Our Policies
— IT Support Policy
Status: Draft for review Applies to: Ad-hoc Technical Support and Support Retainer clients Owner: Operations Manager Last updated: 19 August 2026
1. Purpose and Scope
This policy governs how DMC Agency delivers, prioritises, tracks and bills technical support requests, covering both ad-hoc (pay-as-you-go) support and clients on a Support Retainer. It applies to remote support (including RustDesk remote-access sessions) and on-site call-outs.
This policy does not cover implementation or project work under DMC’s other service lines (Microsoft licensing, hardware procurement, CMS & Contact Centre solutions, or hosting setup) unless that work is explicitly logged as a support ticket.
2. Support Channels
Support requests may be logged through:
- The DMC client portal / support app (preferred — enables triage, severity selection and time tracking as below)
- WhatsApp (text and image/screen-recording only — voice notes are not accepted; the channel will auto-respond asking the sender to resend as text, optionally with a screenshot or screen recording)
Requests submitted outside the portal are, where possible, captured into the same ticketing system so they follow the same triage and billing rules below.
3. Client Point of Contact
Each client company’s account holder must nominate a single point of contact (SPOC) authorised to raise support requests, accept the ad-hoc rate, and otherwise communicate with DMC on the company’s behalf. DMC treats requests, approvals and rate acceptances from the nominated SPOC as authoritative for that account.
The account holder may nominate more than one contact in writing (e.g. for larger organisations); each nominated contact is then treated as a SPOC for this purpose. Requests from individuals not on the nominated contact list are declined — DMC will not action them, and will direct the requester to have their SPOC submit or confirm the request.
The account holder is responsible for notifying DMC promptly when a nominated SPOC changes (e.g. staff turnover).
4. Eligibility and Rate Check
Before any billable work begins, DMC checks the requesting client’s account for an active Support Retainer:
| Situation | Outcome |
|---|---|
| Active retainer, hours remaining | Request proceeds under retainer terms at no additional charge, up to the included hours. |
| Active retainer, included hours exhausted for the current billing cycle | Request automatically proceeds under the ad-hoc rate for the remaining time. The client is notified of this switch. |
| No active retainer | The client must explicitly accept the applicable ad-hoc rate (remote/on-site, plus any after-hours multiplier) before the request proceeds. |
Acceptance of the ad-hoc rate (or notice of a retainer-to-ad-hoc switch) is logged and retained for billing-dispute purposes (see Section 10).
5. Severity Levels and Response Targets
Clients self-report a severity level when logging a request. DMC reserves the right to re-classify severity after triage; severity governs queue priority and response time only — it does not change the applicable rate.
| Severity | Definition | Target first response (business hours) |
|---|---|---|
| Critical | Business-stopping — system/server down, client cannot work, or a security incident | 30–60 minutes |
| High | Major function broken, no easy workaround | 2–4 business hours |
| Medium | Minor issue, workaround exists | same or next business day |
| Low | Question, small request, or cosmetic issue | within 2 business days |
Business hours: Monday–Friday, 08:30 – 16:30 SAST, excluding South African public holidays.
6. Request Intake (Triage)
Before a billable session starts, the client provides:
- A description of the issue.
- A RustDesk remote-access code, if the technician needs to connect to a specific device. This code is treated as sensitive information — see the POPIA & Privacy Policy for handling and retention.
- Supporting media (screenshot or screen recording) where relevant. 20MB file size / recording length limits.
A technician reviews this information before starting a billable session. This triage review is not billed — submitting clear detail benefits the client through a faster, cheaper resolution, not a discount.
7. Billing and Time Tracking
- Billable time is tracked from Start Session to End Session within the support system.
- Total elapsed time is rounded up to the nearest 15-minute increment.
- Sessions falling outside business hours are automatically flagged for the after-hours multiplier (1.5x).
- If a ticket is closed while a session is still running, the timer stops automatically at the closure timestamp.
- Any session flagged as unusually long, or left open past 3 hours, is held for manual sign-off by the Operations Manager before it is invoiced. Nothing is billed without verification.
- If a timer is stopped and needs to be restarted, the technician selects a reason from an approved list (e.g. “Waiting on client response,” “Waiting on parts/access,” “Escalated to another technician,” “Client requested pause”). This list is maintained by the Operations Manager.
Rate Card
| Tier | Rate |
|---|---|
| Remote Support (hourly) | R 550/hour |
| On-site Support (hourly) + call-out fee | R750/hour |
| After-hours multiplier | 1.5x remote / 2x on-site |
| Prepaid Support Hours (bundle) | 10 hours for the price of ~8.5 (roughly 15% off) |
| Support Retainer (per user/month) | R550/month for 3 users |
8. Ticket Closure and Follow-Up Work
Once a ticket is closed, it cannot be reopened to add further billable time — its record (billed time, invoice line) is treated as final for audit and reporting purposes. Any further work related to a closed ticket is logged as a new ticket, linked to the original (e.g. “follow-up to Ticket #123”). A linked follow-up ticket inherits the original ticket’s severity and skips re-triage.
9. Escalation
The client can press the Escalate button on the ticket screen, which sends a notification to the Operations Manager.
10. Records and Disputes
DMC retains triage submissions, session timestamps, severity classifications, rate-acceptance records and retainer-switch notifications for each ticket to support billing queries. A client disputing an invoice should contact billing@dmcagency.co.za or 087 151 4581 within 5 days of the invoice date.
Any personal information collected as part of a support request (including remote-access session data and support media) is handled in accordance with DMC’s POPIA & Privacy Policy.
11. Policy Review
This policy is reviewed when the rate card changes by the Operations Manager. Version history is maintained below.
| Version | Date | Change |
|---|---|---|
| 0.1 (draft) | 19 Aug 2026 | Initial draft for review |
— Domain, Email & Website Hosting Policy
Status: Draft for review Applies to: Clients of DMC’s Domain, Email & Website Hosting service line Owner: Operations Manager Last updated: 19 August 2026
1. Purpose and Scope
This policy sets out how DMC Agency registers, manages and supports domains, email hosting and website hosting on behalf of clients, and what each party is responsible for. It applies to all domains, mailboxes and websites hosted or managed by DMC, whether billed monthly or annually.
Requests made under this policy (DNS changes, domain transfers, mailbox/website changes) must come from the client’s nominated point of contact — see the Support Policy’s Client Point of Contact section.
2. Domain Registration and Ownership
- Domains registered by DMC on a client’s behalf are registered in the client’s name as registrant, unless otherwise agreed in writing. If DMC holds any domains under its own account for clients, this needs to be resolved and disclosed.
- DMC acts as the technical/administrative contact and manages DNS records unless the client requests otherwise.
- Domain renewal is the client’s responsibility; DMC will send renewal reminders at 60/30/7 days before expiry as a courtesy, but is not liable for a domain lapsing if the client does not act on renewal notices or has an invoice in arrears.
- Domain transfers (in or out) require the client’s written request and, where applicable, payment of any outstanding fees and the registrar’s transfer/unlock process.
3. DNS Management
- DMC manages DNS records (A, MX, TXT, CNAME, etc.) for hosted domains as part of the service.
- Changes requested by the client are actioned within the response timeframes set out in the Support Policy, following a written/portal request.
- DMC will maintain SPF, DKIM and DMARC records for hosted email to reduce spoofing and improve deliverability. Clients who route email through third-party platforms (e.g. marketing tools) must inform DMC so SPF/DKIM records include them.
4. Email Hosting
- Mailbox provisioning, quotas and aliases are managed per the client’s agreed plan.
- Acceptable use: hosted mailboxes may not be used to send unsolicited bulk email (spam), phishing content, malware, or content that is illegal under South African law. DMC reserves the right to suspend a mailbox implicated in abuse pending investigation, and will notify the client promptly.
- Backups: mailbox data is backed up daily (retained for 7 days), with a monthly recovery point retained as a single snapshot. Clients are encouraged to retain their own local/exported copies of business-critical email.
- Security: clients are responsible for keeping mailbox credentials confidential and enabling multi-factor authentication where offered. A client’s nominated point of contact can reset their own account/mailbox password via the support portal or the WhatsApp support bot. Where a client instead requests DMC to action the password change on their behalf, this is treated as a support request and billed under the Support Policy’s applicable rate. DMC will verify the requester’s identity before resetting any credentials.
- Offboarding: on termination of hosting, mailbox contents are retained for a maximum of 30 days to allow export, after which they are permanently deleted.
- Storage management: clients are responsible for monitoring their mailbox storage usage. Where usage approaches or exceeds the plan’s quota, the client must either upgrade to a higher storage package or reduce usage by archiving or deleting messages/attachments. DMC will notify clients approaching their quota as a courtesy but is not liable for delivery failures or service disruption caused by exceeded storage that the client did not act on.
5. Website Hosting
- DMC hosts client accounts on South African-based infrastructure, hosted by HostAfrica.
- Uptime target: 99.5% excluding scheduled maintenance.
- Backups: website files and databases are backed up daily (retained for 7 days), with a monthly recovery point retained as a single snapshot. Restoration from backup outside of a DMC-caused incident may be billed under the Support Policy.
- Maintenance windows: planned maintenance that may cause downtime is scheduled outside business hours where possible, with at least 24 hours’ notice to the client.
- Content responsibility: the client is responsible for the legality and accuracy of content published on their website (including compliance with POPIA where the site collects personal information — see the POPIA & Privacy Policy). DMC is responsible for the hosting infrastructure, not editorial content, unless DMC was contracted to produce that content.
- SSL/TLS: DMC provides and renews SSL certificates for hosted websites as part of the service, unless the client supplies their own.
- Storage management: clients are responsible for monitoring their website’s storage usage (files and database). Where usage approaches or exceeds the plan’s quota, the client must either upgrade to a higher storage package or reduce usage by archiving or deleting files. DMC will notify clients approaching their quota as a courtesy but is not liable for site issues caused by exceeded storage that the client did not act on.
6. Shared Responsibilities Summary
| Area | DMC’s responsibility | Client’s responsibility |
|---|---|---|
| Domain renewal payment | Send reminders | Approve/pay renewal on time |
| DNS changes | Action requested changes within SLA | Provide accurate change requests |
| Mailbox security | MFA availability, credential-reset process | Keep credentials confidential, enable MFA |
| Website content | Hosting uptime, backups, SSL | Legality/accuracy of published content, POPIA compliance for data the site collects |
| Data backups | Perform scheduled backups; periodically test restores | Retain independent copies of critical data where appropriate |
| Storage usage | Notify client when approaching quota (courtesy) | Monitor usage; upgrade package or archive/delete files to stay within quota |
7. Suspension and Termination
- DMC may suspend a domain, mailbox or website for non-payment after 5 days’ written notice, or immediately in cases of abuse, security compromise, or illegal content, with notice given as soon as reasonably possible.
- On termination of services (by either party), the client may request an export of website files, databases and email data within 30 days of termination, after which data is permanently deleted in line with DMC’s data retention practice (see POPIA & Privacy Policy).
8. Support for Hosting Issues
Faults with hosted domains, email or websites are logged and handled through DMC’s standard Support Policy (severity levels, triage and billing rules apply), except where the fault is caused by DMC’s own infrastructure, in which case no charge applies.
9. Policy Review
This policy is reviewed annually by the Operations Manager.
| Version | Date | Change |
|---|---|---|
| 0.1 (draft) | 19 Aug 2026 | Initial draft for review |
— POPIA & Privacy Policy
Status: Draft for review — legal review recommended before publication Applies to: All personal information processed by DMC Agency (clients, prospects, employees, website visitors) Owner: Information Officer (see Section 5) Last updated: 19 August 2026
Note: This policy is drafted to align with South Africa’s Protection of Personal Information Act, No. 4 of 2013 (POPIA). It is a working draft based on DMC’s current service lines and is not a substitute for legal advice — have it reviewed by a qualified attorney or compliance specialist before publishing.
1. Purpose
DMC Agency (“DMC”, “we”, “us”) processes personal information in the course of providing Microsoft licensing, hardware procurement, CMS & Contact Centre solutions, domain/email/website hosting, and IT support services. This policy explains what personal information we collect, why, how we protect it, and the rights data subjects have under POPIA.
2. Definitions (as used in POPIA)
- Personal information: information relating to an identifiable, living natural person (and, where applicable, an existing juristic person) — e.g. name, contact details, ID number, online identifiers, device information.
- Special personal information: a narrower category (e.g. health, biometric data, criminal behaviour) subject to stricter conditions — DMC does not intentionally collect special personal information as part of its services. Support sessions could incidentally capture screen content containing such data.
- Data subject: the person to whom personal information relates (client contacts, employees, website visitors, end-users of client systems).
- Operator: a party that processes personal information on behalf of a responsible party (e.g. a hosting provider processing data for DMC). DMC acts as responsible party for its own client/employee records, and as operator where it processes personal information on behalf of a client (e.g. hosting a client’s website that collects visitor data, or hosting a client’s CMS/contact-centre database).
- Processing: any operation performed on personal information — collection, storage, use, transmission, deletion.
3. What We Collect and Why
| Category | Examples | Purpose | Lawful basis (POPIA condition) |
|---|---|---|---|
| Client contact details | Name, email, phone, company | Account management, invoicing, communication | Performance of a contract / legitimate interest |
| Support request data | Issue description, severity, screenshots/screen recordings, RustDesk remote-access codes | Diagnosing and resolving support tickets | Performance of a contract |
| Billing and session records | Session start/end times, invoices | Billing, dispute resolution | Performance of a contract; legal obligation (record-keeping) |
| WhatsApp/communication records | Messages sent to DMC’s support channels | Support ticket handling | Performance of a contract; consent (channel use) |
| Website visitor data | IP address, cookies, form submissions, Google Analytics usage data | Website functionality, enquiry handling, understanding site usage | Consent / legitimate interest |
| Hosted client data (as operator) | Data within client websites, CMS/contact-centre platforms, or mailboxes that DMC hosts | Providing hosting/CMS infrastructure only — DMC does not access or use this content except to deliver or troubleshoot the service | Instruction of the responsible party (the client) |
| Employee data | HR, payroll, performance records | Employment administration | Legal obligation; performance of a contract |
| Marketing communications | Client contact details already held for account management | Informing existing clients about DMC’s related products/services | Legitimate interest — existing-customer exception under POPIA s69; see Section 4 |
We only collect personal information for these specified purposes and do not use it for unrelated purposes without further consent (POPIA’s purpose specification and further-processing-limitation conditions).
4. Direct Marketing
DMC may use a client’s existing contact details to market DMC’s own related products or services (e.g. a new service line, a relevant promotion) to that client, relying on POPIA section 69’s exception for existing customers.
- This exception applies only where: the client’s details were collected in the course of a sale or service, the marketing is for DMC’s own similar products or services, and the client is given a reasonable opportunity to opt out — both when their details were first collected and with every subsequent marketing communication.
- Marketing to prospects who are not existing clients requires prior opt-in consent before any direct marketing communication is sent — POPIA does not permit marketing to non-customers without consent.
- Every marketing communication includes a clear, working opt-out method (e.g. an unsubscribe link or reply-to-opt-out instruction). A client who opts out is removed from marketing communications promptly, and the opt-out is logged.
- Marketing communications are kept separate from operational/service communications (invoices, support updates, renewal reminders) — opting out of marketing does not opt a client out of necessary service communications.
- DMC’s customer database is not sold, rented, or shared with third parties for their own marketing purposes.
5. Information Officer
DMC’s Information Officer is responsible for POPIA compliance, including registration with the Information Regulator, handling data subject requests, and managing breach responses.
- Name/role: Andile Mtshali
- Contact: 074 444 7333 / abmtshali@dmcagency.co.za
- Registration status with the Information Regulator: Registered
6. Security Safeguards
DMC takes reasonable technical and organisational measures to prevent loss, damage, unauthorised access to, or unlawful processing of personal information, including:
- Access controls limiting who can view client data, support session records and RustDesk codes to staff who need it for their role.
- Encrypted transmission where supported by DMC’s systems (e.g. HTTPS, encrypted remote-access sessions).
- Regular backups of hosted data per the Domain, Email & Website Policy.
- Treating RustDesk codes and support session media as sensitive: codes are retained until the session is closed.
- Vetting of third-party operators (hosting infrastructure, CMS/contact-centre platform vendors) for adequate security before engaging them.
- Staff laptops used for support work follow DMC’s password, MFA and device-encryption requirements — see the Data Security Policy for the specific controls.
7. Retention
Personal information is retained only for as long as necessary for the purpose it was collected, or as required by law (e.g. tax/financial record-keeping under South African law), after which it is securely deleted or anonymised.
| Data type | Retention period |
|---|---|
| Support tickets (description, media, session logs) | 12 months from ticket closure |
| RustDesk access codes | deleted immediately after session if one-time |
| Invoices/billing records | typically 5 years |
| Hosted client data (as operator) | Retained per Section 7 of the Domain, Email & Website Policy; deleted per client instruction or on termination |
| Employee records | typically 5 years |
8. Sharing and Third Parties (Operators)
DMC shares personal information with third parties only where necessary to deliver services, including:
- Microsoft (licensing/CSP administration)
- Hosting infrastructure and domain registrars
- CMS/contact-centre platform vendors
- Odoo (business/CRM systems)
- 3CX (communications platform)
- Payment processors
Where a third party processes personal information on DMC’s behalf, DMC ensures a written agreement is in place requiring that party to maintain equivalent security safeguards, consistent with POPIA’s operator provisions.
9. Cross-Border Transfers
Where personal information is transferred outside South Africa (e.g. to a cloud service provider with servers abroad), DMC will only do so where the recipient is subject to laws, binding agreements, or other measures providing an adequate level of protection substantially similar to POPIA, or where another basis under POPIA section 72 applies (e.g. data subject consent). Current vendors involving cross-border transfer include Microsoft, Odoo, 3CX, Google (Google Analytics), and any offshore hosting providers used for backups or infrastructure.
10. Data Subject Rights
Subject to POPIA, data subjects have the right to:
- Be notified that personal information about them is being collected.
- Request access to the personal information DMC holds about them.
- Request correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information.
- Object to processing of their personal information, on reasonable grounds.
- Withdraw consent, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
- Lodge a complaint with the Information Regulator if they believe their information has been processed unlawfully.
Requests can be made to abmtshali@dmcagency.co.za. DMC will respond within the timeframes required by POPIA.
11. Data Breach Notification
If DMC becomes aware of a breach involving personal information (unauthorised access, loss, or disclosure), it will:
- Contain and assess the breach as soon as reasonably possible.
- Notify the Information Regulator and affected data subjects as soon as reasonably possible, as required by POPIA, including the nature of the compromise and steps recommended to mitigate harm.
- Document the breach and remedial action taken.
12. Known Gaps to Close Before Publication
Flagged from current internal notes — these should be resolved before this policy is finalised and published:
- Confirm data storage location/provider for support media (screenshots/recordings) and website form submissions raised via the CMS/contact-centre platform.
- Implement a cookie consent banner on the website (confirmed not yet in place — see Section 13) so visitors are prompted before analytics cookies are set, rather than relying solely on browser-level opt-out.
13. Cookies (Website)
DMC’s website uses Google Analytics to understand visitor behaviour (pages visited, session duration, general location/device) and to improve the site. This sets analytics cookies; DMC does not currently use marketing/advertising cookies.
Visitors can decline analytics cookies via their browser’s cookie settings, or by installing the Google Analytics Opt-out Browser Add-on. Data collected via Google Analytics is subject to Google’s own privacy practices — see Section 9 (Cross-Border Transfers).
A cookie consent banner is not currently implemented on DMC’s website. Visitors are not prompted to accept or decline analytics cookies before they are set. Until a banner is added, this section’s opt-out guidance (browser settings or the Google Analytics Opt-out Browser Add-on) is the only opt-out mechanism available to visitors.
14. Policy Review
This policy is reviewed [PLACEHOLDER — e.g. annually, or on any material change to data processing] by the Information Officer.
| Version | Date | Change |
|---|---|---|
| 0.1 (draft) | 19 Aug 2026 | Initial draft for legal review |
— Acceptable Use Policy
Status: Draft for review Applies to: All DMC Agency staff, contractors, and anyone using DMC systems, devices, or accounts. Owner: Operations Manager. Last updated: 19 August 2026
1. Purpose and Scope
This policy sets out what is and is not acceptable when using DMC Agency’s systems, devices, accounts and client-facing tools — including company email, internet access, the support ticketing/portal system, WhatsApp support channel, RustDesk remote-access, Odoo, and any hosted client systems staff can reach in the course of their work. It exists to protect DMC, its staff, and its clients from security, legal and reputational risk.
It applies alongside the Support Policy, Domain/Email/Website Policy, Data Security Policy and POPIA & Privacy Policy — where those policies set specific rules for a system or process, this policy sets the general standard of conduct.
2. General Principles
- Company systems and accounts are provided for business purposes. Limited, reasonable personal use (e.g. a quick personal email) is acceptable provided it does not interfere with work, consume significant resources, or create risk.
- Staff must not use DMC systems, credentials or client access for any unlawful purpose, or to bypass client, DMC or third-party security controls.
- Staff are accountable for activity carried out under their own login credentials and must not share passwords, session tokens or access codes with anyone, including colleagues, unless a documented handover process applies.
3. Email and Communication
- Company email accounts must not be used to send unsolicited bulk email, phishing content, or content that is discriminatory, harassing or illegal.
- Staff should treat unexpected attachments or links — even from apparently known senders — with suspicion, and report suspected phishing to IT Support rather than clicking through.
- The WhatsApp support channel is for client support requests only (text and images/screen recordings, per the Support Policy — voice notes are auto-rejected). It must not be used for internal staff communication that should sit in a proper system of record.
4. Internet and Software Use
- Staff must not download or install unauthorised software on DMC devices, particularly software that could compromise security (unlicensed tools, pirated software, browser extensions of unknown provenance).
- Access to client systems (CMS/contact-centre platforms, hosted websites, mailboxes) is only for legitimate support, implementation or maintenance purposes — never for personal curiosity or unrelated use.
- Staff must not use DMC internet access or company devices to access illegal content, or content that would embarrass DMC or breach a client’s trust if discovered.
5. Remote Access and RustDesk
- RustDesk (or any remote-access tool) may only be used to connect to a client device after a valid support ticket has been triaged, per the Support Policy.
- Technicians must not retain a connected session longer than necessary to complete the ticketed work, and must end the session explicitly rather than leaving it open.
- RustDesk codes and any credentials shared by a client during a support session are confidential — they must not be written down outside the ticketing system, shared with anyone not working the ticket, or reused for a purpose beyond that ticket. See the Data Security Policy for retention and handling rules.
6. Devices
- Staff using DMC-issued or DMC-approved devices for work (including personal devices used to access company email or client systems — “BYOD”) must: keep the device’s OS updated, enable a passcode/biometric lock, enable disk encryption where supported.
- Lost or stolen devices that have access to DMC or client systems must be reported to IT Support immediately so access can be revoked.
- Devices must be locked when unattended, particularly in client-facing or shared environments.
7. Social Media and Public Communication
- Staff must not represent DMC’s official position on social media or public forums unless authorised to do so.
- Client information, screenshots, or details of support incidents must never be shared publicly (including on social media, personal blogs, or in casual conversation) — this applies even to seemingly minor details, as combined with other information it may identify a client or breach confidentiality.
8. Data Handling
- Staff must only access client or company personal information relevant to their current task, consistent with the role-based access principle in the Data Security Policy.
- Personal information (client or employee) must not be copied to personal devices, personal cloud storage (e.g. personal Google Drive/Dropbox), or personal email accounts.
- Support media (screenshots, screen recordings) and RustDesk codes must stay within the ticketing system — not forwarded via personal channels for convenience.
9. Monitoring
DMC may monitor use of its systems (email, internet access, ticketing system, device logs) to the extent necessary to protect security, investigate suspected misconduct, or meet legal obligations, in accordance with South African law (including the Regulation of Interception of Communications and Provision of Communication-Related Information Act, where applicable) and POPIA.
10. Consequences of Breach
Breach of this policy may result in disciplinary action up to and including termination of employment or contract, and — where the breach involves client data or systems — may also expose DMC and the individual to legal liability. Suspected breaches should be reported to the Operations Manager as soon as they are identified.
11. Policy Review
This policy is reviewed annually by the Operations Manager.
| Version | Date | Change |
|---|---|---|
| 0.1 (draft) | 19 Aug 2026 | Initial draft for review |
— Data Security Policy
Status: Draft for review Applies to: All DMC Agency staff, systems, and third-party operators handling company or client data Owner: Operations Manager Last updated: 19 August 2026
1. Purpose and Scope
This policy sets out the technical and organisational measures DMC Agency uses to protect company and client data — including client records, support tickets and media, RustDesk remote-access sessions, hosted client systems (websites, mailboxes, CMS/contact-centre platforms), and employee data — from loss, unauthorised access, or misuse.
It is the internal operating standard that supports DMC’s POPIA & Privacy Policy: that policy explains data subject rights and legal obligations; this policy explains how DMC actually secures the data day to day. It should be read together with the Acceptable Use Policy.
2. Data Classification
| Class | Examples | Baseline handling |
|---|---|---|
| Public | Marketing content, published website pages | No special controls |
| Internal | Internal process docs, non-sensitive operational data | Staff access only |
| Confidential | Client contact/account records, invoices, contracts | Role-based access; not shared externally without authorisation |
| Restricted | RustDesk codes, support session media, credentials, ID numbers, hosted client data DMC processes as operator | Access limited to staff actively working the relevant ticket/task; handled per Sections 4–6 below |
3. Access Control
- Access to client data, support-tier pricing, and administrative functions is granted on a role-based, least-privilege basis — staff have access to what their role requires, not by default to everything.
- Access to a specific client’s data or systems is limited to staff assigned to that client’s account or an open ticket for that client.
- The Operations Manager is responsible for granting, reviewing and revoking access; access is reviewed quarterly.
- Shared/generic logins are not used for systems that touch client or personal data — each staff member has their own credentials, so actions are attributable.
- Access is revoked immediately on a staff member’s exit or role change.
4. Authentication and Credentials
- Multi-factor authentication (MFA) is required for email, Odoo, hosting/DNS control panels, and any system holding client or financial data.
- Passwords must be at least 6 characters long and include a mixture of character types, and must not be reused across systems.
- Credentials must never be shared via WhatsApp, email, or written down in an unsecured location. Where a credential must be shared (e.g. onboarding a new client system), it is shared through a password manager with expiring share links.
5. Remote Access and Support Session Security
- RustDesk sessions are only opened after a ticket has passed triage (per the Support Policy), and only for the duration needed to complete the ticketed work.
- RustDesk access codes are treated as Restricted data: codes are one-time session codes.
- Support media (screenshots, screen recordings) that may incidentally capture personal or sensitive information on a client’s screen is stored only within the ticketing system, not downloaded to personal devices, and retained per the schedule in Section 7.
- Technicians must end sessions explicitly rather than leaving a remote connection open after work is complete.
6. Device and Network Security
- DMC devices used to access client systems must have up-to-date OS/antivirus, disk encryption, a locking screensaver, and be enrolled in any device management DMC uses.
- Public or unsecured Wi-Fi should be avoided for accessing client systems; where unavoidable, a VPN should be used.
- Company Wi-Fi/network infrastructure (office and any remote server access) is secured with WPA2/3, segmented guest network, firewall rules.
7. Backups and Retention
- Client data hosted by DMC (websites, mailboxes, CMS/contact-centre databases) is backed up per the schedule in the Domain, Email & Website Policy.
- Internal systems (Odoo, ticketing system) are backed up weekly, downloaded from the server to offline storage, and encrypted.
- Backup restoration is tested annually to confirm backups are actually usable, not just present.
- Retention periods for support tickets, RustDesk codes, and other data categories follow Section 7 of the POPIA & Privacy Policy — this policy does not set separate retention rules to avoid the two documents drifting out of sync.
8. Third-Party and Operator Security
- Before engaging a new vendor/operator that will process company or client data (hosting providers, CMS/contact-centre platform, payment processors), DMC confirms the vendor has adequate security measures and, where required, signs an agreement obligating equivalent safeguards — consistent with Section 8 of the POPIA & Privacy Policy.
- Existing key vendors (Microsoft, hosting/domain providers, CMS/contact-centre platform) are reviewed annually for continued adequacy.
9. Incident Response
If a security incident is suspected or confirmed (unauthorised access, lost/stolen device, credential compromise, suspected data breach):
- Report immediately to the Operations Manager, regardless of how minor it seems.
- Contain — e.g. revoke affected credentials, isolate affected systems, end open remote sessions.
- Assess — determine what data/systems were affected and whether personal information was involved.
- Notify — where personal information is involved, this triggers the breach notification process in Section 11 of the POPIA & Privacy Policy (notifying the Information Regulator and affected data subjects).
- Record and review — document the incident and remedial steps, and review whether a control gap needs closing.
10. Governance and Review
- The Operations Manager is accountable for this policy day to day and signs off on exceptions (e.g. a staff member needing temporary elevated access).
- This policy is reviewed annually, or after any security incident, and is updated as DMC’s systems (Odoo, CMS/contact-centre platform, hosting infrastructure) evolve.
| Version | Date | Change |
|---|---|---|
| 0.1 (draft) | 19 Aug 2026 | Initial draft for review |
