Policy
Company policies
The standards Occam Digital holds itself, its contractors and its suppliers to, written so a procurement team can check them.
What do these policies cover?
Eleven policies cover how we work with clients, staff, contractors and suppliers. Each one applies to everyone working on our behalf.
How do we deal with bribery and financial crime?
We do not offer, pay, request or accept bribes, kickbacks or facilitation payments, and we do not help anyone evade tax. The rule covers our director, our staff and every contractor acting for us. Hospitality is acceptable only when it is modest, occasional and open, and anything significant is recorded. Cash gifts are never given or accepted. Conflicts of interest are declared and resolved before work starts.
Occam Digital is a marketing and consultancy firm, not a regulated financial business, and we do not hold client money. We will not knowingly receive the proceeds of crime or deal with anyone subject to UK sanctions. New clients and suppliers are checked in proportion to the risk, payments go only to a verified account in the supplier’s own name, and unexplained third-party or cash payments are refused.
What is our position on modern slavery?
We do not tolerate forced, bonded or child labour, trafficking or exploitative recruitment, in our own work or in work we commission. Everyone who works with us must be of legal working age, work by choice, keep their own identity documents and be paid what was agreed. Charging workers recruitment fees and making unlawful deductions are prohibited.
Before engaging a new contractor we check who they are, where they work and how they are set up, with closer review for higher-risk locations or labour-intensive services. Concerns are investigated, and exploitation ends the relationship. Section 54 of the Modern Slavery Act 2015 requires a statement only from businesses with turnover of £36 million or more. Occam Digital is below that threshold and publishes this position voluntarily.
How do we make sure people are treated fairly?
We decide on hiring, contracting, progression and client work on merit, regardless of age, disability, gender reassignment, marriage or civil partnership, pregnancy or maternity, race, religion or belief, sex or sexual orientation. Those are the nine characteristics protected by the Equality Act 2010. Harassment, bullying, victimisation and unlawful discrimination are not tolerated from anyone, including clients and suppliers.
We make reasonable adjustments for colleagues, contractors and clients who need them, and we judge performance against criteria agreed in advance. The same standard applies to this website, which aims for WCAG 2.2 AA. The accessibility statement says where it still falls short.
How can someone raise a concern about us?
Anyone can raise a concern about our conduct by emailing engage@occamdigital.com for the director’s attention. That includes staff, contractors, suppliers, clients and members of the public. Reports are handled discreetly, investigated in proportion to their seriousness and recorded, and we tell the person who raised a concern what we did wherever we can.
Nobody is penalised for raising a genuine concern in good faith. If the concern is about the director, or you would rather not come to us first, you can take it to an independent adviser or the relevant authority. Protect, the UK whistleblowing charity, offers free and confidential advice. Complaints about our services follow the same route and the same rules.
How do we protect client information?
Client information is used only for the work it was provided for, and only the people doing that work can reach it. Everyone has their own account and nobody shares logins. Our policy requires strong, unique passwords managed securely, multi-factor authentication on email, hosting and administrative systems, encrypted and screen-locked devices, and prompt security updates. Passwords are never sent by email or kept in spreadsheets.
Each client’s data is kept apart from every other client’s. Subcontractors get the narrowest access the task needs, and we remove it when the work ends. Access is reviewed whenever a person or a project changes. We hold no ISO 27001 or SOC 2 certification, and we say so on security questionnaires rather than imply otherwise.
How do we work on client websites and systems?
We change a client’s website or systems only against an agreed scope and with the client’s approval. We use the least access the job needs, build and test away from the live site where the setup allows, and review code in proportion to the risk of the change. API keys, passwords and other secrets stay out of code repositories.
Before a significant change to a live system we take a backup and make sure the change can be rolled back. Live personal data is not copied into development environments without the client’s agreement. A serious vulnerability is reported to the client straight away and fixed as a priority. Security controls the client owns, such as their own hosting or firewall, remain the client’s responsibility.
How do we handle personal data on a client’s behalf?
When we process personal data for a client, we act only on the client’s documented instructions and sign a data processing agreement that meets Article 28 of the UK GDPR. We collect only what the work needs, restrict who can see it, and record what we process, why, where it is hosted and how long it is kept. A subprocessor is used only with the client’s prior authorisation and on terms at least as protective as ours.
If personal data leaves the UK for a country without a UK adequacy decision, we put a recognised safeguard in place, such as the UK International Data Transfer Agreement. Requests from individuals go straight to the client. At the end of an engagement we return or delete the data unless the law requires us to keep it. Visitors to this website are covered by the separate privacy notice.
What happens if there is a security or data incident?
Anyone who suspects a security or data incident reports it to the director immediately. We contain it first: revoke access, secure accounts and systems, and preserve the evidence. We work with the platform or hosting provider involved and assess whether the law requires a report to a regulator.
Affected clients are told without undue delay and within any period their contract sets. Under Article 33 of the UK GDPR, a controller must report a notifiable breach to the ICO within 72 hours of becoming aware of it, so we tell clients fast enough for them to meet that deadline. The director records what happened, what was affected and what was decided, tracks each corrective action to closure, and changes whatever allowed the incident to happen.
How do we keep client work running through a disruption?
Occam Digital is a small, remote-capable firm, so a likely disruption is a lost laptop, a failed connection or an unavailable person rather than a closed office. We keep spare working equipment, a second internet connection and a second place to work. Approved cloud tools mean work is not tied to one machine, and business-critical work is backed up where the client’s terms allow.
When something goes wrong, we check safety and scope, secure systems and credentials, tell the affected clients, restore the most important contracted work first, and record what we learned. Where a client’s own website, CMS or hosting is down, recovery depends on the client’s systems and their providers’ service levels.
How do we limit our environmental impact?
Our direct footprint is small because we sell advice, writing and software rather than physical goods, but computing, hosting and travel still have a cost. We meet remotely by default and travel when being in the room changes the outcome. Contracts, deliverables and signatures are electronic.
We keep equipment in use for as long as it does the job and recycle electronics responsibly. When choosing cloud and hosting providers we weigh their environmental practices in proportion to what we spend with them, and we expect contractors to follow environmental law where they work. We have not measured our carbon footprint and hold no net-zero certification, so we claim neither.
What do we expect from our suppliers?
Every freelancer, vendor and hosting provider we use is expected to meet the standards on this page. We keep a current list of material suppliers, where they work, and whether they can reach client data. Before engaging one we check that they are a legitimate business, competent to do the work, able to keep information confidential, and sound on labour practices and data protection.
Written terms cover confidentiality, permitted use of information, security, intellectual property, subcontracting and termination. Where a client contract or data processing agreement requires the client to approve a subcontractor, we get that approval before work starts. Critical suppliers are reviewed at least once a year, and any supplier promptly after a change or a failure.