Information security policy

1. Purpose and scope

We depend on information to provide Amazon and TikTok Shop services, communicate with clients and operate our business. This policy is intended to protect the confidentiality, integrity and availability of that information and to reduce the risk of accidental loss, unauthorised access, misuse or disruption.

It applies to all directors, employees, workers, contractors and suppliers who access our information or systems. It covers information in any form and all company-managed or approved devices, cloud services, software, websites and connected marketplace accounts.

2. Governance and responsibility

The directors of Simon and Prime Ltd are accountable for information security. System and service owners are responsible for applying this policy to the systems they manage. Everyone in scope must follow the controls relevant to their role and report suspected security events without delay.

Information security decisions are made on a risk basis, taking account of the nature of the information, the purpose of processing, the likely impact on people and clients, contractual duties, platform rules and the cost and effectiveness of available safeguards.

3. Risk and data principles

Minimise. Collect and retain only the information needed for a defined business or legal purpose.

Limit access. Give access only to people and systems with a current, approved need.

Protect throughout the lifecycle. Apply safeguards when information is collected, used, transferred, stored, backed up and deleted.

Review and improve. Test controls, learn from incidents and change safeguards as risks and technology change.

Information is handled according to its sensitivity. Public information may be shared openly; internal information is limited to authorised business use; confidential information includes client, commercial and personnel data; restricted information includes credentials, secret keys and any data whose compromise could cause serious harm.

4. Access control

• Access must be based on least privilege and a legitimate business need.
• People must use individually assigned accounts. Shared credentials are prohibited unless a system technically requires them and compensating controls are documented.
• Strong, unique passwords or passkeys must be used. Business-critical accounts must use two-step verification where the service supports it.
• Privileged access must be limited, separately controlled where practical, and reviewed more frequently than ordinary access.
• Access must be changed or removed promptly when a role changes, a contract ends or access is no longer required.
• Credentials and secret keys must not be sent through unapproved channels, committed to source control or written to application logs.

5. Devices and remote working

Devices used for company work must run supported software, install security updates promptly, use an effective firewall and malware protection where appropriate, and lock automatically when unattended. Devices that store confidential or restricted information must use device encryption where supported.

Lost, stolen or suspected-compromised devices must be reported immediately. Confidential information must not be exposed in public places, left unattended, or stored on personal devices or removable media without approval and suitable protection.

6. System and software security

New systems and material changes must consider security and privacy during design, before production use and throughout the service lifecycle. Controls are selected in proportion to risk and may include:

• secure configuration, input validation, tenant separation and defensive session management;
• encryption in transit and authenticated encryption for sensitive data at rest;
• separation of development, test and production environments;
• code review, automated tests, dependency checks and vulnerability remediation;
• rate limiting, audit trails, backup and recovery controls; and
• documented approval before real client or platform data is introduced.

Before production use, third-party access tokens and similar platform credentials must be encrypted using keys managed separately from the stored data, with access restricted and rotation or revocation supported. Test and development work should use synthetic or anonymised data wherever practical.

For HaloProof, the product is designed not to ingest marketplace buyer names, addresses, phone numbers, email addresses or buyer messages. Permissions and data collection are limited to what is needed to provide seller analytics and measure aggregate commercial performance.

7. Data handling, retention and deletion

Confidential and restricted information must be transferred only through approved services and protected in transit. It must not be copied into personal email, unapproved storage, public AI tools or other systems without an authorised business purpose and an appropriate data-protection assessment.

Retention periods must reflect the purpose for which the information was collected, legal and contractual requirements, platform obligations and the needs of the client. Information must be securely deleted or anonymised when it is no longer required. Disposal of devices and media must prevent recovery of company or client information.

Requests to access, correct or erase personal information are handled under our Privacy Policy and applicable data-protection law.

8. Suppliers and connected platforms

Before a supplier is given access to confidential or restricted information, we assess the service, the information involved, the access required and the supplier’s ability to protect it. Contracts or platform terms must address confidentiality, permitted use, security, deletion and incident notification where appropriate.

Connections to Amazon, TikTok Shop and other platforms must use approved authentication methods and the minimum scopes needed for the service. Connected-account data must be used only for the agreed service, must not be sold, and must not be used for unrelated advertising or profiling.

Supplier and platform access must be reviewed when the service changes and removed when it is no longer needed.

9. Monitoring and assurance

Security-relevant events must be logged where proportionate, including authentication, privileged actions, connection changes, exports, data deletion and security-control failures. Logs must not contain plaintext credentials or unnecessary personal information and must be protected from unauthorised alteration and access.

Controls are checked using appropriate methods such as access reviews, automated security tests, vulnerability scans, dependency review, restoration tests and independent assessment where risk or a platform requirement warrants it. Material findings must be recorded, prioritised and followed through to closure.

10. Incident response

A security incident includes suspected or confirmed loss, unauthorised access, disclosure, alteration, service disruption, malware, credential compromise, phishing or a breach of this policy.

Suspected incidents must be reported immediately. We will act to contain the issue, preserve relevant evidence, assess affected systems and information, revoke or rotate access where needed, recover safely, document decisions and address the underlying cause.

We assess whether clients, platforms, individuals, insurers, law enforcement or regulators must be notified. Where a personal data breach is reportable to the UK Information Commissioner’s Office, notification will be made without undue delay and, where applicable, within 72 hours of becoming aware of it. A post-incident review is required for material incidents.

11. Backups and business continuity

Business-critical information and configurations must be backed up at a frequency proportionate to the impact of loss. Backups must be protected from unauthorised access and, where practical, isolated from the source environment. Restoration must be tested periodically so that a backup is evidence of recoverability, not merely a copy.

Critical services must have practical recovery arrangements, identified owners and alternative contact routes appropriate to their importance.

12. Training, exceptions and review

People with access to company systems must receive security instructions appropriate to their role, including account protection, phishing awareness, safe information handling and incident reporting. Additional guidance is required for people with privileged or engineering access.

Any exception to this policy must have a documented reason, owner, risk assessment, approval, compensating controls and review or expiry date. Suspected non-compliance will be investigated and may lead to removal of access, contractual action or disciplinary action where appropriate.

This policy is reviewed at least annually and sooner after a material incident, legal or platform change, major system change or significant change in risk. Updates are approved by the directors of Simon and Prime Ltd and published with a new version or effective date.

This policy is informed by the UK Information Commissioner’s Office guidance on appropriate technical and organisational measures and the National Cyber Security Centre’s guidance for small organisations. It should be read alongside our Privacy Policy.

Last updated 27 August 2026.