Security Statement

Our approach

In line with Article 32 of the GDPR, we apply technical and organisational measures to protect the confidentiality, integrity, availability and resilience of personal data, in proportion to the risk.

Access control

Access is limited to authorised people who need it, with strong authentication and prompt removal when roles change.

Encryption and backups

Data is encrypted in transit and, where appropriate, at rest. Backups are kept and restoration is tested.

Suppliers

Suppliers that handle personal data are selected carefully and bound by data processing agreements (Article 28).

Incidents

Security incidents are recorded and handled under a documented procedure. Where required, breaches are notified to the AEPD within 72 hours (Article 33).

Review

Measures are reviewed periodically and described in our internal security policy.