Information Security Policy

This policy applies to:

• All information created, received, stored, or processed by Flaxur

• All systems, platforms, and digital tools used in support of Flaxur’s activities

• All individuals acting on behalf of Flaxur, including directors, staff, volunteers, consultants, and authorised partners

The policy covers both digital and physical information assets.

Our approach to information security is guided by the following principles:

Confidentiality

Information is accessible only to authorised individuals and used solely for legitimate purposes.

Integrity

Information is accurate, complete, and protected from unauthorised modification or destruction.

Availability

Information and systems are available to authorised users when required to support Flaxur’s operations and programmes.

Information assets covered by this policy include, but are not limited to:

• Personal data and records

• Programme and operational documents

• Financial and administrative information

• Digital communications and correspondence

• Website content and backend systems

Flaxur seeks to ensure that information assets are identified, appropriately protected, and used responsibly.

Access to information and systems is restricted to individuals who require it for legitimate organisational purposes. Measures may include:

• Role-based access permissions

• Use of passwords or authentication controls

• Limiting administrative access to authorised personnel only

Access rights are reviewed periodically and adjusted as roles or responsibilities change.

Information systems and devices used for Flaxur activities must be used responsibly and in accordance with organisational guidelines. This includes:

• Protecting login credentials.

• Avoiding unauthorised software or tools.

• Taking reasonable steps to prevent loss or misuse of devices.

• reporting suspected security incidents promptly.

Where personal devices are used, reasonable care is expected to safeguard organisational information

Flaxur applies appropriate technical and organisational measures to protect information, which may include:

• Secure hosting environments

• Password protection and authentication controls

• Regular system updates and maintenance

• Controlled sharing of files and documents

Security measures are proportionate to the sensitivity of the information and the level of risk involved.

Flaxur may rely on third-party service providers for website hosting, email, cloud storage, analytics, or other operational needs. Where third-party services are used:

• Reasonable consideration is given to their security practices.

• Access to information is limited to what is necessary.

• Services are selected to support responsible handling of information.

Flaxur does not transfer responsibility for information security when using external services.

Any suspected or actual information security incident, including unauthorised access, data loss, or system compromise, should be reported promptly through appropriate internal channels.

Flaxur will take reasonable steps to assess incidents, mitigate risks, and respond in line with applicable policies and legal requirements.

All individuals acting on behalf of Flaxur share responsibility for information security. This includes:

• Handling information with care.

• Following organisational policies and procedures.

• Raising concerns or risks in good faith.

Information security is treated as an ongoing organisational responsibility, not a one-time activity.

This policy should be read in conjunction with:

• Data Protection Policy

• Privacy Policy

• Governance framework

• Other relevant internal policies

Together, these documents support Flaxur’s overall approach to responsible information management.

This Information Security Policy is reviewed periodically to ensure it remains appropriate to Flaxur’s operations, technology environment, and risk profile. Updates will be published on the Flaxur website as required.

Questions or requests relating to information security may be directed to:

Email: compliance@flaxur.org