Policy status: Approved and actively followed. We follow privacy, legal and contractual obligation governance processes. Effective April 11, 2026.
Purpose and scope
We ensure security claims, customer commitments and personal-data practices are traceable to law, signed contracts and reliable evidence.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We record Pingplus Media's correct legal and GST registration identity in contracts and formal disclosures; the operational title Founder & CEO may identify its executive sponsor but does not change legal form.
- We maintain a live register of applicable telecom, privacy, contractual, data handling, breach reporting and supplier requirements with accountable owners and legal review dates.
- We apply established legal review and execution controls to data-processing agreements and record the relevant processing roles, applicable obligations and subprocessor terms of signed agreements.
- We maintain public policies reflecting our actual data processing, availability, retention and contact channels. Our published security and continuity descriptions are aligned with the controls and supporting evidence in place.
- We verify ISO/IEC 27001:2022 certification status, scope and expiry when describing our ISMS, and distinguish the management-system scope from individual product-level assurances.
- We respond to TPRM controls with Yes/Partial/No or customer-prescribed options and cite current evidence. Each security control is reviewed against its implementation records and assigned an accountable owner.
Review and responsibility
On every new customer commitment; annually at minimum; upon law/certificate changes.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.