We are not ISO/IEC 27001 certified. This policy follows the structure of ISO/IEC 27001 and the control themes of ISO/IEC 27002: organisational, people, physical and technological controls. Broadly, sections 2 to 4 and 10 to 13 cover organisational controls, section 14 people controls, section 7 physical controls, and sections 5, 6, 8 and 9 technological controls. This policy describes the measures we take today. Where a measure is still being rolled out or is planned, we say so.

1. Purpose and scope

1.1 This policy explains how MediaTuig B.V., trading as New Way Work (“New Way Work” or “we”), protects the confidentiality, integrity and availability of the information entrusted to us. In this policy, “you” means our client.

1.2 Our most important information is client material: the footage, audio, project files, brand materials and deliverables that you share with us or that we create for you. Client material often contains personal data of the people who appear in it.

1.3 Our objectives are that no one gets access to client material without permission, that your work is not lost, that we keep client material no longer than needed, and that incidents are reported and handled promptly.

1.4 This policy applies to everyone who works on our service: the founder in the Netherlands and the team on Lombok, Indonesia. Our editors are employed by PT Starianti Administrative Center (“PT Starianti”), a company incorporated in Indonesia with offices in Mataram, Lombok, which works for us as our permanent editing team. Under the GDPR, you are the controller of the personal data in your material, we are your processor and PT Starianti is our sub-processor.

1.5 The service in scope is video editing of your own footage, including versions, aspect ratios and subtitles, and the communication and file exchange around it. We do not film.

1.6 The systems in scope are:

• the tools we host ourselves on rented virtual private servers (Hostinger): the client portal My NWW, our chat (Mattermost), the review environment for timecoded feedback, the file exchange (Seafile), our CRM (Twenty), automation (n8n), e-signing (DocuSeal), email sending (Listmonk), single sign-on (Authentik), scheduling (Cal.com) and project management (Plane);

• the services of our suppliers, such as backup storage, email hosting and video calls, as listed on our sub-processors page;

• our own hardware in the Netherlands used for local transcription;

• the editor workstations and render machines used for client work.

1.7 The locations in scope are the Netherlands; the EU data centres where our servers and backups run; the PT Starianti office in Mataram and other workplaces on Lombok from which the editing team works; and your premises if you choose the on-site option (clause 4.2).

1.8 Your own Blackmagic Cloud account and storage are outside the scope of this policy. You control them, and Blackmagic Design is not our sub-processor.

2. Roles and responsibilities

2.1 The founder owns this policy. The founder approves it, decides on the risk assessment, selects suppliers and concludes the agreements with them, leads the response to incidents and decides on notifications to clients and authorities.

2.2 The studio manager on Lombok is responsible for day-to-day practice in the editing team: onboarding new editors, applying the handling rules in this policy, arranging editors’ access when they start and its removal when they leave, and escalating suspected incidents to the founder.

2.3 PT Starianti, as the editors’ employer, is bound by its data processing and transfer agreement with MediaTuig B.V. (clause 10.3).

2.4 Every team member:

• keeps client material confidential and uses it only for the project it was shared for;

• uses only the tools and channels set out in this policy;

• protects their login details and locks their device when leaving it;

• reports a suspected incident immediately to the studio manager or the founder.

2.5 You decide what material you share with us and which workflow we use. In the cloud workflow, you control your project library and who has access to it.

3. Risk-based approach

3.1 We choose our measures based on risk. We assess the likelihood and impact of what could go wrong for you, for the people in your footage and for our service, and decide which measures are needed. A public summary of this assessment, including a transfer impact assessment for Indonesia, is in our risk assessment.

3.2 We repeat the risk assessment at least once a year, and sooner after a significant change, such as a new tool, supplier or workflow, or after an incident.

3.3 Three principles guide our choices:

• minimise: move and keep only the client material the work requires;

• limit access: give people access only to what their role requires;

• delete: remove client material once it is no longer needed.

4. Asset management

4.1 Client material is our highest-value asset. We treat all client material as confidential, whether or not it contains personal data. Personal data in our own administration, such as client contacts and applicants, is also confidential.

4.2 We work with three workflows:

• Cloud workflow: you create a project library in your own Blackmagic Cloud account and invite us. Sync is set to Proxy Only: your original footage stays on your own storage and only lightweight proxy files sync to our editors. When the edit is approved, you render the final version from your originals.

• Upload workflow: you upload source footage through a link we share, up to 20 GB per project. Larger productions use the cloud workflow.

• On-site option: your source footage stays on a Mac mini at your office. Our editors connect to it through encrypted remote desktop and render the finals there. The footage does not leave your building.

4.3 Proxy-only principle: wherever the workflow allows, editors work on proxies and your originals stay with you. The 20 GB cap in the upload workflow keeps the amount of footage we hold small.

4.4 Deletion after delivery: we delete source footage, proxies and working files after delivery, within the periods set out in our data retention policy. PT Starianti deletes its local working copies of footage. Deletion is currently part of our project close-out routine; we plan to automate it so that it no longer depends on a manual step. We are not an archive service, so please keep your own originals.

4.5 We keep an overview of the systems we use (clause 1.6) and of the suppliers that process personal data for us (our sub-processors page).

4.6 Editors use non-admin accounts on their workstations and on render machines. On managed render machines, deleting source files requires an administrator password, which protects originals against accidental deletion.

5. Access control

5.1 We grant access on a need-to-know basis. Team members get access to the systems and client projects their role requires, and no more. Administrator rights are limited to the people who manage the systems.

5.2 Our internal tools use single sign-on (Authentik), which gives us one place to grant, change and withdraw access.

5.3 Multi-factor authentication (MFA) is available on single sign-on and is being rolled out as mandatory. It is not yet enforced for every account. Enforcing it for all accounts is one of the open actions in our risk assessment.

5.4 Our servers accept SSH logins with keys only, not with passwords.

5.5 Remote access to render machines, including a Mac mini at your office, runs through an encrypted relay (RustDesk with forced encryption) or a private network (Tailscale).

5.6 We set up access when someone joins, adjust it when their role changes and remove it when they leave. This covers single sign-on accounts, remote access and access to client projects.

6. Cryptography

6.1 All our web services use TLS (HTTPS) through a reverse proxy (Caddy), so data is encrypted in transit.

6.2 Backups of both our servers are encrypted with GPG and stored off-site.

6.3 Remote access to render machines is encrypted (clause 5.5), and administrative access to our servers uses SSH keys.

6.4 We rotate secrets, such as passwords and API keys, in periodic rotation rounds.

7. Physical and environmental security

7.1 Our servers run in EU data centres operated by our hosting providers. We have no physical access to them; the physical security of those buildings is the providers’ responsibility.

7.2 The editing team works from the PT Starianti office in Mataram and other workplaces on Lombok. In every workplace:

• devices are locked when unattended and set to lock automatically after a period of inactivity;

• client footage is not played where people outside the team can see or hear it;

• client material is not copied to personal accounts or personal storage.

7.3 Power cuts and internet interruptions can occur on Lombok. We take this into account in how we work: in the cloud workflow, work syncs to the cloud as it progresses, schedules are agreed per request, and the continuity measures in section 12 apply.

7.4 If you choose the on-site option, you are responsible for the physical security of the Mac mini at your office.

8. Operations security

8.1 We run a weekly maintenance and update round for our servers and tools.

8.2 We run periodic security scans of our stack and fix findings in order of risk.

8.3 Both servers are backed up. The backups are encrypted and stored off-site in DigitalOcean Spaces (Amsterdam), a different provider from the one that hosts the servers.

8.4 Our servers and core services record security-relevant events, such as sign-ins and failed login attempts. fail2ban uses these records to block repeated failed attempts, and we use logs to investigate suspected incidents.

8.5 Devices used for client work must run a supported operating system with current security updates and built-in malware protection switched on. Non-admin accounts limit what software editors can install or change.

8.6 We keep client projects separate. Your material is kept in its own project library or folder, and editors are given access only to the projects they work on.

8.7 For AI tools, these rules apply:

• transcription runs locally on our own hardware in the Netherlands where possible;

• the standard briefing estimator does not send briefs to an external AI service; any external AI use on client material must be agreed per project, listed and checked for the applicable data-processing and transfer arrangements;

• client material is never used to train AI models;

• we do not create synthetic faces, voices or statements without explicit written consent;

• a human editor makes and reviews every creative decision.

9. Communications security

9.1 Our servers are protected by a firewall (UFW) with hardened rules for our Docker containers, which restricts incoming connections to the services we intend to offer.

9.2 fail2ban blocks repeated failed login attempts, and SSH accepts keys only.

9.3 Remote access to render machines runs over a private network or an encrypted relay (clause 5.5).

9.4 We use these channels for client material:

• your own project library (cloud workflow);

• our file exchange (upload workflow);

• encrypted remote desktop (on-site option);

• My NWW, for requests and deliverables;

• the review environment, for feedback on edits;

• Mattermost, for day-to-day communication with your editor.

9.5 Team members do not send client material through personal email or personal file-sharing services.

10. Supplier relationships

10.1 We host most of our business tools ourselves on servers in the EU. This limits the number of suppliers that handle client data.

10.2 The suppliers that process personal data on our behalf are listed on our sub-processors page. We do not give a new supplier access to client personal data before we have added it to that list, in line with our data processing agreement.

10.3 Our agreement with PT Starianti is a data processing and transfer agreement, with MediaTuig B.V. as data exporter and PT Starianti as data importer. It contains the terms required by article 28 of the GDPR and incorporates the EU Standard Contractual Clauses (SCCs) of Commission Implementing Decision (EU) 2021/914, Modules 2 and 3. Module 3 (processor to processor) covers the personal data we process for you. The agreement is governed by Dutch law. It requires PT Starianti to notify us of incidents within 24 hours and to delete its local working copies of footage.

10.4 Blackmagic Cloud, used in the cloud workflow, is your own service under your own agreement with Blackmagic Design. It is not our sub-processor.

10.5 External AI services are subject to the rules in clause 8.7.

11. Incident management

11.1 An incident is any event that threatens the confidentiality, integrity or availability of client material or our systems, such as unauthorised access, loss of data, a compromised account or malware. A personal data breach is an incident that affects personal data.

11.2 Team members report a suspected incident immediately to the studio manager or the founder. Reporting a mistake early is always the right step.

11.3 PT Starianti notifies us within 24 hours of becoming aware of an incident that affects client data.

11.4 We notify you without undue delay after becoming aware of a personal data breach affecting your data. We give you the information you need to meet your own obligations as controller.

11.5 Where we are the controller, for example for our own business contacts and applicants, we notify the Autoriteit Persoonsgegevens within 72 hours where the GDPR requires this, and inform the people affected where required.

11.6 We handle every incident in the same order: contain, assess, notify where required, recover and learn. We document every personal data breach, including what happened, its effects and the action taken.

11.7 Report a security concern to info@newwaywork.nl. If you have found a vulnerability, please follow our responsible disclosure policy.

12. Business continuity

12.1 Our set-up is designed so that a single failure does not destroy your work:

• you keep your originals, and in the cloud workflow they never leave your storage;

• in the cloud workflow, every asset the editors use syncs to the cloud automatically, so proxies can be synced again and another editor can take over a project;

• our servers are backed up with encryption, off-site and with a separate provider;

• the founder in the Netherlands and the team on Lombok (UTC+8) work in different time zones, which spreads our availability across the day.

12.2 If the main internet connection at a workplace fails, editors switch to an alternative connection.

12.3 We do not promise fixed turnaround times; schedules are agreed per request. If a disruption affects an agreed schedule, we tell you as soon as possible and agree a new one.

12.4 In a serious disruption on Lombok, such as a natural disaster, the safety of the team comes first. Your originals and our servers and backups are held outside Lombok, so a local event does not destroy them.

13. Compliance

13.1 We are subject to the General Data Protection Regulation (GDPR) and Dutch law, including the Dutch GDPR Implementation Act (Uitvoeringswet AVG). This policy is part of how we meet those obligations. Our supervisory authority is the Autoriteit Persoonsgegevens.

13.2 Indonesia has no EU adequacy decision. Transfers of personal data to PT Starianti rely on the SCCs, a transfer impact assessment and supplementary measures, as summarised in our risk assessment.

13.3 PT Starianti is also subject to Indonesian law, including Law No. 27 of 2022 on Personal Data Protection (UU PDP). Its obligations under our agreement apply in addition to that law.

13.4 Related documents: our privacy policy, data processing agreement, sub-processors page, data retention policy and responsible disclosure policy.

14. Awareness and training

14.1 All team members are bound by confidentiality through their contracts.

14.2 Our onboarding policy requires new editors to receive instructions on confidentiality and the secure handling of client material: the workflows and the proxy-only principle, the tools and channels to use, deletion after delivery, the rules for AI tools and how to report an incident. The responsible manager records completion before granting access to client work.

14.3 When this policy changes in a way that affects daily work, the team is briefed on what changes in practice.

15. Review

15.1 We review this policy at least once a year, and sooner after a significant change or incident. The founder approves each new version.

15.2 The version number and date at the top of this page show the current version. The next scheduled review is due by September 2027.

15.3 Questions about this policy can be sent to info@newwaywork.nl.