Security & Data Protection Overview

1. Our approach

Nebs-Creative uses proportionate technical and organisational measures to protect client work, accounts and personal data. Controls are selected according to the sensitivity of the information, client requirements, the systems involved and the risks of the engagement.

2. Access control

• Multi-factor authentication is required on supported accounts used for client work.
• Access is limited to people who need it for a specific project and is removed when no longer required.
• Shared credentials, where unavoidable, are stored in an approved encrypted password manager rather than ordinary documents or chat messages.
• The supplied internal policy requires access review at project close and periodic review of active access.

3. Devices and accounts

• Work devices are expected to use screen locking, current supported operating systems, automatic security updates and full-disk encryption.
• Anti-malware protection is required under the supplied internal policy for devices used for client work.
• Personal devices may be used only under the internal approval and security requirements.
• Team members must use unique credentials and follow the company password policy.

4. Data handling and minimisation

• We prefer sample, anonymised or pseudonymised data instead of live personal data where possible.
• Client Personal Data is restricted to approved tools and authorised people.
• Real personal data should not be inserted into designs/prototypes unless the client instructs us to do so and appropriate safeguards apply.
• Files containing confidential information are shared with access restrictions appropriate to the project.

5. Encryption and transfer

The supplied DPA provides for encryption in transit for transfers and encryption at rest where provided by approved storage systems, together with international-transfer safeguards where required by applicable data-protection law.

6. People and confidentiality

The supplied legal pack requires employees, contractors and freelancers to sign confidentiality and intellectual-property obligations before accessing client work. Security and data-protection training is required on joining and periodically thereafter under the internal policy.

7. Secure development and project work

Security responsibilities for a development project depend on scope. We may use version control, controlled access, reviews, testing, dependency management and structured deployment practices appropriate to the engagement. A client requiring a specific secure-development framework, penetration test, security standard, code audit or compliance certification should include it expressly in the SOW.

8. AI tools

Client confidential information and personal data must not be entered into unapproved AI tools. Where an approved AI tool is used with client information, the use must comply with the applicable client agreement, DPA, approved settings and restrictions on model training. Clients may restrict AI-generated elements in project-specific documents.

9. Incident response

The supplied internal policy requires suspected security incidents to be reported internally promptly and recorded. Where an incident involves Client Personal Data, the DPA requires client notification without undue delay and, under the current DPA, in any event within 48 hours after Nebs-Creative becomes aware of a relevant personal-data breach. Regulatory or individual notifications are handled as required by applicable law and client/controller responsibilities.

10. Business continuity and backups

Project work is generally maintained in approved cloud services with provider backup/recovery capabilities. Backup responsibility for client production systems, hosting and infrastructure depends on the project scope and should be stated in the SOW or hosting/maintenance agreement.

11. Data deletion

For Client Personal Data processed under the DPA, the current contractual position is return or deletion within 30 days after the relevant services end, subject to client instructions, legal retention obligations and normal backup-overwrite cycles. Other business records are retained according to our Privacy Policy and legal obligations.

12. Security reporting

If you believe you have found a security issue affecting Nebs-Creative, contact contact@nebs-creative.com with “Security” in the subject line and provide enough information for us to investigate. Do not access, download, alter or disclose data that is not yours, disrupt services or use destructive testing.

13. No absolute security guarantee

No organisation can guarantee that every system, device or transmission is completely secure. This overview describes our intended practices and does not create a warranty beyond the obligations expressly stated in an applicable client agreement or DPA.