This is MoneyMesh Ltd’s (“MoneyMesh”) policy on GDPR and data security. This policy should be read alongside our privacy policy.

This policy has been approved and published internally for MoneyMesh and is applicable to all of our offices located in the UK, Kosovo, North Macedonia, Albania, Montenegro, Bosnia and Herzegovina, Serbia and Croatia ("Western Balkans") and the European Economic Area ("EEA").

Our application of GDPR principles

Accountability:

We are committed to the GDPR principles and apply this throughout our business operations by taking reasonable steps to ensure accuracy and confidentiality. We are fully accountable and have detailed policies and systems in place. We also have a Data Protection Officer who oversees and manages our compliance with data protection regulations and legislations of the UK, Western Balkans and the EEA. This includes handling subject access requests.

We review our policies regularly to ensure they are kept up to date and we train our employees on GDPR, data protection principles and security as this is highly important given the nature of our business.

Transparency, fairness and lawfulness:

We process all data ensuring we have full regard to the data subject’s interests, and we undertake processing activities transparently in order to achieve fairness in all we do. This means we can be satisfied that we are processing data lawfully and fairly. MoneyMesh has robust processes in place so that subject access requests can be handled efficiently and carefully.

Data integrity and confidentiality:

MoneyMesh holds data using secure systems such as Azure, which guarantees data encryption at rest and in transit.

Information security and integrity is key to the operation of our work and we have a dedicated team who monitors our systems and can support us in the event that data is likely to be or has been compromised.

Storage of data:

We will not keep data for longer than is necessary and will only hold data provided that there is a lawful reason to do so, which allows fair retention. If we are required to remove data, we will do so by using a secure process so that the disposal of data is legally and ethically compliant.

Data accuracy:

MoneyMesh treats data accuracy seriously and we train all employees on maintaining data to a high standard of accuracy.

Purpose:

We will only handle data for a specific purpose so that it is not excessive in nature. This ensures that data is not processed for any other reason other than what it was collected for.

The below looks at what operational steps MoneyMesh has implemented within the business to maintain the standards around data privacy and security.

For further information or any questions about the topics raised in this policy, please contact our Data Protection Officer via email on ssamain@moneymesh.demo.

Our security measures:
Secure areas

Any areas that are considered to be secure access only are protected by entry processes to ensure we are only authorising staff to enter with a valid ID badge. We remove access/entry rights for those employees who leave their employment with or self-employed contract with MoneyMesh.

Buildings

Receptions are staffed during our office opening hours and all door access control systems are in place throughout our offices. We have CCTV monitoring in place at all sites including the entrance points.

Network access

Access to our internal systems including the intranet is accessed via secure HTTPS internet browser. We use a secure network to access our internal systems and folders. We ensure that all employees change their password regularly with specific password requirements, for security purposes.

Software and applications

We use agile software for our software and digital applications. After a change is implemented by MoneyMesh, we conduct user end to end testing so that updates are noted accurately and also, to monitor the current system functionality. We use up to date operating systems to ensure that they are fully supported. Our laptops and desktops are kept up to date with automatic instalment updates. We will never store sensitive data on unsecure systems or on systems/applications that do not comply with relevant GDPR principles.

Testing and control processes

All patches on our equipment and systems are monitored by our internal control process, which includes evaluation, testing and deployment procedures.

Encryption software

All MoneyMesh software, databases, and hardware devices are protected with highly secure levels of encryption. We implement strict processes for using encryption within the company and any physical keys have been placed in a secure location with access only available to designated employees.

Our system updates

We carry out regular updates to our systems as and when this is appropriate so that we are using up to date systems and IT equipment.

Data backups

We backup all data everyday and have a restore process in place. We have implemented measures in the unlikely event that there is a compromise at MoneyMesh. MoneyMesh has a secure backup system in place managed by a senior member of staff and/or director due to limited access for security reasons. Our IT department will regularly test the backup process to ensure it is working correctly and securely. MoneyMesh is also able to monitor the performance of employees using our systems to ensure integrity and legal compliance.

Monitoring and testing

MoneyMesh will regularly monitor the network and can quickly identify any non-compliance to prevent data loss by using our prevention controls in place.

Cloud storage

We use Cloud storage to process and store data and this also ensures that the data is kept securely. We run tests regularly. Data resides within the UK, Western Balkans and the EEA and data will never be transferred outside of the EEA and/or outside of the above countries in which we operate.

Cyber security

MoneyMesh networks, whether internal or external connections, use firewalls, antivirus and malware protection to detect and prevent threats. We ensure that applications used within the business and on the internet must constantly be protected to prevent exploitation of web vulnerabilities of any kind. The access to the internet is monitored by a web filtering programme to restrict specific web URLs and traffic. Third party security

All IT security requirements are managed by our employees and third party agents who we instruct to comply with GDPR requirements. Our contract with third party IT agents includes an agreement on data processing of personal data.

We have a dedicated security team who will frequently run tests and check that all controls are in working order, safely and securely.

Employee security

It is important that MoneyMesh conducts screening checks on new recruits prior to their employment with us. This includes conducting interviews, review of CVs and qualifications and checking their ID and right to work documents before commencing employment. We also provide the employee with an employment contract, employee handbook and a signed confidentiality/NDA agreement. Furthermore, when we update our HR policies and employee handbook, our employees are correspondingly updated.

MoneyMesh ensures that all employees receive induction training on security, data privacy and GDPR compliance. We also hold training seminars and presentations within the company. MoneyMesh operates a clean desk policy and each employee is required to lock their computer screens when away from their desks for any length of time.

MoneyMesh has implemented a safe and secure remote working process for remote workers within the company. MoneyMesh prohibits the use of using and/or storing data on removable and device hardware.

Once an employee leaves the company, we immediately prevent access to their accounts, the office and internal systems.

Data retention:

We comply with legal, commercial and contractual requirements in relation to ownership, retention and disposal of data concerning MoneyMesh’s business activities within the UK, Western Balkans and the EEA.

Data Disposal:

MoneyMesh encourages its employees to work with digital files and records and we limit paper records where reasonably practicable. We have confidential waste bins at each site to securely dispose of confidential paper waste.

For all hardware data, we have a strict policy in place where the hardware is deleted i.e. “wiped off” by our employees or by our instructed agents.

Queries and complaints:

MoneyMesh has a designated team who can be contacted in writing with any queries or concerns regarding the privacy policy, this GDPR policy and/or subject access rights. In addition, employees can request access to information held by MoneyMesh and the company will not charge employees for this service.

Our Data Protection Officer can be contacted on the details below:
Shahem Samain
ssamain@moneymesh.demo
145 City Road
London
EC1V 1AZ

If you are unhappy with how we have handled your access and data subject requests and/or exercising your GDPR rights, you can file a complaint or raise a query with the relevant Data Protection Regulatory Agency as listed below. More information on how to raise a complaint can be found below depending on the relevant location in which we provide our services:

The UK: ICO https://ico.org.uk/
Croatia: PDPA https://azop.hr/
Kosovo: IPA https://aip.rks-gov.net/
North Macedonia: (no data protection regulatory agency available currently)
Albania: IDPC https://www.idp.al/
Montenegro: Agency for PDP of Montenegro https://www.azlp.me/me/agencija
Bosnia and Herzegovina: PDPA in B&H http://www.azlp.ba/
Serbia: Commissioner for IPI and PDP https://www.poverenik.rs/en/

Review of policy:

This policy was last reviewed and updated by MoneyMesh on 01 September 2022. This will be reviewed periodically by the company, as is deemed appropriate and at least once every 12 months.

MoneyMesh Ltd.