Our systems hold client footage and personal data, so we take security reports seriously. If you have found a vulnerability, we want to hear about it. This policy explains how to report it and what we promise in return.

1. Scope

This policy covers the systems that New Way Work (MediaTuig B.V.) operates, including:

• our website www.newwaywork.nl;

• our client portal My NWW (my.newwaywork.nl) and our editor chat (chat.nww.agency);

• our application page (hub.nww.agency) and our booking page (meet.nww.agency);

• other services we run on newwaywork.nl or nww.agency.

Our website runs on Framer, and we use services of other companies, such as Google. Report a vulnerability in their platforms to them directly. If it affects our data or our setup, please tell us as well.

2. How to report

Email info@newwaywork.nl with the subject line “Security”. Please include:

• the system or URL affected;

• a description of the vulnerability and its possible impact;

• the steps to reproduce it, with a proof of concept, screenshots or a short screen recording if you have them;

• how we can reach you.

Send only what we need to understand the issue. Do not include personal data or other data you came across, beyond what shows the problem. You may report anonymously, but then we cannot keep you informed or credit you.

3. Rules

When you look for or report a vulnerability:

• Do no more than needed to show the vulnerability. Do not access, copy, change or delete data beyond that. If you come across personal data or client material, stop and tell us.

• Do not run denial-of-service or brute-force attacks, and do not use automated scans that put a heavy load on our systems.

• Do not use social engineering, such as phishing or contacting our team or clients under false pretences, and do not attempt physical access.

• Do not install malware or backdoors, and do not share access with anyone else.

• Keep the vulnerability confidential. Do not disclose it publicly or to others before we have fixed it.

• Give us reasonable time to fix the issue, and agree the moment of any publication with us.

• Delete any data you obtained once you have reported the vulnerability.

We do not treat findings without a demonstrable security impact as vulnerabilities, for example unverified output of automated scanners or best-practice suggestions without a concrete risk.

4. What we promise

If you act in good faith and follow these rules:

• We acknowledge your report and confirm that we are looking into it.

• We keep you informed of our progress and tell you when the issue is fixed.

• We treat your report confidentially and do not share your personal details with others without your permission, unless the law requires us to.

• We will not take legal action against you or report you to the police in connection with your report. This commitment binds us; it cannot bind others, such as the Public Prosecution Service or the providers of the systems involved.

• If you wish, we credit you by name when we communicate about the fix.

5. No bug bounty

We do not run a bug bounty programme and do not pay for reports. We are grateful for every report that helps us protect our clients and their material.