Data Security Policy

Effective Date: 5 January 2022

Moxe Consulting (“the Firm”) is committed to protecting the security, confidentiality, and privacy of all information entrusted to us. This policy sets out the measures adopted by the Firm to manage data responsibly and in accordance with applicable international standards. It applies to all personnel, including affiliated professionals, who support our due diligence and investigative work.

This policy is reviewed periodically and updated as necessary in response to legal, regulatory, or operational developments.

1. Scope and Applicability

This policy applies to all data collected, processed, or retained by the Firm in the course of its professional activities. This includes information received directly from clients, obtained from public sources, or gathered through discreet field-based methods. It covers both electronic and physical records and extends to all individuals and entities acting under the Firm’s instruction or supervision.

2. Security Principles and Data Handling

The Firm follows internationally recognized information security principles to ensure that data is handled in a secure, confidential, and professional manner. All information is treated as confidential unless it is demonstrably public or disclosed with authorization. Internal protocols are designed to prevent unauthorized access, modification, loss, or disclosure of any information handled in the course of our work.

Access to sensitive data is strictly limited to authorized individuals who require it to fulfill specific professional responsibilities. Appropriate safeguards are in place to preserve the integrity and availability of data and to ensure that it is stored and transmitted securely.

3. Technical and Organizational Measures

The Firm maintains secure data environments with access restrictions, authentication procedures, and information compartmentalization. Case-related data is stored on secure platforms configured to international standards, with controlled access based on the principle of least privilege. All communication involving sensitive or confidential information is conducted through secure channels, and information is not retained beyond the period reasonably required for the purpose for which it was collected.

Regular reviews of data storage, access protocols, and third-party systems are conducted to ensure that appropriate controls remain in place and that any required updates are implemented promptly.

4. On-the-Ground Information Gathering

Certain assignments may require the collection of information through field interviews, discreet inquiries, or local research methods. These activities are carried out by qualified professionals operating under strict confidentiality obligations. All information obtained through such methods is subject to the same standards of confidentiality, protection, and verification as information received through other channels.

5. Network and Affiliate Controls

Where the Firm engages affiliated professionals or researchers to support the delivery of services, their responsibilities are clearly defined and subject to written confidentiality terms. These individuals are required to handle information with due care and are not permitted to retain, copy, or share data beyond the scope of the work authorized by the Firm. The Firm remains responsible for ensuring that all persons involved in its assignments act in compliance with this policy and applicable obligations.

6. Internal Compliance and Supervision

The Firm provides regular guidance to its staff and affiliated professionals on appropriate information handling. Engagement in sensitive or restricted matters is limited to those who have acknowledged and accepted applicable confidentiality and data protection obligations. The Firm’s internal team oversees compliance, and measures are taken to address any identified issues promptly and effectively.

7. Incident Response and Breach Management

The Firm maintains a protocol for responding to actual or suspected data security incidents. In the event of an incident involving the loss, unauthorized access, or misuse of information, appropriate steps are taken to assess the situation, mitigate risk, and, where necessary, notify the affected parties or regulatory bodies in accordance with applicable legal requirements.

8. Contact Us

For any inquiries regarding this Data Security Policy, please contact us at: