Policy document

Acceptable Use Policy.

Clear rules for the safe, responsible use of company systems, networks and technology resources.

Version 4

Reviewed 6 October 2025

This policy applies to employees, contractors and authorised users of company-provided technology resources.

Purpose

To support appropriate and responsible use of company technology.

Who it covers

Employees, contractors and any other authorised users.

Report an issue

Tell IT or your line manager promptly if there is a concern.

Data breach report

Use the online reporting form.

Permitted use

Authorised users are permitted to use company-provided technology resources for work-related purposes, including communication, collaboration, and productivity tasks directly related to their roles.Internet access is allowed for research, communication, and accessing company-approved websites and online resources.

Prohibited use

Unauthorised access to, use, or distribution of sensitive, confidential, or proprietary information is strictly prohibited.Engaging in activities that violate local, national, or international laws or regulations is not allowed.Use of company technology resources for personal gain, commercial activities, or non-work-related purposes is prohibited.Installing unauthorised software, apps, or modifying system settings without proper authorisation is not permitted.Sharing login credentials, passwords, or accessing another user's account without permission is prohibited.

AI data privacy and control

Free AI tools may store, analyse, or use your data to improve their models. You often do not have visibility into where your data goes or who can access it.Uploading client information, financial records, or internal documents may violate privacy laws or contracts.If Microsoft Copilot is not available, staff will be given access to the paid version of ChatGPT. Free versions of AI must not be used.

Security and data protection

All users are responsible for maintaining strong and secure passwords, and for promptly reporting any suspicious activity or security concerns.Users must not engage in activities that could compromise the security or integrity of the company's systems or networks.Encryption should be used for transmitting sensitive data over untrusted networks. Speak to your IT provider if you are unsure.

Legitimate business interest

As part of its promotional and marketing activities, the company may use photographs, video footage, or other visual representations of staff members on its website, social media platforms, printed materials, or other marketing channels.The company will ensure that any use of staff images complies with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018. Where required, consent will be obtained before identifiable images of staff are used.

Authorised software

Staff must not install, download, or run software, applications, or executable files on company-owned devices without prior written approval from the IT department or an authorised manager.This includes freeware, shareware, browser extensions, mobile apps, and third-party tools. Approved software must be sourced through official channels and checked for compatibility and security.Unauthorised software may be removed without notice, and disciplinary action may be taken for policy violations. Submit business software requests to help@itliferaft.co.uk.

Email and communication

Company email accounts are for business purposes only. Sending unsolicited emails, spam, or phishing attempts is prohibited.Confidential or sensitive information should not be shared by email or other electronic communication without proper encryption.If you suspect a spoof call, end the conversation. Ask how the caller got your number, make clear it is a business number, say you suspect a scam, and ask them to follow up through the email address on the company website. Do not provide an email address to the caller. Then terminate the call.

Monitoring and enforcement

The company reserves the right to monitor technology usage, including network traffic, email, and system activity, for security and compliance purposes.Violations of this policy may result in disciplinary action, including suspension of technology privileges and legal action where appropriate.

Reporting violations and data breaches

Anyone who becomes aware of a violation of this policy must promptly report it to the IT department or their designated line manager.Because the business may need to report a data breach to the Information Commissioner's Office (ICO), staff must report any situation where data may be at risk at the earliest opportunity. This includes the loss or theft of a device.

Agreement

Use technology responsibly.

By using company technology resources, all users agree to follow this Acceptable Use Policy. Failure to comply may result in disciplinary action and potential legal consequences.

Contact IT Life-Raft