MultiSigner
These Incident Notification Procedures ("Procedures") set out the process followed by SparkRelay Tech Services ("Company," "we," or "us") to detect, respond to, and notify affected parties about security incidents and personal data breaches relating to the MultiSigner service (the "Service"). These Procedures complement the Data Processing Agreement and our Privacy Policy, and are designed to support compliance with the GDPR / UK GDPR and other applicable laws.
The Company maintains a designated incident response function responsible for coordinating the detection, analysis, containment, and notification of security incidents. Responsibilities include:
The Company detects incidents through a combination of automated monitoring, log analysis, alerts, vulnerability reports, and reports from users, customers, or third parties. Security-relevant events are logged, including authentication activity, access to systems and data, and changes to configuration. Logs are protected against tampering and retained for a limited period for security and operational purposes.
Each incident is classified according to its severity to determine the appropriate response and notification obligations:
| Severity | Definition | Typical response |
|---|---|---|
| Critical | Confirmed Personal Data Breach with a high risk to individuals' rights and freedoms, or a major compromise of the Service. | Immediate containment; notification to customers without undue delay; notification to supervisory authorities within 72 hours where required; notification to data subjects where required. |
| High | Confirmed Personal Data Breach with limited risk, or significant unauthorized access without confirmed data compromise. | Containment; notification to affected customers without undue delay; assessment of authority/data subject notification requirements. |
| Medium | Security event requiring investigation but with no confirmed compromise of personal data. | Investigation and remediation; notification to customers only where reasonably appropriate. |
| Low | Minor event or anomaly with no meaningful impact. | Routine handling and logging; no external notification required. |
Upon detection, the Company will take reasonable and prompt steps to contain the incident and prevent further exposure, including, where appropriate: isolating affected systems, revoking or rotating credentials, applying patches, blocking unauthorized access, and preserving evidence. The Company will then take steps to remediate the underlying cause and restore affected services.
The Company will notify affected customers of a confirmed Personal Data Breach affecting their personal data without undue delay and, where feasible, within forty-eight (48) hours after becoming aware of it. Notifications will be sent to the customer's registered contact email and will include the information described in Section 10, to the extent available. The Company will provide updates as additional information becomes available.
Where the GDPR / UK GDPR applies and a Personal Data Breach is likely to result in a risk to the rights and freedoms of natural persons, the relevant controller (and, where applicable, the Company acting as processor) will be notified as required by law. Notification to a supervisory authority will be made without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach. Where notification is made after 72 hours, the reasons for the delay will be documented. For processing performed on behalf of a Customer, the Company will promptly notify the Customer so that the Customer can meet its own notification obligations.
Where a Personal Data Breach is likely to result in a high risk to the rights and freedoms of individuals, and where required by applicable law, affected data subjects will be notified without undue delay, in clear and plain language. Notification may be made through the responsible controller or directly, as appropriate. Where direct notification would involve disproportionate effort, a public communication or similar measure may be used as permitted by law.
Notifications will, where possible and appropriate, include:
The Company maintains an internal record of all security incidents and personal data breaches, including the facts relating to the incident, its effects, and the remedial action taken, regardless of whether external notification was required. Such records are retained for at least the period required by applicable law and are made available to supervisory authorities upon request.
Following a material incident, the Company will conduct a post-incident review to identify root causes, evaluate the effectiveness of the response, and implement improvements to prevent recurrence. Lessons learned are incorporated into the Company's security measures and these Procedures.
To report a security vulnerability or suspected incident, or for questions regarding these Procedures, please contact:
SparkRelay Tech Services
2000 Hogback Rd, Suite 6, Ann Arbor, MI 48105-9735, USA
Email: info@multisigner.vip
Website: https://multisigner.vip