Data Breach Policy
Last updated: [DATE]. Applies to all administrators, staff and contractors with access to Vistacoin customer data. Breach lead: Marcelle (Director/Owner — confirm), marcelle@aerovistaclub.co.uk, 07749 395963.
1. What is a personal data breach
Any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Examples: a stolen or shared password, a lost laptop with an active session, data emailed to the wrong person, a misconfigured database policy, or a compromised provider account.
2. Everyone’s duty: report immediately
Anyone who suspects a breach must tell the breach lead at once, and in any case within hours, not days. Do not try to hide, investigate alone, or delete evidence. Staff will not be penalised for good-faith reporting.
3. Response steps
- Contain. Revoke the affected staff access (admin console), reset passwords, sign out sessions, rotate keys, and disable affected features.
- Assess. Record what happened, when it was found, which data and people are affected, and the likely risk to them.
- Record. Log every breach, including those not reported, with facts, effects and actions taken.
- Notify the ICO without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. If full details are not yet known, report in phases.
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to them, saying in plain language what happened, likely consequences, what we are doing, and how they can protect themselves.
- Notify others where appropriate: our processors, insurers, banks, the police/Action Fraud, and any regulator that applies to a live service.
- Review. Fix the root cause, update controls and training, and note lessons learned.
4. Processors
If a processor (such as Supabase or Vercel) suffers a breach affecting our data, we expect prompt notice and will start this process when we become aware.
5. Preventive controls
- Invitation-only accounts with unique strong passwords; multi-factor authentication to be enabled for all staff [CONFIRM].
- Least-privilege access, with administrators reviewing and revoking staff access regularly.
- Row-level security on all customer tables; the database service-role key is never used in the website or shared.
- No customer data in emails, chat or personal devices unless approved.
6. Contacts
Breach lead: Marcelle, marcelle@aerovistaclub.co.uk, 07749 395963. ICO: ico.org.uk/make-a-complaint/data-protection-complaints/ or 0303 123 1113.