Alexander Baker trading as @thatbakerface may receive private, commercially sensitive, personal, technical or unreleased information while providing creative, event, media and technical services. This policy sets out the controls used to protect it.
Scope
This policy applies to information received from clients, venues, contributors, suppliers, collaborators, subcontractors and other parties, whether spoken, written, visual, electronic or contained in equipment or media.
Confidential information
Confidential information may include:
- unreleased audio, video, photographs, campaigns, programmes, scripts, designs and creative concepts;
- event plans, guest information, schedules, security arrangements and access details;
- prices, budgets, commercial terms, business plans and supplier information;
- personal data and private correspondence;
- passwords, credentials, keys, system information, vulnerabilities and technical configurations;
- client files, source files, backups, recordings, research and production notes; and
- information identified as confidential or which a reasonable person would understand to be confidential.
Information not treated as confidential
Confidentiality does not apply to information that the recipient can show:
- is lawfully public other than through a breach of confidence;
- was already lawfully known without a duty of confidence;
- was independently developed without using the confidential information;
- was received lawfully from another source without a confidentiality restriction; or
- must be disclosed by law, court order, regulator or competent public authority.
Use and access
- Confidential information will be used only for the agreed work, administration, legal compliance or protection of legitimate rights.
- Access will be limited to people who reasonably need it.
- Information will not be discussed in public or shared through unsuitable channels.
- Credentials and access links will not be reused, copied or retained beyond the authorised purpose.
- Confidential material will not be used for publicity, showreels, portfolios, social media or case studies without permission or another clear lawful basis.
Subcontractors and service providers
Confidential information may be provided to an authorised subcontractor or service provider where reasonably necessary for the work. Only the necessary information will be shared, and an appropriate contractual, professional or legal duty of confidentiality will be required.
Storage and transmission
Protection will be proportionate to the information and may include access controls, password protection, multi-factor authentication, encryption where supported, secure links, restricted folders, recipient checks, private working areas and secure disposal.
Highly sensitive information should not be sent by an insecure method where a reasonably available safer method is appropriate.
Remote and on-site work
- Screens, documents and conversations will be protected from casual observation.
- Client or venue systems will be accessed only with authority and within the agreed scope.
- Copies will not be made merely for convenience where access to the original is sufficient.
- Equipment and media containing confidential information will not knowingly be left exposed to unauthorised access.
Return, deletion and retention
On request or when the work ends, confidential information will be returned, deleted or made inaccessible where reasonably practicable, subject to legal, insurance, tax, dispute, backup and professional record-keeping requirements. Any retained copy remains protected by this policy.
Required disclosure
Where disclosure is legally required, only the information reasonably required will be disclosed. The owner of the information will be notified beforehand where lawful and practicable.
Incidents
A suspected loss, mistaken disclosure, unauthorised access or other confidentiality incident must be reported promptly to Alexander Baker. The business will take proportionate steps to contain the issue, preserve evidence, notify affected parties where appropriate and meet any legal reporting duty.
Duration
The duty continues after a project or engagement ends for as long as the information remains confidential or for any period expressly agreed. Trade secrets and credentials remain protected while they retain that character.
Responsibility
Alexander Baker is responsible for this policy. Anyone engaged by the business must follow it and may lose access to work or information if they breach it.