Data Management Policy

Purpose and scope

Pistachio AS and its subsidiaries (Pistachio) classify, protect, keep and dispose of information according to its importance. This policy covers all our data and systems across Norway, Spain and the UK.

Three levels of data

Every system is classified at the level of the most sensitive data it holds.

Handling confidential data

Confidential data, including all data we process for our customers, is protected in four ways:

• Access needs authentication and is limited to approved roles.
• The data is held in the cloud, not on laptops, and is encrypted at rest and in transit, including backups.
• The data is never used in development or test environments.
• The data is only shared outside Pistachio under a contract and with written approval.

Keeping and deleting data

• We keep data only as long as we need it, or as long as the law or a contract requires.
• Personal data is deleted or de-identified as soon as it has no business use.
• Data and devices are securely wiped or destroyed when no longer needed, and suppliers must meet our disposal standards.
• Retention periods for the data we process for our customers are set out in our Data Processing Agreement.

Personal data rights

Everyone whose personal data we process can exercise their rights under data protection law. Our Privacy Notice explains how.

If a breach affects personal data, our Incident Response Policy sets out how we respond and who we notify.

Our UK entity, Pistachio Cybersecurity Ltd, is registered with the UK Information Commissioner’s Office (registration number ZC100694).

Annual review

We review the data we hold, and how we process it, every year. Our full record of processing activities sits alongside this policy.

Version history