Information Security Policy.

Effective Date: 10 December 2025

Atura Group Limited protects the confidentiality, integrity and availability of the information used to deliver its services. This policy establishes the security requirements applying to Print Portals, direct and ad-hoc orders, business systems, devices, personnel and service providers.

Purpose

This policy defines how Atura protects business, customer and personal information against unauthorised access, alteration, disclosure, loss, destruction and material unavailability. Controls are selected according to the information involved, the way it is used and the likely effect of a security incident.

The policy supports Atura’s obligations under the UK General Data Protection Regulation, the Data Protection Act 2018, customer contracts and other applicable legal or regulatory requirements. It should be read with Atura’s Data Protection Policy, Privacy and Cookie Policy, retention arrangements, incident procedures and contract-specific security instructions.

Scope

This policy applies to information handled in any format by Atura personnel and by third parties engaged to support Atura’s services. It covers Print Portals, WordPress and WooCommerce hosted through 20i, Clarity, business email, accounting and administrative systems, local files, devices, supplier communications, courier systems, backups, logs and paper records.

It applies to customer and portal-user information, order and artwork files, delivery details, commercial information, employee and supplier information, credentials, system records and any information received under a customer or government contract.

Security principles

• Confidentiality Information is available only to authorised people and organisations with a genuine need to use it.
• Integrity Information and systems are protected against unauthorised or accidental alteration, and material errors are corrected promptly.
• Availability Important information and services can be recovered within a period proportionate to the operational and customer risk.
• Least privilege Access is limited to what each person or service needs for its approved role.
• Proportionate control Security requirements reflect the sensitivity, volume and use of the information and the harm that could result from compromise.

Responsibilities

The Directors are responsible for this policy, for ensuring that proportionate resources are available and for approving material security risks. Responsibility for day-to-day implementation may be assigned to appropriate personnel or specialist service providers, but accountability remains with the Directors.

Managers must ensure that access, working practices, suppliers and systems within their areas follow this policy. Everyone working for or on behalf of Atura must protect credentials and information, follow approved procedures and report suspected incidents or weaknesses immediately.

Information classification and handling

Information must be handled according to its sensitivity and the requirements attached to it:

• Public information may be shared openly once publication has been authorised.
• Internal information is limited to Atura and approved recipients and must not be published without authority.
• Confidential information includes personal data, customer records, portal information, prices, artwork, credentials and security information. It must be shared only with authorised recipients using suitable safeguards.
• Information carrying a customer, contractual or government marking must be handled according to the applicable instructions, including any requirements for access, transmission, storage, retention and deletion.

If the classification or handling requirement is unclear, the information must be treated as confidential until the position is confirmed.

Access control

• Access is granted for an approved business purpose and is limited to the minimum information and functions required.
• Individual accounts must be used wherever the system supports them. Shared administrative accounts must be avoided or subject to additional control.
• Standard portal users may access only information associated with their own account. Enhanced access for customer-nominated approvers, managers or administrators must be agreed with the customer and limited to their assigned role.
• Administrative and privileged access to 20i, WordPress, Clarity, business email and other important systems must use multi-factor authentication where the service supports it. Where it is unavailable, the limitation and appropriate compensating controls must be considered.
• Passwords and authentication codes must not be disclosed, reused inappropriately or stored in unsecured files or messages.
• Access must be changed or removed promptly when responsibilities change, authorisation is withdrawn or a person leaves the relevant organisation.
• Privileged and enhanced customer access must be reviewed periodically and when a material change occurs.

Systems and software security

Atura uses hosted and third-party systems to provide its services. WordPress and WooCommerce operate within Atura’s portal environment hosted through 20i, while Clarity supports quotations, order administration, production, invoicing and dispatch. Security controls must reflect the function and risk of each system.

• Operating systems, devices, WordPress, WooCommerce, plugins, themes and connected services must be supported and updated according to risk.
• Administrative access, integrations and plugins must be restricted to approved people and services.
• Security features provided by hosting, email and software services must be enabled where appropriate, including encrypted connections, authentication controls, malware protection, logging and backup facilities.
• Material portal, integration, permission or workflow changes must be assessed and tested before live use. Changes must not weaken agreed customer access restrictions.
• Unneeded accounts, plugins, services and access routes must be removed or disabled.
• Suspected vulnerabilities must be reported promptly and addressed according to their likely effect on Atura, its customers and individuals.

Secure use and transfer of information

• Information must be stored and shared through approved business systems and sent only to verified recipients.
• Only the information necessary for the relevant order, production, support, installation or delivery task may be exported or disclosed.
• Confidential information must use encrypted web connections or another secure transfer method appropriate to the risk.
• Downloads, exports and temporary working files must be minimised, protected from unauthorised access and deleted securely when no longer required.
• Customer or personal information must not be placed in personal email accounts, unapproved consumer file-sharing services, unapproved removable media or unapproved generative artificial intelligence services.
• Remote working must not expose confidential information to household members, visitors or the public. Devices must be locked when unattended and protected during transport.

Suppliers fulfilment partners and couriers

Atura selects service providers according to the information and service involved. Relevant contractual, confidentiality, security, location, retention, incident and deletion arrangements must be considered before a provider receives confidential or personal information.

Customer data is held within systems hosted or provided by 20i and Clarity. Provider personnel do not require routine business access to Atura’s customer records. Any provider-level access must be limited to authorised technical support, maintenance, security, backup or recovery activities and governed by the provider’s controls and contractual obligations.

Production suppliers, factories, fulfilment partners, installers and couriers do not receive direct access to Atura’s systems unless specifically assessed and authorised. Atura supplies only the information required for the particular task. This may include product specifications, artwork, personalisation, recipient details, delivery instructions or installation contacts. Unrelated customer records and order history must not be disclosed.

International access or transfers must follow Atura’s Data Protection Policy, the relevant customer instructions and an applicable lawful transfer mechanism.

Device and physical security

• Business devices must use appropriate access controls, automatic screen locking and supported security software.
• Devices and paper records containing confidential information must be protected from loss, theft and unauthorised viewing.
• Visitors and third parties must not be given unsupervised access to confidential records, unattended devices or restricted working areas without authorisation.
• Equipment and media must be securely erased or destroyed before disposal or reuse where they may contain confidential information.

Backup continuity and recovery

Hosting and software providers manage infrastructure backup, replication and disaster-recovery arrangements for their services. Atura will consider the availability and recovery requirements of important systems, maintain additional copies where proportionate and ensure that access to backups is appropriately restricted.

Recovery arrangements must be reviewed and tested at intervals proportionate to the service and customer risk. Material failures or gaps must be recorded, escalated and addressed.

Security incidents

A suspected loss, compromise, misdirection, unauthorised disclosure, alteration, destruction or material unavailability of information must be reported internally immediately. Examples include compromised credentials, incorrect portal permissions, malware, lost devices, information sent to the wrong recipient, insecure links and unintended publication. No one should delay reporting while attempting to investigate alone.

Atura will contain the incident, preserve relevant evidence, assess the information and people affected, recover services and record the response. Where Atura processes information for a customer, it will notify that customer without undue delay and comply with any shorter contractual deadline. Where Atura acts as controller, it will make any notification required by law, including notification to the Information Commissioner’s Office within the applicable period for a notifiable personal data breach.

After a material incident, Atura will identify appropriate corrective actions and update controls, instructions or training where required.

Retention and secure deletion

Information must not be kept longer than required for the relevant service, customer instruction, contract, legal obligation, security purpose or dispute. Portal records, Clarity records, artwork, delivery information, email, exports, logs, backups and supplier communications must follow the applicable retention arrangement.

When information is no longer required, Atura will delete it securely or require the relevant provider to delete or isolate it in accordance with its contract and backup cycle. Access must be removed promptly even where information must remain retained for a limited legal or contractual purpose.

Training and acceptable use

Everyone with access to Atura information or systems must receive instructions and training appropriate to their responsibilities. They must understand how to protect credentials, identify suspicious messages, use approved systems, handle customer information and report incidents. Refresher training or communication will be provided when risks, systems or responsibilities materially change.

Atura systems must be used lawfully and for authorised business purposes. Deliberate, reckless or repeated failure to follow security requirements may result in removal of access, disciplinary action, termination of a contract or business relationship, legal action or notification to an appropriate authority.

Government and customer requirements

Customer and government-contract security requirements supplement this policy. Before protected information is received, Atura will identify applicable requirements for classification, personnel access, authentication, hosting, transmission, subcontractors, international access, incident reporting, audit, retention, return and deletion. Relevant requirements must be passed to suppliers where their services form part of the contract.

Where a contract requires Cyber Essentials, Cyber Essentials Plus or other certification, the required certification or evidence must be current before information subject to that requirement is processed and must be maintained for the required contract period.

Monitoring and review

Atura will review security controls in a manner proportionate to the systems, information and risks involved. Reviews may include access checks, configuration checks, supplier information, backup or recovery tests, incident trends and corrective actions. Material weaknesses must be reported to the Directors and addressed according to risk.

This policy will be reviewed at least annually and following a material change to Atura’s systems, Print Portals, direct or ad-hoc order processing, hosting, Clarity, suppliers, customer requirements, legal obligations or security risks.

Contact

Questions, security concerns and suspected incidents should be reported promptly to Atura Group Limited at sales@aturagroup.co.uk or 0161 399 5842. A concern involving the usual contact should be raised with another Director.