Information Security Policy

This policy establishes OTCICU’s commitment to protecting member information, financial and payment-related information, and the systems that support our cooperative operations.

This policy applies to information handled through our website, administrative systems, and any third-party service providers engaged to support our operations.

OTCICU is guided by the principles of confidentiality, integrity, and availability in how it handles member and organisational information, applying measures appropriate to its size and activities.

Access to administrative systems and member records is restricted to authorised personnel who require it to perform their cooperative duties.

Administrative access to our systems is protected by individual login credentials. Personnel with system access are expected to keep their credentials confidential and to follow reasonable password practices.

Member information is handled in accordance with our Privacy Policy and is not shared beyond what is necessary for cooperative administration.

Our administrative systems apply role-based access controls, so that personnel can access only the information and functions relevant to their responsibilities.

Our website is served over an encrypted (HTTPS) connection and is hosted with reputable infrastructure providers who maintain their own security practices for the environments they operate.

Where we engage third-party providers for hosting, domain, email, or related infrastructure services, those providers are responsible for the security of the environments and services they operate on our behalf.

Where a third-party payment service provider is used to facilitate transactions, that provider is responsible for the security of its own payment processing systems and for maintaining applicable payment industry compliance.

Should a security concern affecting member information arise, OTCICU management will assess the matter and take appropriate steps to address it and, where required, notify affected members and relevant authorities.

Our administrative data is maintained with our technology infrastructure provider, which applies its own standard backup and recovery practices for the environment.

Personnel with access to member information or administrative systems are expected to handle such information responsibly and in line with this policy and our Privacy Policy.

OTCICU is committed to promoting sensible information security practices among Executive Committee members and staff with system access.

Member and cooperative information accessed by personnel in the course of their duties is treated as confidential and is not disclosed except as authorised or required by law.

This policy is reviewed periodically by OTCICU management to ensure it remains appropriate as our systems and services develop.