Information Security Policy

Last updated: March 2026

Pretzel Films Ltd recognises the importance of protecting the confidentiality, integrity and availability of the information we handle. This policy outlines our commitment to maintaining appropriate security controls to protect company, client and supplier information.

Purpose

The purpose of this policy is to establish the principles and framework used to protect information assets across Pretzel Films Ltd. It supports responsible handling of information and reduces the risk of security incidents.

Scope

This policy applies to all employees, contractors, freelancers and suppliers who access Pretzel Films Ltd systems, data or services.

It covers all forms of information including digital data, communications, documents, production materials and confidential client information.

Security Principles

Pretzel Films Ltd follows widely recognised information security principles including:

• Protecting the confidentiality of client and company information
• Maintaining the integrity and accuracy of information
• Ensuring information is available when required for business operations
• Restricting access to authorised individuals only
• Applying appropriate safeguards to protect against cyber threats

Access Control

Access to systems and data is restricted based on business need. Users are granted the minimum level of access required to perform their role.

Authentication controls such as passwords and multi-factor authentication are used where appropriate to secure access to systems and cloud services.

Device Security

Pretzel Films Ltd operates primarily using secure Apple devices. Devices used for company work are configured with security controls including:

• Operating system security updates
• Device encryption
• Secure user authentication
• Built-in malware protection

Devices are protected against unauthorised access and must be kept physically secure.

Data Protection

Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Pretzel Films Ltd takes reasonable technical and organisational measures to safeguard personal data and confidential information.

Supplier Security

Suppliers and contractors working with Pretzel Films Ltd are expected to operate in accordance with appropriate security and data protection standards.

Suppliers who access company information or systems may be required to demonstrate compliance with security requirements as part of contractual agreements.

Incident Management

Any suspected information security incident must be reported promptly so that appropriate action can be taken.

This includes incidents such as:

• Loss of devices containing company data
• Unauthorised access to systems or files
• Malware or cyber attack
• Data breaches or suspected data breaches

Training and Awareness

Pretzel Films Ltd promotes security awareness and encourages employees and contractors to follow responsible security practices when handling company and client information.

Continuous Improvement

Pretzel Films Ltd regularly reviews its security practices and policies to ensure they remain appropriate for the nature of our work and evolving security risks.

Approval