Policy status: Approved and actively followed. Our approved employee policies are already in place, communicated to personnel and followed in daily operations, including confidentiality, acceptable use, access management, onboarding, security awareness, remote work and offboarding. Effective April 11, 2026.
Purpose and scope
We ensure each person receives proportionate screening, awareness, confidentiality obligations, role-specific instruction and timely offboarding.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We maintain approved employee and contractor policies for confidentiality, acceptable use, personal-data protection, information handling, security awareness, access to systems, remote work, incident reporting and separation. Personnel are informed of the policies and acknowledge the obligations relevant to their roles.
- We conduct employee security induction as part of onboarding, covering phishing, secure devices, OTP and customer-data handling, incident reporting, passwords and MFA, privacy and acceptable use. We document training completion and policy acknowledgements.
- We run an established annual security-awareness refresher programme and provide role-relevant updates after material control changes or incidents. Training records, acknowledgements and applicable phishing-awareness exercises are maintained.
- Our employee lifecycle process records joiners, role changes and departures. Managers approve role-based access, owners review transfers, and HR or the responsible manager coordinates timely disablement of access at separation, with completion evidence retained.
- We retrieve or secure company devices, access tokens, credentials and company information through the established offboarding process. Shared credentials are reviewed or rotated in a controlled manner where an exposure risk exists, preserving the continuity of production connections.
- We apply role-appropriate employee screening and reference checks in accordance with applicable law and internal personnel policy, limiting the collection and retention of related records.
Review and responsibility
Before onboarding/access; on any role change or exit; annual training review.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.