Security Management Policy

01 Purpose and scope

This policy sets out how LightCastle keeps its information assets confidential, accurate and available. It applies to all employees, contractors and third parties who have access to our systems and data.

02 Information security objectives

• Protect sensitive information from unauthorised access.
• Keep data accurate and complete.
• Keep systems available when they are needed.
• Meet our legal and regulatory requirements.
• Protect LightCastle’s reputation.
• Reduce the risk of security breaches.

03 Information we collect and how we use it

Primary data collection

Field research may collect personal and business details. We collect this only after the participant gives verbal consent.

Email communications

We use email to reply to enquiries. Please do not send sensitive details such as passwords or bank information by email.

Transfer of assets

If LightCastle is acquired, sold or goes through bankruptcy, personal and non-personal data may transfer to the new owner.

Other disclosures

We may disclose data where the law requires it, or where needed to protect our legal rights, our website, our users or the public.

04 Collecting personal data

• We ask for written consent before collecting personal data, and explicit consent before sharing it with a third party.
• Consent requests use simple, clear language without legal jargon.
• We never sell personal data.
• We use reasonable safeguards, but no online system can be guaranteed completely secure.

05 Security controls

We apply 23 operational controls. The main ones are summarised below.

1. 01Access control

   Access limited to what each role needs; reviewed annually.

2. 02Passwords & MFA

   Strong, unique passwords and multi-factor authentication for sensitive systems.

3. 03Data retention & destruction

   Data kept only as long as needed, then securely deleted.

4. 04Physical security

   Restricted, monitored access to critical facilities.

5. 05Training & awareness

   Regular security and phishing-awareness training for staff.

6. 06Third-party security

   Partners must meet our security standards, set out in contracts.

7. 07Disaster recovery

   Critical data backed up and recovery plans tested regularly.

8. 08Cloud security

   Encryption, access controls and regular security assessments.

9. 09Data protection law

   Personal data handled under Bangladesh’s Data Protection Act, including cross-border transfers.

The full list of 23 controls is included in the PDF version of this policy.

06 Reporting a security concern

Staff must report any suspected or confirmed security incident promptly. Incidents are handled and documented by the Digital Transformation team and, where required, reported to the relevant authorities.