1. Purpose and Scope

This Privacy and Confidentiality Policy is established to ensure that Mission View Capital (MVC) maintains the trust of its clients and prospective clients by safeguarding their confidential information. The policy applies to all MVC employees, partners, contractors, and service providers, collectively referred to as "staff."

It defines the standards, methods, and responsibilities required to protect confidential information in all aspects of MVC's operations and interactions.

 

2. Core Principles

1. Confidentiality: All client and prospective client information is treated as confidential and disclosed only with explicit authorization.

2. Data Integrity: MVC ensures that all records are accurate, up-to-date, and securely stored.

3. Proactive Risk Management: Measures are taken to prevent confidentiality breaches through training, technology, and strict adherence to policy.

4. Transparency: MVC communicates its data protection practices to clients and prospective clients clearly and consistently.

 

3. Standards for Confidentiality and Data Protection

3.1 Employee and Partner Responsibilities

• Non-Disclosure Agreements (NDAs): All staff members must sign NDAs outlining obligations to maintain confidentiality.

• Access Control: Confidential information is accessible only to authorized individuals based on role-specific permissions.

3.2 Methods and Tools to Secure Data

Digital Security Measures

1. Data Encryption:

   • Encryption is applied to all data in transit (e.g., TLS) and at rest (e.g., AES-256).

2. Secure File Storage:

   • Confidential files are stored on servers protected by firewalls and intrusion detection/prevention systems (IDS/IPS).

3. Password Management:

   • Unique, complex passwords are managed using an enterprise-grade password manager.

4. Multi-Factor Authentication (MFA):

   • MFA is required for access to systems containing confidential information.

Physical Security Measures

1. Secure Offices:

   • Offices feature keycard access and are monitored by CCTV systems.

2. Document Disposal:

   • Physical documents are shredded, and electronic media are wiped using Department of Defense (DoD) standards before disposal.

Monitoring and Threat Detection

1. Endpoint Security:

   • Devices are equipped with antivirus, anti-malware, and endpoint detection software.

2. Network Monitoring:

   • Continuous monitoring is conducted for unusual or unauthorized activity.

Compliance and Audits

1. Data Privacy Regulations:

   • MVC complies with all applicable data protection laws, including GDPR and CCPA.

2. Regular Audits:

   • Internal and external audits are conducted regularly to ensure compliance and identify areas for improvement.

 

4. Proactive Policies for Handling Confidential Information

4.1 Client Communication

1. Secure Channels:

   • Communication with clients must use secure, encrypted platforms (e.g., Microsoft Teams or encrypted email).

2. Consent Requirements:

   • Client information is not shared with third parties without prior written consent.

4.2 Document Classification and Handling

1. Labeling:

   • Documents are classified and labeled as “Confidential,” “Sensitive,” or “Internal Use Only.”

2. Storage:

   • All classified documents are stored securely, either in physical locked cabinets or encrypted digital systems.

4.3 Incident Response Plan

1. Immediate Action:

   • In case of a data breach, the incident response team is activated to assess and mitigate risks.

2. Client Notification:

   • Clients are informed promptly of breaches affecting their information, along with proposed resolution measures.

4.4 Training and Awareness

1. Mandatory Training:

   • Annual training on confidentiality, data security, and emerging threats is mandatory for all staff.

2. Policy Updates:

   • Staff are informed of any updates to the confidentiality policy and required to acknowledge their understanding.

 

5. Public Spaces Policy

To prevent accidental disclosure of confidential information in public settings, staff must adhere to the following:

1. No Public Discussions:

   • Confidential information must not be discussed in public areas such as cafes, airports, or co-working spaces.

2. Device Use:

   • If laptop or mobile devices must be used to turn around urgent client requests, they must have privacy screens should not be used if their screens are in sight of others.

3. Printed Materials:

   • Confidential documents must be securely stored in locked bags or briefcases when transported.

4. Secure Connections:

   • Public Wi-Fi must not be used for accessing confidential systems unless a secure VPN is employed.

 

6. Implementation and Enforcement

6.1 Policy Enforcement

1. Managerial Oversight:

   • Managers are responsible for ensuring compliance with this policy.

2. Disciplinary Actions:

   • Non-compliance may result in disciplinary actions, including termination of employment or partnerships.

6.2 Policy Review

1. Annual Reviews:

   • The policy will be reviewed annually or as needed to align with new standards and regulations.