1. Overview
KIVO BPO is committed to protecting the confidentiality, integrity, and availability of our sensitive information, including customer information, employee information, and business information. This information security/sensitivity policy outlines the procedures and controls that are in place to ensure that sensitive information is handled securely and in compliance with applicable laws, regulations, and industry standards.

2. Types of Sensitive Information
KIVO BPO may process the following types of sensitive information:

• Customer information, including contact information, payment information, account information, transaction information, and other information provided by the customer
• Employee information, including personal information, employment history, payroll information, and benefits information
• Business information, including trade secrets, intellectual property, financial information, and strategic plans

3. Classification of Sensitive Information
KIVO BPO classifies sensitive information based on the potential impact of a security incident on the confidentiality, integrity, or availability of the information. Sensitive information is classified as follows:

• Confidential information: Information that, if disclosed or accessed by unauthorized individuals, could cause significant harm to KIVO BPO, its customers, or its employees. Examples include customer payment information, employee social security numbers, and trade secrets.
• Internal information: Information that is intended for internal use only and should not be disclosed to third parties without authorization. Examples include internal policies and procedures, financial reports, and employee performance evaluations.
• Public information: Information that is intended for public disclosure and is not considered sensitive. Examples include press releases, marketing materials, and job postings.

4. Handling of Sensitive Information
KIVO BPO has implemented the following procedures and controls for handling sensitive information:

• Access control: Access to sensitive information is granted on a need-to-know basis and is reviewed periodically to ensure that access is appropriate and necessary. KIVO BPO uses technical and organizational measures to protect sensitive information against unauthorized access, disclosure, alteration, or destruction.
• Transmission control: Sensitive information is transmitted only through secure channels, such as encrypted email or secure file transfer protocols. KIVO BPO uses industry-standard security technologies and procedures to ensure the confidentiality, integrity, and availability of sensitive information in transit.
• Storage control: Sensitive information is stored only in secure locations, such as encrypted servers or locked filing cabinets. KIVO BPO uses industry-standard security technologies and procedures to ensure the confidentiality, integrity, and availability of sensitive information at rest.
• Disposal control: Sensitive information is securely disposed of when it is no longer needed, in accordance with applicable laws and regulations. KIVO BPO uses industry-standard data destruction techniques to ensure that sensitive information is irretrievable.

5. Incident Response
KIVO BPO has implemented an incident response plan to address security incidents that may impact the confidentiality, integrity, or availability of sensitive information. The incident response plan includes the following:

• Identification and assessment of the security incident
• Containment and eradication of the security incident
• Notification of affected parties, as required by applicable laws and regulations
• Recovery and restoration of systems and information
• Review and analysis of the security incident to identify opportunities for improvement

6. Review and Maintenance
KIVO BPO regularly reviews and updates this information security/sensitivity policy to ensure that it remains effective and aligned with our information security objectives and controls.

If you have any questions or concerns about this information security/sensitivity policy or our handling of sensitive information, please contact us at [email protected].