Data Security & Privacy Policy

Purpose

EDI must protect restricted, confidential or sensitive data from loss to avoid reputation damage and to avoid adversely impacting our customers. The protection of data in scope is a critical business requirement, yet ability to access data and work effectively is also critical. This policy outlines the requirements for data leakage prevention, a focus for the policy and a rationale.

Scope

Any employee, contractor or individual with access to EDI systems or data. Definition of data to be protected includes: PII, Financial, Restricted/Sensitive, Confidential IP, Customer/Respondent Collected Data, and Client Data.

Policy Requirements

EDI staff are required not to reference the subject or content of sensitive or confidential data publicly, or via systems or communication channels not controlled by EDI. The use of external e-mail systems not hosted by EDI to distribute data is not allowed.

EDI staff need to use a secure password on all systems as per the password policy. These credentials must be unique and must not be used on other external systems or services.

Terminated subcontractors or employees will be required to return all records, in any format, containing personal information.

EDI staff must immediately notify Henry Edinger in the event that a device containing in scope data is lost.

EDI staff must take extra precaution to ensure that data is appropriately handled when working remotely.

Data that must be moved within EDI is to be transferred only via business provided secure transfer mechanisms.

Any information being transferred on a portable device must be encrypted in line with industry best practices and applicable law and regulations.

Confidentiality Policy

EDI adheres to the CASRO (Council of American Survey Research Organizations) code of ethics and policies on confidentiality. Key principles include:

• Always enter into a confidentiality or “chain of trust” agreement when receiving and using legally-protected, personally-identifiable information.

• Always require subcontractors and third parties to enter into confidentiality agreements providing the same level of security.

• Always store or maintain personally-identifiable information in a verifiably secure location.

• Always control and limit accessibility to personally-identifiable information.

• Always use reasonable efforts to destroy personally-identifiable information once the survey is complete and validation has been conducted.

• Never knowingly receive, use or disclose personally-identifiable information in a way that will violate any Privacy Law or agreement.

International Compliance

In order to conduct international research, EDI complies in all material respects with international privacy laws and regulations, including compliance with the EU Safe Harbor privacy principles covering Notice, Choice, Onward Transfer, Access, Security, Data Integrity, and Enforcement.