Information Security Policy

1. Introduction

This Information Security Policy establishes the framework for protecting information assets within the My Journey application, a project of The Jubilee Trust (Charity No. 1077936). This policy applies to all users, administrators, and any third parties who access, process, or manage data within the My Journey system.

1.1 Purpose

The purpose of this policy is to ensure the confidentiality, integrity, and availability of all information processed through the My Journey application, whilst supporting The Jubilee Trust in fulfilling its charitable objects of advancing the Christian faith.

1.2 Scope

This policy covers all data collected, stored, processed, and transmitted through the My Journey application, including:

• User account information and credentials
• Faith conversation records and notes
• Contact information of individuals encountered
• Geolocation data where enabled
• System logs and audit trails
• Backup data and archives

2. Information Classification

2.1 Data Categories

My Journey processes the following categories of data:

Personal Data: Names, email addresses, phone numbers, and any information that can identify an individual.

Sensitive Personal Data: Religious beliefs, faith journey stages, and spiritual conversations which constitute special category data under UK GDPR.

Location Data: GPS coordinates and location names where conversations took place.

Operational Data: System logs, user activity records, and analytical data.

2.2 Handling Requirements

All sensitive personal data relating to faith and religious beliefs must be processed with explicit consent and handled with additional security measures as required by data protection legislation.

3. Access Control

3.1 User Authentication

• All users must authenticate using unique credentials (email and password)
• Passwords must meet minimum complexity requirements
• Two-factor authentication (2FA) is available for administrator accounts
• Failed login attempts are logged and monitored

3.2 Authorisation

• Access rights are granted based on the principle of least privilege
• Users can only access their own recorded conversations
• Administrators have elevated access for user management purposes
• Access permissions are reviewed regularly by organisation administrators

3.3 Session Management

• User sessions timeout after periods of inactivity
• Users should log out when finished using the application
• Sessions are terminated upon password change

4. Data Protection

4.1 Encryption

All data transmitted between users and the My Journey application is encrypted using SSL/TLS (HTTPS). Database connections are secured and access is restricted to authorised systems only.

4.2 Data Storage

• Data is stored on secure servers with appropriate physical and logical controls
• Regular backups are performed and stored securely
• Backup data is encrypted and access-controlled

4.3 Data Retention

Data is retained in accordance with the Privacy Policy. Users may request deletion of their data, and organisations can export data before account closure.

5. Acceptable Use

5.1 User Responsibilities

All users of My Journey are responsible for:

• Keeping login credentials confidential and secure
• Only recording information with appropriate consent
• Reporting any suspected security incidents immediately
• Using the application only for its intended purpose
• Complying with data protection legislation

5.2 Prohibited Activities

Users must not:

• Share login credentials with others
• Attempt to access data belonging to other users
• Store or transmit malicious code through the application
• Use the application for any unlawful purpose

6. Incident Response

6.1 Reporting Security Incidents

Any suspected security incident, data breach, or vulnerability must be reported immediately to your organisation administrator, who will escalate to The Jubilee Trust as appropriate.

6.2 Incident Handling

The Jubilee Trust maintains an incident response procedure that includes:

• Identification and containment of incidents
• Investigation and impact assessment
• Notification to affected parties where required
• Remediation and recovery actions
• Post-incident review and improvement

7. Physical Security

The My Journey application is hosted on secure infrastructure provided by our technology partner. Physical security controls include restricted data centre access, environmental controls, and monitoring systems.

8. Third-Party Security

The Jubilee Trust uses Mirata Ltd as its technology provider. All third-party providers are required to maintain appropriate security standards and comply with data protection requirements.

9. Compliance

This policy supports compliance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations
• Charity Commission requirements

10. Policy Review

This policy will be reviewed annually or following any significant security incident or change to systems or legislation. Updates will be communicated to all users.

11. Contact

For security-related enquiries, please contact The Jubilee Trust through the contact details provided on the My Journey application.