Data Backup and Recovery Policy](https://kriko.io/company-policies/information-technology-and-data-management-policies/supplier-code-of-conduct) * [Data Security and Protection Policy](https://kriko.io/company-policies/information-technology-and-data-management-policies/data-security-and-protection-policy) * [Information Technology Use and Access Policy](https://kriko.io/company-policies/information-technology-and-data-management-policies/information-technology-use-and-access-policy) ## Track the digital heartbeat with Kriko Subscribe to receive curated insights, news, and ideas shaping the digital landscape. By checking this box, you acknowledge and accept our [privacy policy](https://kriko.io/privacy-policy).