Acceptable Use Policy

This Acceptable Use Policy defines the acceptable and unacceptable use of:

• Clerked’s systems, platforms, data, and infrastructure
• Devices, accounts, and credentials issued by Clerked
• Access to third-party services used in delivering the Clerked platform

The purpose of this policy is to:

• Protect Clerked, its users, and their data
• Maintain platform security, availability, and integrity
• Ensure compliance with legal, regulatory, and contractual obligations

This policy applies to all individuals who:

• Work for or on behalf of Clerked
• Have access to Clerked systems, data, or environments
• Interact with production, staging, or administrative systems

This includes access to:

• The Clerked production platform
• Admin and support tools
• Hosting, databases, and backups
• Authentication, payment, and calendar integrations
• Internal communication and documentation systems

All use of Clerked systems must:

• Be lawful, ethical, and professional
• Be necessary for legitimate business purposes
• Follow the principle of least privilege
• Respect confidentiality and data protection obligations

Users must not assume access rights beyond those explicitly granted.

Staff may use Clerked systems and data only to:

• Perform their assigned job responsibilities
• Support users in line with documented procedures
• Maintain, develop, or secure the Clerked platform
• Fulfil contractual, legal, or regulatory obligations

Access to personal data must be:

• Purpose-limited
• Minimised
• Logged where applicable

5.1 Account Use

• Accounts are personal and must not be shared
• Credentials must be kept confidential
• Passwords must comply with Clerked’s security standards

5.2 Privileged Access

• Administrative access is restricted to authorised personnel only
• Elevated access must be used only when necessary
• Privileged actions may be logged and audited

Staff must:

• Access personal data only where required to perform their role
• Avoid viewing or extracting unnecessary personal data
• Never download, copy, or export data unless authorised
• Follow the Data Protection Policy and Retention Schedule

Personal data must not be:

• Used for personal interest
• Shared outside Clerked without authorisation
• Stored on personal devices or accounts

The following activities are strictly prohibited:

• Accessing data without a legitimate business need
• Attempting to bypass security controls
• Introducing malware or unauthorised software
• Modifying production data without approval
• Using Clerked systems for personal, political, or commercial gain
• Sharing data with unauthorised third parties
• Attempting to access user calendars, payment data, or credentials beyond approved abstractions

• Production data must not be used for testing or experimentation
• Testing must be conducted in approved environments only
• Any exceptional access to live data must be:
  • Approved
  • Logged
  • Time-limited

Staff must not:

• Alter third-party integrations without authorisation
• Access third-party dashboards (e.g. hosting, payments) unless approved
• Export data from third-party platforms without a valid business reason

All third-party access must comply with:

• Vendor agreements
• Data Processing Agreements
• Clerked security policies

Clerked may:

• Monitor system access and usage
• Review logs for security, compliance, and operational purposes

Monitoring is conducted proportionately and in line with data protection law.

All staff must:

• Immediately report suspected security incidents or data breaches
• Follow the Data Breach Policy & Incident Response procedures

Failure to report incidents promptly may increase risk to users and Clerked.

Where remote working is permitted:

• Only approved devices and networks may be used
• Devices must be secured (passwords, updates, encryption where applicable)
• Public or unsecured networks should be avoided

Personal devices may only be used where explicitly authorised.

Violation of this policy may result in:

• Suspension or revocation of access
• Disciplinary action
• Termination of contract or employment
• Legal or regulatory action where applicable

Breaches are investigated in line with Clerked’s governance procedures.

• All staff must read and acknowledge this policy
• Policy forms part of onboarding
• Refresher awareness provided where appropriate

This policy is reviewed:

• Annually
• Following material system or regulatory changes
• After serious incidents or breaches