Privacy Policy

Purpose

The purpose of the Privacy Policy is to protect the privacy and security of your Personally Identifiable Information (PII). This Privacy Policy outlines how we collect, use, disclose, and protect your PII in compliance with applicable laws and regulations.

Scope

The Policy applies to the workforce, agents, contractors, third-party partners, and all data and systems used by or supporting Edged.

This Policy encompasses all phases of privacy and applies to all information and data owned or managed by Edged.

Policy

1. Information We Collect

Edged may collect the following types of Personally Identifiable Information (PII):

Contact Information: Name, email address, phone number, mailing address.
Account Information: Username, password, account preferences.
Payment Information: Credit card details, billing address.
Demographic Information: Age, gender, occupation, interests.
Device Information: IP address, device type, browser type, operating system.
Location Information: Geographical location, GPS data (if applicable).
Other Information: Any other information you voluntarily provide to us

1. How We Use Your Information

Edged may use your Personally Identifiable Information (PII) for the following purposes:

Provide Services: To provide and maintain our products and services.
Communicate with You: To respond to your inquiries, provide customer support, and send you updates and notifications.
Personalization: To personalize your experience and tailor our services to your preferences.
Analytics: To analyze usage trends, monitor the effectiveness of our services, and improve our products and offerings.
Compliance: To comply with legal obligations and enforce our policies.

1. Data Security

Edged take reasonable measures to protect Personally Identifiable Information (PII) from unauthorized access, use, disclosure, alteration, or destruction. These measures include:

Encryption of sensitive data during transmission.
Implementation of access controls and authentication mechanisms.
Regular monitoring and testing of our security infrastructure.

1. Your Rights and Choices

Access and Correction: You may request access to, correction, or deletion of your PII by contacting us using the information provided below.

Cookies: You can manage your cookie preferences through your browser settings or by using opt-out tools provided by third-party advertisers.

Enforcement
1. Violations

Users detecting violations of this Policy should immediately report the violation to the GRC Team, who will verify the nature of the violation and report it to the IT Manager. A determination will be made as to the extent of risk that any non-compliance condition presents and what remediation activities are required.

Users who deliberately violate information security policies will be subject to disciplinary action up to and including termination of employment or association with Edged.

1. Exceptions and Variances

Suppose current practices or business needs require that exceptions or variance be made to this Policy. In that case, a formal exception/Variance is obtained by submitting an exception ticket via Jira. This requires, at a minimum, documenting the circumstances and business case for the needed control circumvention and/or compensating controls and obtaining approval from the IT Manager.

Approved exceptions are maintained in JIRA and reviewed at least annually to validate that risk at acceptable levels. Where the situation has changed to a significant degree, previously granted exceptions may be revoked.

5. Review and Approval

This Policy is owned by the Edged Security team, who is responsible for the related documentation’s content, review, and upkeep. The Policies are reviewed at least annually or after any major changes to Edged business practices or processing environments to ensure that the contents remain accurate. All Policies are current and available on IT Policy Page.

Each business unit will develop, and document IS operating standard procedures to ensure compliance with all corporate policies. The GRC Team is responsible for the implementation and monitoring of adherence to these policies.

References and Related Documents
1. Compliance References

NIST CSF: ID. GV, ID.RA, ID.RM, PR. IP
ISO 27001: 2018 A.6.1.1,

1. Related Documents

Data Governance Policy
Access Control Policy
Cyber Security Incident Response Standard
Cyber Security Incident Response Plan

7. Revision History

Version	Date	Author(s)	Changes Made
1.0	4/29/2024	Christian Nimoh	Draft
1.0	5/16/2024	Jacob Wintheiser	Approved