1. Purpose

This policy outlines how Evergreen Marketing Group Ltd manages information security to protect client data, advertising platform access, and internal systems. While we are a small remote business, we apply practical, risk-based controls to maintain confidentiality, integrity, and availability of all data we handle.

2. Scope

This policy applies to all systems, accounts, and data used in the delivery of digital advertising and consultancy services. It covers information stored or accessed through Evergreen Marketing Group Ltd devices and platforms.

3. Governance & Ownership

James Green (Director) is responsible for the implementation and oversight of all security practices, tools, and reviews. As a sole operator, no other personnel have access to client or platform data.

4. Security Controls

4.1 Devices & Access

• All business devices are encrypted, password-protected, and used solely by the Director
• All key services (email, cloud storage, ad platforms) have two-factor authentication (2FA) enabled
• No passwords are stored in plaintext or shared via unsecured channels

4.2 Data Storage & Backup

• All files are stored in secure, GDPR-compliant cloud environments (e.g. Google Workspace)
• Sensitive client documents are kept in restricted-access folders
• Cloud-based backups are active and monitored automatically — no local or physical servers are used

4.3 Platform Integrations

• Access to client ad accounts is via official platform APIs or admin access, never via shared logins
• Access is strictly limited to campaign execution and reporting
• No third-party contractors or developers access client data or accounts

5. Risk Management

We take a minimum-access, zero-bloat approach to tooling and workflows. Only essential data is stored, and unnecessary retention is avoided. Platform permissions are reviewed when onboarding or offboarding clients.

6. Incident Response

• Any suspected breach or unauthorised access will be investigated immediately
• Clients will be notified promptly if their data may be affected
• Incidents are logged, with actions taken to prevent recurrence

7. Vendor & Software Policy

• All tools used are industry-standard SaaS platforms with published security practices
• We do not use custom-built software or unsupported tools
• Vendors are selected based on reliability, compliance posture, and support availability

8. Certifications

Evergreen Marketing Group Ltd is not ISO 27001 certified. However:

• Our controls are aligned with ISO 27001 principles where practical
• We are happy to complete security questionnaires or work to client frameworks as needed

9. Review & Updates

This policy is reviewed annually or after any material change in business operations or tooling. Updates are version-controlled and documented.

Summary

We are a lean, security-conscious consultancy that only accesses the data we need to deliver services — nothing more. We don't subcontract, don't carry legacy systems, and maintain tight control over every touchpoint. If your business has specific requirements, we're happy to accommodate them within reason.