RareWine has introduced this Policy to establish and maintain a high standard of protection of the personal data we either receive from our customers and partners or in the context of staff employment.
Many people are happy to make their personal data available, but at the same time, they want to make sure that their sensitive information is taken care of. Therefore, confidentiality and data security are two fundamental considerations that we at RareWine take into account when we receive data about our customers, partners or employees, when we go about our daily tasks, when we compile statistics or when we in any other way process personal data.
This Policy has been drafted in accordance with the new EU General Data Protection Regulation with effect from 25 May 2018. The IT security Policy applies to all personal data processed at RareWine and to personal data about customers, current and former employees and job applicants.
The Policy broadly describes what categories of personal data RareWine processes for various purposes, how these are handled internally and what rights each person has in connection with the processing.
For the purposes of this Policy, 'personal data' refers to both ordinary and sensitive personal information (i.e. data for identifying a person either directly or indirectly - e.g. name, address and/or CPR no.), and health information with information about treatments.
'IT security' refers to all security measures designed to protect the physical and electronic personal data used by RareWine.
For RareWine, it is very important to protect all the personal data we receive from our customers, partners and employees/former employees. It is crucial to RareWine's reputation and credibility that we adequately protect this data.
For RareWine, it is important to ensure:
- Confidentiality - i.e. confidential processing, transmission and retention of personal data, in which only limited internal users have access, and in which users' access is limited to what is necessary.
- Integrity - a reliable and correct functionality of our IT systems that minimizes the risk of incorrect data.
- Security measures - i.e. that we use and maintain technical and organizational measures to protect the data and limit the risk of security breaches and unauthorized access.
- Legal processing - i.e. that the processing is in accordance with applicable law and in accordance with RareWine's IT Security Policy.
The purpose of this IT security policy is to:
- Establish the overall framework for IT security, taking into account RareWine's risk picture.
- Describe the delegation of responsibilities and appropriate management and control of IT security.
- Ensure that all personal data is processed in accordance with applicable law.
The structure of the IT security work
With this text, RareWine has outlined the overall framework for RareWine's IT and Information Security Policy. RareWine's employees have detailed instructions for their daily work via internal IT business procedures. RareWine has entered into data processor agreements that outline rules and checks for operations carried out by external partners.
Our IT security work is rooted in 'good IT practice' in the field of information security and is based on certain standards.
Risk management
In order to focus the efforts of the IT security work, we work on the basis of a structured approach to risk management. The result of the risk management, including the assessment of risks, must be reported periodically to RareWine's management.
Management is immediately informed of significant deviations in the current threat picture and the adjustment it results in, in relation to focus areas and checks. Ordinary deviations are collected and reported periodically by management.
Deviations
In general, the IT Security Policy and all business procedures must always be complied with. However, situations may arise in which special circumstances require a deviation from the applicable security rules. Such a deviation depends on a specific assessment and requires a specific exemption. The exemption must be approved by RareWine's chief executives and must be justified and supported by a risk assessment. The exemption is always limited in terms of a specific event and period of time.
Auditing and monitoring
It is the job of the IT security officer to ensure that at least once a year - based on the risk picture - a systematic review and assessment are conducted of whether the IT Security Policy should be updated. If necessary, the IT security officer must update the IT Security Policy and underlying business procedures and policies.
Publication
The IT Security Policy is accessible to everyone via the RareWine website and to staff via our shared drive. Similarly, business procedures are accessible to the members of staff who have a work-related need.
Risk management model and protection of data
RareWine prioritizes confidentiality and data security and aims to guarantee that those who make their personal data available can be sure that their sensitive data is well taken care of.
All the personally sensitive and confidential data that RareWine processes is processed in a legally and ethically correct manner, whether it is IT-processed or manually-processed. The data processed is assessed in a life cycle from registration, processing and storage to disposal.
RareWine works on the basis of a risk management model to provide protection from the negative consequences of IT threats. Accordingly, RareWine carries out a structured collection and assessment of potential risks and threats. These threats are periodically analyzed, and we make ongoing assessments of how to mitigate these risks and threats (mitigating actions and checks).
We have also established a contingency plan that contains precautions for how RareWine's systems can be recreated, precautions that also apply to breaches of confidentiality and breaches of integrity.
