Effective Date: January 1, 2026
This Information Security Policy outlines the principles, safeguards, responsibilities, and controls used by Padi to protect information assets, customer data, systems, and business operations.
The purpose of this Information Security Policy is to establish the principles, responsibilities, and controls that guide the protection of information assets managed by Padi. This Policy supports the confidentiality, integrity, and availability of information and systems used to provide our Services.
This Policy applies to all employees, contractors, consultants, vendors, service providers, systems, applications, infrastructure, devices, and information assets owned, operated, or managed by Padi in connection with the delivery of its products and services.
Padi is committed to protecting information assets from unauthorised access, disclosure, modification, destruction, disruption, or misuse. Our security programme is designed to preserve confidentiality, maintain data integrity, and ensure service availability.
Management is responsible for overseeing information security practices and ensuring appropriate safeguards are implemented. All personnel are expected to understand and comply with applicable security requirements relevant to their responsibilities.
Padi maintains processes for identifying, assessing, monitoring, and managing risks that may impact information systems, customer data, business operations, or regulatory compliance obligations.
Access to systems, applications, and information assets is granted based on business need and the principle of least privilege. Access rights are reviewed periodically and revoked when no longer required.
Users are responsible for protecting account credentials and maintaining appropriate password security. Additional authentication controls may be implemented where appropriate to strengthen account protection.
Information assets, systems, software, devices, and infrastructure components are managed throughout their lifecycle. Appropriate safeguards are applied to protect assets from loss, theft, misuse, or unauthorised modification.
Information is classified and handled according to its sensitivity and business value. Appropriate controls are applied to ensure that confidential and sensitive information is protected throughout its lifecycle.
Padi employs encryption and related safeguards where appropriate to protect sensitive information during transmission, storage, and processing.
Security considerations are incorporated into software development, testing, deployment, and maintenance activities. Systems are designed and maintained with security best practices in mind.
Systems and infrastructure may be monitored to detect operational issues, unauthorised activities, security events, and potential threats. Relevant logs may be retained for security, auditing, and compliance purposes.
Padi maintains processes for identifying, assessing, prioritising, and remediating vulnerabilities that may affect the security of systems, applications, infrastructure, or customer data.
Padi maintains procedures for identifying, reporting, investigating, containing, mitigating, and recovering from information security incidents. Incidents are reviewed to improve future prevention and response efforts.
Appropriate measures are implemented to support operational resilience and continuity of critical services in the event of disruptions, failures, or security incidents.
Padi evaluates relevant security considerations when engaging vendors, partners, subprocessors, and service providers that may access or process information related to the Services.
Personnel may receive security awareness training and guidance to help ensure understanding of information security responsibilities, threats, and best practices.
Padi seeks to comply with applicable legal, regulatory, contractual, and industry requirements relating to information security, privacy, and data protection.
This Information Security Policy is reviewed periodically and may be updated to reflect changes in business operations, technology, legal obligations, threats, or security practices.
Questions regarding this Information Security Policy may be directed to [email protected].