Data Classification Policy

1) Introduction and scope

This policy sets the framework for classifying data and applying controls by sensitivity to protect Tanqory’s, customers’, partners’, and stakeholders’ data.
Covers all data types (digital/physical/verbal), all media, and all locations where Tanqory stores, processes, transfers, or disposes of data, including cloud services and mobile devices.
Use alongside the Privacy Policy, DPA, Acceptable Use Policy, Security Standards, Data Retention Schedule, and Incident Response Playbook; if conflicts arise, the stricter/more specific document prevails (contract/Order Form > this policy > general terms).
Aligned with ISO/IEC 27001/27701, SOC 2, PCI DSS, GDPR/UK GDPR, PDPA SG, and NIST for global consistency.
Applies to all roles: employees, contractors, service providers, third parties, auditors, and partners with access to Tanqory data.
Binding details follow contracts/Order Forms/specific measures for Enterprise customers where applicable.
Continued system use signifies acceptance and compliance with this policy, including announced changes.
NDA/DPA must be signed before accessing non-public data, and mandatory training must be completed before work starts.
Security/legal events may require immediate temporary measures; notice will be provided as soon as practicable.
Questions/reporting channels: dpo@tanqory.com, security@tanqory.com.

2) Classification levels and examples

Four levels: Public (L1), Internal (L2), Confidential (L3), Restricted (L4), determined by impact, risk, law, and business value.
Public (L1): Publicly released data (approved web content, marketing); no personal/confidential data.
Internal (L2): Internal use (policies, procedures, operational info not for external release).
Confidential (L3): Customer/partner data, internal personal data, unpublished financials, business logic; disclosure could harm reputation/compliance.
Restricted (L4): Highly sensitive data such as payment/PCI, sensitive/health/biometric data, encryption keys, trade secrets, open incidents, data under strict legal/court orders.
Summary of controls per level is in Appendix A; when in doubt, classify at the higher level.
Classify upon creation/receipt and review when context changes (e.g., external sharing/third parties).
If mixed data exists, apply the highest classification present.
Do not downgrade without data owner/security approval.
Label documents/systems/storage clearly with the classification level.

3) Access and controls by level

Least privilege and need-to-know apply to all levels; MFA enforced for L3/L4 and critical systems.
Public: Approved open sharing; no special encryption required, but use approved sources.
Internal: Restricted to authorized staff/contractors by role; use SSO/MFA; share internally via auditable corporate channels.
Confidential: Fine-grained permissions, access logging, encryption at rest/in transit (AES-256 / TLS 1.2+); do not send externally by email without protection (e.g., secure link/separate password).
Restricted: Only a limited, explicitly authorized group; audit logs, DLP, session monitoring, segregated key management, network segmentation/zero trust.
Do not copy/download/carry L3/L4 to personal devices or portable media without approval and encryption.
External providers must have DPA/SCC/IDTA/equivalent and pass security assessment before accessing L3/L4.
Cross-region sharing must meet data transfer laws (GDPR/UK GDPR/PDPA, etc.) with appropriate safeguards.
Systems/content must be tagged (metadata/labels) to enable DLP and automated permissions.
Review access regularly (at least quarterly for L3/L4) and revoke immediately when no longer needed/role changes.

4) Storage, transmission, and portable media

Public/Internal: Store in approved corporate systems; standard backups; share within company/approved partners.
Confidential: Encrypt at rest/in transit; use approved channels (VPN/HTTPS/secure transfer); avoid external email attachments—use short-lived links/separate passwords.
Restricted: Use dedicated encrypted repositories, managed endpoints (MDM/EDR); no portable media unless explicitly approved and full-disk encrypted.
Do not use personal systems/personal cloud to store or transmit L3/L4; only approved accounts/zones.
Printing L3/L4 must be limited/tracked; store physical documents in locked cabinets/rooms with access logs.
Third-party transfers require contract/SOW specifying classification and safeguards.
Backups of L3/L4 must be encrypted and controlled at parity with source data.
Apply retention per the Data Retention Schedule and delete/destroy when no longer needed.
When using data in public/semi-public areas, prevent shoulder-surfing/eavesdropping (privacy screens, secure meeting rooms).

5) Data and media destruction

Public/Internal: Standard deletion; physical media destroyed with standard shredding.
Confidential/Restricted: Secure wipe/cryptographic erase and destroy media (shred/degauss/physical destruction) per NIST/ISO.
Keep destruction evidence (certificate/log) for L3/L4 and have it verified by the data owner/security.
Backups/archives must be purged at end of retention and not restored for normal processing except for security/legal needs.
Do not discard storage media containing L3/L4 without proper destruction.
Disposal vendors must be contracted and meet adequate security standards.
Data under court order/legal hold requires legal approval before destruction.
Customer erasure/RTBF requests follow SLA in the DPA/Privacy Policy.
Confirm completion to requesters/owners where law/contract allows.
Maintain destruction records for audit/dispute reference.

6) Roles and responsibilities

Data Owner: defines classification, manages permissions, reviews, and approves sharing for their source/system.
Custodian/Admin: enforces technical controls (permissions, encryption, DLP, logging) per level.
Users/Staff: label correctly, follow level controls, use approved channels, and report anomalies immediately.
DPO/Legal: advise on law/transfers/data subject rights and check compliance.
Security: set standards, monitor, improve, and respond to incidents.
Third-party/vendor manager: ensure contracts/security assessments cover the data levels accessed.
Audit/Compliance: monitor and report risks/gaps and track remediation.
Business leadership: provide resources and enforce within teams.
Violations may lead to disciplinary action, contract termination, or legal action.
Roles and RACI may be appended or in team runbooks where applicable.

7) Monitoring, review, and improvement

Periodic access reviews for L3/L4 (at least quarterly); key audit logs retained per security standards.
DLP, SIEM, and alerting to detect leakage/abnormal access, respecting applicable privacy laws.
Regular classification reviews (at least annually) and after major events (data migration, M&A, new system rollout).
Internal/third-party audits per ISO/SOC/PCI/legal requirements, with remediation tracked.
Metrics/KPIs: labeling completeness, DLP events, access breaches, deprovisioning time on offboarding.
Update supporting docs (standards/procedures/runbooks) to align with this policy.
Tabletop/drills for data breach response covering L3/L4 and regulator/data-subject notification.
Record audit findings and remediation plans for compliance/audit trail.
If classification is found inappropriate, correct promptly and adjust controls; notify stakeholders.
Report review outcomes to management per cadence/risk.

8) Security incidents and notifications

Report L3/L4 incidents immediately to security@tanqory.com and follow the Incident Response Playbook.
Notifiable events (e.g., GDPR 72h, PDPA SG 3 days) will be assessed and regulators/data subjects notified as required.
Log incident details/scope/impacted data/remediation and lessons learned.
Unauthorized access/leak of L4 is critical; escalate immediately (CISO/relevant leadership).
If third parties are involved, coordinate per DPA/incident clauses and track remediation.
During investigations, access may be limited/systems paused to stop harm.
Post-incident reviews will drive control/training improvements.
Notify customers/partners per contract/law with mitigation guidance.
Where rights may be affected, provide transparent info as far as law/safety permits.
Maintain incident records for audit/legal/dispute purposes.

9) Training and awareness

Anyone accessing data must complete security and data classification training before access and refresh at least annually.
Roles accessing L3/L4 require deeper training (encryption, DLP, data law, PCI/sensitive data).
Provide quick guides (cheat sheets/FAQ) on labeling, sharing, and destroying data by level.
Promote a “report-first” culture for anomalies/misuse.
Run phishing simulations/awareness to prevent leaks via email/file channels.
Incorporate incident/audit lessons into training and guides.
Leadership must ensure team participation in required training.
Keep training records for compliance (ISO/SOC/legal).
Assess training effectiveness (quiz/score) to improve.
Communicate policy changes via email/dashboard (durable medium) when significant updates occur.

10) Policy changes and communication

Changes that add burden/reduce rights: announce at least 30 days in advance via email/dashboard (durable medium), unless immediate safety/legal needs.
If conflicting information exists, rely on the latest document (this policy/standards/Order Form/dashboard notice).
Maintain change history for compliance/audit and disputes.
If changes are not accepted, customers may exercise rights under contract/law.
Update appendices/supporting standards when structure/tools/law change.
Include contact channels with each change notice.
Translations may be provided; English version prevails.
PCI/special-law changes will be announced with updated practices.
Related pricing/quota info (if any) is in the latest Pricing/Order Form.
All key communications are retained in accessible systems for audit.

11) Contact channels

Info/policy/classification: security@tanqory.com, dpo@tanqory.com
Legal/transfers/rights: legal@tanqory.com, dpo@tanqory.com
Security incident/breach reports: security@tanqory.com (immediate)
Data subject rights requests: dpo@tanqory.com or dashboard form
Partners/vendors: vendor-security@tanqory.com
Help Center: https://help.tanqory.com
Registered agent address: c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA
Include system/data level/recipient/incident when contacting to speed responses.
Response SLA: intake ≤2 Business Days, updates every 10 Business Days, target closure 30 days; complex cases will include reasons if longer.

Appendix A: Levels/examples/key controls

Change history