Security & Data Protection Statement

This statement describes Innen Support’s approach to information security and protection of personal and business information. It is intended for website visitors, prospective clients and business partners.

1. Our approach

Innen Support recognises that operational support may involve access to confidential business information and, depending on the engagement, personal data. Security requirements are therefore considered as part of service design and contractual arrangements.

2. Core principles

• Confidentiality – information is accessed only by authorised persons with a business need.
• Least privilege – access should be limited to what is necessary for the assigned role.
• Integrity – appropriate controls are used to protect information from unauthorised alteration.
• Availability – reasonable measures are used to support continuity and recovery.
• Data minimisation – only information necessary for the relevant purpose should be processed.
• Accountability – contractual, organisational and technical controls should be documented where appropriate.

3. Access control

Access to systems and information should be granted according to role and business need. Credentials should be kept confidential and access should be removed or adjusted when no longer required.

4. Confidentiality

Personnel and relevant contractors may be subject to confidentiality obligations. Client information is not used for unrelated purposes.

5. Client data processing

Where Innen Support processes personal data on behalf of a client, the processing will be governed by the applicable client agreement and, where required, a Data Processing Agreement. Instructions, categories of data, categories of data subjects, security requirements, subprocessors, incident handling and deletion/return requirements should be documented.

6. Technical and organisational measures

• Access controls and authentication mechanisms.
• Role-based access where appropriate.
• Endpoint and system security controls appropriate to the environment.
• Backups and recovery measures where appropriate.
• Logging and monitoring where appropriate.
• Secure data deletion and disposal.
• Incident identification and response procedures.
• Confidentiality obligations and security awareness.

7. Subprocessors and service providers

Where third-party providers process personal data on behalf of Innen Support or a client, appropriate contractual safeguards and due diligence will be considered, including GDPR requirements where applicable.

8. International data transfers

Where data is transferred outside the EEA and GDPR applies, an appropriate legal transfer mechanism will be used where required.

9. Incidents and data breaches

Security incidents are assessed according to their nature and impact. Where a personal data breach occurs, Innen Support will follow applicable legal and contractual notification requirements. For processor activities, the relevant client will be notified in accordance with the DPA and applicable law.

10. Business continuity

Reasonable continuity and recovery measures may be used according to the systems, services and risks involved. Specific service continuity commitments are defined in applicable client contracts or SLAs.

11. No unqualified certification claims

Innen Support will not claim certification or compliance with a specific security standard unless the relevant certification or assessment has actually been obtained. Client-specific security requirements may be agreed contractually.

12. Contact

INNEN SUPPORT S.R.L.
Registered office: Strada Brândușelor nr. 18, Sat Berceni, Comuna Berceni, Județul Ilfov, România
CUI: 49292293
Trade Register No.: J2023008461235
Email: contact@innensupport.ro
Telephone: +40 757 655 857
Website: innensupport.ro