The purpose of this Cyber Security Policy is to protect Entelechy Academy Limited's information assets, ensure compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any applicable data protection laws and regulations, in particular, the United Kingdom Data Protection Act 2018 (together, the "Data Protection Laws"), and to promote a responsible use of our company's IT resources among our employees. This policy sets forth guidelines and best practices for all employees to safeguard sensitive information, prevent unauthorized access, and maintain the confidentiality, integrity, and availability of our IT systems and data.

Purpose

This policy applies to all employees, contractors, and temporary staff who have access to Entelechy Academy Limited's IT resources, including computers, mobile devices, networks, and systems.

Scope

All employees must understand their role in maintaining a secure IT environment and are responsible for complying with this policy. Entelechy Academy Limited has designated a responsible person for ensuring the implementation of this policy, providing cybersecurity training, and addressing any reported security incidents or violations.

Roles and responsibilities

All employees shall receive cybersecurity training upon joining the company and periodically thereafter. Training will cover essential topics, including:

Recognizing and reporting security threats, such as phishing and social engineering attacks;

Protecting sensitive information and adhering to data protection regulations;

Secure password management and multi-factor authentication;

Safe use of mobile devices and public Wi-Fi networks;

Appropriate use of company IT resources, as outlined in this policy.

Security awareness and training

All employees must adhere to the following best practices to protect personal data and ensure compliance with GDPR and other Data Protection Laws:

Limit the collection, processing, and storage of personal data to what is necessary for legitimate business purposes;

Obtain explicit consent from data subjects before collecting or processing their personal data, where required;

Store personal data securely using encryption, password protection, or other appropriate security measures;

Share personal data only with authorized personnel or third parties who have a legitimate need to access the information;

Report any actual or suspected data breaches to the Data Protection Officer (DPO) or designated contact person immediately.

Data protection and GDPR compliance

Employees shall use Entelechy Academy Limited's IT resources responsibly and in accordance with the company's values, policies, and applicable laws. Prohibited activities include, but are not limited to:

Accessing, downloading, or sharing offensive, inappropriate, or illegal content;

Engaging in cyberbullying, harassment, or discrimination;

Unauthorized access, use, or disclosure of company data or IT resources;

Using company IT resources for personal gain or non-business-related purposes.

Acceptable use of IT resources

Entelechy Academy Limited reserves the right to monitor the use of its IT resources to ensure compliance with this policy and applicable laws. Employees who violate this policy may be subject to disciplinary action, up to and including termination of employment and legal action, where necessary.

Monitoring and enforcement

Employees are encouraged to report any actual or suspected cybersecurity incidents, policy violations, or concerns to the designated contact person immediately. Entelechy Academy Limited is committed to responding promptly and effectively to any security incidents and taking appropriate measures to prevent their recurrence.

Reporting and incident response

This Cyber Security Policy shall be reviewed and updated periodically to reflect changes in technology, business requirements, or applicable regulations. Employees will be notified of any significant changes to the policy and are expected to comply with the updated requirements.

Cyber Security Policy

Contents