Staff Data Security Policy
Context, Scope and Application
Music Monitor staff come into contact with personal information relating to students and staff of the institutions that are our customers while developing Music Monitor and supporting the users. This policy sets out our expectations of our staff in relation to the integrity of the data we deal with.
Alison Carr Solutions is a small business operated by a sole-trader and does not operate a business premises. All Music Monitor staff, including the business owner, work entirely from home with the exception of work performed on a customer’s premises. Therefore, this Staff Data Security policy also encompasses a Working From Home policy and a Bring Your Own Device policy.
Music Monitor is a product built on a platform of Claris FileMaker. It takes the form of a set of files stored on a server. Some security measures pertain to the Claris platform, or the server environment, and are covered in other policies. This policy covers the behaviour of Alison Carr Solutions’ staff, and applies to those people.
Alison Carr Solutions is a small business operated by a sole-trader and does not operate a business premises. All Music Monitor staff, including the business owner, work entirely from home with the exception of work performed on a customer’s premises. Therefore, this Staff Data Security policy also encompasses a Working From Home policy and a Bring Your Own Device policy.
Music Monitor is a product built on a platform of Claris FileMaker. It takes the form of a set of files stored on a server. Some security measures pertain to the Claris platform, or the server environment, and are covered in other policies. This policy covers the behaviour of Alison Carr Solutions’ staff, and applies to those people.
Policy Content
Physical Environment
Devices
Handling Data
- Workstation is not in view of others when accessing personal information.
- Home is secured against unauthorised entry.
- Network is not accessible without authority:
- WiFi is password protected
Devices
- Any device that has access to personal information is password protected.
- Software is regularly updated with security patches.
- User profile that has access to personal information is not accessible to others.
Handling Data
- The expected way to support customers is via a medium where the customer has control over access to their data:
- Phone call
- Video call where the customer chooses to share their screen
- Remote support platforms Splashtop or TeamViewer, where the customer approves access and is present and supervising during access.
- Direct access to customers’ files is only given with the customer’s agreement, is only given where required for delivery of the service, is only given to those staff members who require it in their roles, and is only used for situations where supervised access is not sufficient.
- Staff will not copy or record personal data from customers’ files.
- In limited cases, a senior Music Monitor staff member may need to temporarily save a copy of a file to a local device for some support services.
- In a case where customer records need to be copied to a staff member’s local device during delivery of a service:
- Data is handled as an entire file. Individuals records are not inspected or saved separately.
- Data is encrypted in transit and at rest.
- Records are kept only for the required time while the work is carried out and then deleted from the local device.
Last Updated: 23 May 2025