Information Security Policy

Ink & Compass Creative Studio LTD

Date: 13.03.2025

Introduction

This Policy Document encompasses all aspects of security surrounding confidential company information and must be distributed to all company employees. All company employees must read this document in its entirety and sign the form confirming they have read and understand this policy fully. This document will be reviewed and updated by Management on an annual basis or when relevant to include newly developed security standards into the policy and distribute it to all employees and contractors as applicable.

Information Security Policy

Ink & Compass Creative Studio handles sensitive cardholder information securely. Sensitive Information must have adequate safeguards in place to protect them, to ensure cardholder privacy, ensure compliance with various regulations, and to guard the future of the organization.

Ink & Compass Creative Studio is committed to respecting the privacy of all its customers and to protecting any data about customers from outside parties. To this end, management is committed to maintaining a secure environment in which to process cardholder information.

Employees handling sensitive cardholder data should ensure:

• Handle company and account data including cardholder information securely.
• Ensure personal use of company systems does not interfere with job performance.
• Ensure electronic communications are not misused.
• Protect sensitive cardholder information at all times.
• Avoid using messaging technologies like email or WhatsApp to share cardholder data.
• Keep passwords and accounts secure.
• Do not install unauthorized software or hardware without approval.
• Always leave desks clear of sensitive cardholder data and lock computer screens when unattended.

Access to the Sensitive Cardholder Data

All access to sensitive cardholder data should be controlled and authorized. Any job functions requiring access to cardholder data should be clearly defined. Display of cardholder data should be restricted to the first six and last four digits. Privileged access should be granted based on job responsibilities only.

Third-Party Service Providers

The following third-party service providers may access or manage cardholder data as part of our business operations:

Encryption Policy

Cardholder data must be encrypted using industry standards such as AES 256-bit encryption. Encryption keys must be managed securely with annual rotation and restricted access.

Incident Response Plan

In the event of a security breach:

• The incident must be reported immediately to the designated security officer.
• The PCI Response Team will investigate and implement measures to mitigate further exposure.
• Relevant authorities, including credit card processors, will be informed as required.

Roles and Responsibilities

Appendix A: Agreement to Comply Form
Appendix B: List of Third-Party Service Providers

Employee Name (printed)

Department

Employee Signature