Data Protection & IT Security Policy

Questionable Content is committed to protecting the confidentiality, integrity, and availability of company and client data. This Data Protection & IT Security Policy (“Policy”) sets out how employees and contractors must handle data and use IT resources to safeguard https://questionable-content.com operations.

1. Purpose

The purpose of this Policy is to:

• Protect sensitive and personal data handled by Questionable Content.
• Ensure compliance with applicable privacy and security laws.
• Define employee responsibilities for IT systems, devices, and data.
• Reduce the risk of unauthorized access, loss, or misuse of information.

2. Scope

This Policy applies to all employees, contractors, vendors, and partners who access or process company or client data through https://questionable-content.com systems, networks, or devices.

3. Data Protection Principles

Employees must handle all data in line with the following principles:

• Confidentiality: Only access data necessary for your role. Do not share with unauthorized persons.
• Integrity: Ensure information is accurate, complete, and updated as required.
• Availability: Follow procedures to keep systems functional and accessible to authorized users.
• Minimization: Collect and process only the data necessary for business purposes.

Any suspected breach of these principles must be reported immediately to taylor@questionable-content.com.

4. Employee Responsibilities

Employees are required to:

• Use strong, unique passwords and protect them at all times.
• Lock devices when unattended and secure them physically.
• Avoid using personal devices for company work unless authorized and secured.
• Store files only in approved systems (not personal drives or unauthorized cloud services).
• Encrypt sensitive data before sharing externally.
• Report lost devices or suspected breaches immediately to taylor@questionable-content.com.

5. IT Security Practices

To maintain security, employees must:

• Apply software updates and patches promptly.
• Use only licensed and authorized software.
• Avoid downloading or installing unapproved applications.
• Refrain from clicking suspicious links or opening unknown attachments.
• Follow VPN or secure network procedures when working remotely.

6. Data Retention and Disposal

• Data should be retained only as long as required for business or legal purposes.
• At the end of the retention period, data must be securely deleted or anonymized.
• Physical documents containing sensitive data must be shredded or disposed of securely.

For guidance on retention timelines, refer to the Data Retention Policy or contact taylor@questionable-content.com.

7. Third-Party Access

Vendors, contractors, or partners who access company systems must sign confidentiality agreements and follow this Policy. Employees are responsible for ensuring third parties adhere to security requirements when sharing data.

8. Incident Response

If a data breach or security incident is suspected:

• Immediately report it to taylor@questionable-content.com.
• Do not attempt to conceal or resolve the issue independently.
• Cooperate fully with the investigation and remediation process.

9. Disciplinary Action

Violations of this Policy may result in disciplinary measures, up to and including termination of employment or contract. Serious breaches may also result in legal action.

10. Policy Review

This Policy will be reviewed periodically and updated as needed to reflect changes in laws, regulations, or security practices. Employees are required to stay informed of updates and comply with the latest version.