Incident Response and Breach Notification Policy

This policy describes how TrueValue Technologies Ltd responds to security incidents affecting the TrueValue service and communicates with affected customers. It should be read with the Terms of Service, DPA and Security Statement. Contact security@truevalue.business for urgent reports and privacy@truevalue.business for data-protection matters.

An incident may affect confidentiality, integrity or availability. A Personal Data Breach can involve accidental or unlawful loss, destruction, alteration, disclosure or access, not just a malicious intrusion. A service outage is assessed for its actual effect; not every outage or unsuccessful attack is a notifiable personal data breach.

The DPA applies where we process personal information for a customer. For information we control independently, we make our own legally required assessments and notifications. Contractual confidentiality duties may require customer notification even where no personal data is involved.

Notify us promptly with the affected workspace or feature, the time observed, what happened, the apparent impact and a safe way to contact you. Preserve relevant evidence. Do not send unnecessary deal files, passwords or sensitive identity documents in an ordinary report; ask for a secure transfer route.

Customers should also secure compromised credentials or revoke a relevant integration where appropriate and safe. Do not erase important evidence or take steps that unnecessarily increase the incident's impact. If a customer-selected external service is involved, contact that provider as well; we assess our own systems and responsibilities rather than automatically assuming all incidents are ours or none are ours.

We will assign responsibility for triage, assess affected systems and information, take reasonable proportionate containment measures, and involve relevant suppliers and specialist advisers where appropriate. Immediate steps may include restricting access, revoking tokens, disabling an affected feature or protecting evidence.

We prioritise according to risk to people, customers and the service. Containment may temporarily interrupt functionality. We give useful information where practicable without disclosing details that would expose another customer or assist exploitation. The process is not a promise that every incident can be contained within a fixed number of hours.

Where we become aware of a Personal Data Breach affecting Customer Personal Data, we will notify the affected customer without undue delay and in any event within 24 hours after awareness. We do not wait for a completed forensic investigation, proof of our fault or a decision that a regulator must be notified.

The same initial timing applies to an identified security breach materially affecting the confidentiality, integrity or availability of the customer's non-personal confidential Customer Data. A purely speculative report is assessed promptly; uncertainty is not used to postpone a notice once we are aware of a breach.

Initial notice goes to the customer's nominated administrative or security contact using an appropriate channel. Customers must keep those details current. Where the normal channel appears compromised, we will use a reasonable alternative available to us.

To the extent available, we explain the nature and timing of the incident; the affected service and information; approximate numbers and categories of affected individuals or records; likely consequences; actions taken or proposed; recommended customer precautions; and a contact for follow-up.

If information is incomplete, we state that clearly and provide further details without undue further delay as they become available. We do not withhold an initial notification merely because precise record counts or root cause are not yet known. Updates are proportionate to the incident and may be provided through a secure incident channel.

We keep an incident record, including assessment and notification decisions, significant actions and remediation. We can provide meaningful relevant findings without releasing privileged legal advice, another customer's data, sensitive exploitation details or unrestricted internal system access.

For customer-controlled processing, the customer remains responsible for its own decisions about notifying regulators, individuals and other parties. We provide appropriate assistance and available facts. We do not issue statements in the customer's name without authority unless law requires a disclosure.

A controller's legal reporting timetable is separate from our processor-to-customer notice. A controller may need to report a notifiable breach within 72 hours after awareness where applicable, and inform affected individuals without undue delay where the relevant high-risk test is met. The customer should assess its circumstances promptly rather than waiting for our final report.

Where we are controller or otherwise have a direct legal duty, we make the required notifications ourselves. We also consider other applicable sector, contractual or reporting duties where relevant. No clause in this policy restricts lawful reporting by an affected person.

We take reasonable steps to investigate cause, restore affected service safely, address identified weaknesses and reduce recurrence risk. Recovery decisions balance availability, evidence preservation and the risk of restoring an unsafe environment. Any incident-specific estimate is an estimate, not an unconditional service-level commitment.

We bear the cost of investigating and remedying our own failures and provide the assistance required by our DPA. Any charge for separately requested work outside ordinary contractual duties must be appropriate and agreed in advance; it cannot be used to delay a mandatory notice or assistance.

A notification or precautionary restriction is not, by itself, an admission of fault. Liability, customer remedies and any agreed insurance arrangements are determined by the applicable contract and law, not by an unsupported public promise of unlimited reimbursement.

Where a security breach materially affects use of the Service, the remedies in the Terms of Service apply, including termination without penalty, a pro-rata refund of prepaid unused subscription fees and a standard export within seven calendar days of a verified request unless legally prohibited. Applicable statutory rights remain unaffected.

After the immediate response, we review appropriate lessons, track material remedial actions and update controls and procedures as needed. We do not promise that every possible future incident can be prevented.

Urgent security reports: security@truevalue.business. Data protection: privacy@truevalue.business. Contractual matters: legal@truevalue.business.

TrueValue Technologies Ltd, company number 17462580, registered office 66 Paul Street, London, England, United Kingdom, EC2A 4NA.