Red Thread is committed to ensuring its Suppliers conform to minimum industry expectations around security and privacy. These Security and Privacy Requirements form part of all agreements between Red Thread and its suppliers (“Service Providers”). By engaging with Red Thread, all Service Providers agree to comply with these requirements in full.

These requirements are incorporated by reference into all contracts, purchase orders, and service agreements between Red Thread and its Service Providers. Compliance with these requirements is mandatory and constitutes a material term of our business relationship.

Red Thread reserves the right to audit Service Provider compliance with these requirements at any time during the term of engagement. Failure to comply may result in termination of the agreement, liability for damages, and other remedies as specified in the underlying agreement.

Red Thread may update these requirements periodically to address evolving security threats and regulatory changes. Service Providers will be notified of any updates and must comply with the most current version.

1. Definitions

Information Security Incident Any actual or suspected unauthorized access, loss, theft, use, disclosure, or processing of Red Thread Personal Information or Confidential Information or Red Thread systems.

Information Security Programme Service Provider’s safeguards ensuring confidentiality, security, integrity, and availability of information.

Personal Information means any information relating to an identified or identifiable individual (including, but not limited to, a person’s name, postal address, email address, telephone number, date of birth, national insurance or social security number or its equivalent, driver’s license number, account number, credit or debit card number, health or medical information, or any other unique identifier) that is Processed by the Service Provider for Red Thread. Personal Information includes Red Thread employee or personnel business contact information that may be exchanged in the ordinary course of business communications, such as information in email signatures.

Process or Processing means any operation or set of operations performed upon Personal Information, such as accessing, obtaining, storing, transmitting, using, disclosing or disposing of the Personal Information.

2. Service Provider’s Obligations

When Processing Personal Data Service Provider shall:

  • Process Personal Information only as necessary for the Agreement or as required by law.
  • Limit access to authorised personnel who require it to perform services.
  • Before providing Services it will:
    • Train its Personnel on information security;
    • Conduct background checks on all Personnel appropriate to the role and level of sensitive information such Personnel will have access to;
    • Ensure that third parties can and will maintain confidentiality;
    • Notify Red Thread immediately and in any case within 24 hours of relevant Personnel terminations where such Personnel have access to Red Thread IT infrastructure.
  • Notify Red Thread in writing of all subcontractors with access to Red Thread data and ensure all subcontractors also meet these requirements.
3. Compliance Requirements

Service Provider shall:

  • Process Personal Information in accordance with the Agreement, applicable laws, and Red Thread policies.
  • Maintain an Information Security Programme compliant with laws and industry standards.
  • Securely destroy or return all Personal Information when no longer needed.
4. International Data Transfers

If Service Provider or any third party acting on its behalf seeks to transfer Personal Information between countries in connection with the Services, Service Provider shall establish a legal basis for such transfer. Prior to any proposed transfer of Personal Information between countries, Service Provider shall obtain Red Thread written consent to such transfer and comply with any requirements Red Thread may require Service Provider to take to fulfil, or assist the Red Thread in fulfilling, applicable regulatory requirements.

Where services that comprise the subject of the Agreement anticipate the collection of Personal Information by the Service Provider of residents of the European Union or the UK on Red Thread or its Clients behalf, Service Provider shall inform data subjects of such transfer and, obtain adequate consent to such transfer where required.

5. Deletion of Personal Data

When Personal Information is no longer necessary for the performance of Services, or promptly upon the termination of the Agreement, Service Provider shall securely destroy or return all Personal Information and Confidential Information in its possession, custody or control.

6. Technical Safeguards

Service Provider shall:

  • Implement industry-standard encryption for data at rest and in transit.
  • Maintain robust access controls with multi-factor authentication for sensitive systems.
  • Deploy endpoint protection on all devices accessing Red Thread data.
  • Conduct regular vulnerability scanning and penetration testing.
  • Maintain 24/7 security monitoring capabilities.
  • Implement automated threat detection systems.
  • Establish security logging and audit trails for all systems handling Red Thread data.
  • Implement regular backup procedures with encryption.
  • Maintain offsite/offline backup copies of Red Thread data.
  • Conduct security assessments of all subcontractors to ensure subcontractors meet or exceed these security requirements.

7. Information Security Incident Response

In the event of a suspected Information Security Incident Service Provider shall:

  • Notify Red Thread by emailing Red Thread’s Data Protection Lead (Nick Leach) within 1 business day, summarising the impact to Red Thread and corrective actions taken or to be taken by Service Provider.
  • Investigate the reasons for the Information Security Incident and take all necessary and advisable actions to remediate the Information Security Incident, keeping all evidence regarding the cause, response, remedial actions taken.
  • Assist with any investigation of a Security Incident by Red Thread and take such remedial actions as it
  • Not disclose without Red Thread’s prior written approval any information related to the suspected Security Incident to any third party other than a third party hired to investigate/mitigate such Security Incident, except as required by law.
8. Cooperation and Information Request

In the event Service Provider receives a request relating to the Personal Information by Red Thread or a third party, Service Provider shall respond to Red Thread or notify Red Thread in writing of the third party request, within 1 business day, and shall provide such assistance as Red Thread reasonably requests.

In the event the request is from a government or regulatory entity, Service Provider shall disclose the minimum Personal Information necessary to comply with law.

The Service Provider shall allow Red Thread or any representative to access its facilities during normal business hours to audit compliance with these requirements.

Changes to this Policy

We may change this Privacy and Security Requirements Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.  This Policy was last updated on 2nd June 2025.