Data Security and Privacy

Why this matters more than anything else

Clients give Narqix access to their customers, their money, their deals and their reputation. One leaked spreadsheet or one shared password can cost a client far more than everything they pay us, and can expose Narqix to legal action. Bangladesh's Personal Data Protection Ordinance 2025 and the data laws in our clients' countries make companies and their people responsible for protecting personal data. Security is not IT's job. It is yours, every minute.

The five security principles

1. Least access: open only what your task needs.
2. Client ownership: every account and every record belongs to the client.
3. Approved places only: client data lives in the client's systems and your approved work device, nowhere else.
4. Secrets stay secret: passwords and codes are never written in chat, email or documents.
5. Report fast: any possible incident is reported within 15 minutes.

1. Your device

These settings are required and checked at onboarding and monthly. Setup steps are in Your Setup.

• Full-disk encryption on
• Automatic updates on for the operating system and browser
• Antivirus active, full scan at least every two weeks
• Firewall on
• Auto-lock after 5 minutes; lock manually every time you step away
• Separate work user account that nobody else uses
• Home Wi-Fi on WPA2 or WPA3 with a strong, non-default password
• Public Wi-Fi never used for work unless through the approved VPN in an emergency your lead has approved

Workspace rules

• Position your screen so nobody else can read it.
• No printing client data. No photos of your screen.
• Screenshots only inside the client's tools or approved storage, and only when needed for the task.
• Downloads go into one working folder and are deleted when the task ends. Empty the recycle bin weekly.

2. Access: the right way to get into client systems

Use the safest available option, in this order:

Preference	Method	Why
1st, best	Your own named login in the client's system	Every action is traceable and access can be removed instantly
2nd	Delegated access (for example, permission to manage someone's inbox or calendar without their password)	The client keeps their password private
3rd	A login shared through the approved password manager, ideally with the password hidden from view	The password never travels in plain text
Never	A password sent in chat, email, a document or a text message	It can be copied, forwarded and found forever

3. Passwords and two-factor codes

• Every password lives in the approved password manager (the client's or Narqix's). Not in a browser outside that manager, not in a note, not on paper.
• Use the password manager's generator. Never reuse a password.
• Turn on two-factor authentication (2FA) on every work account.
• Shared 2FA codes are stored in the client's password manager, not on your personal phone, so access does not depend on one person.
• If the client's 2FA code goes to their phone, agree login times in advance. Never wake a client at night with an unexpected code request.
• Never approve a 2FA request you did not trigger. Report it immediately. It may mean someone is trying to break in.

If a client sends you a password in chat or email:

1. Save it into the approved password manager.
2. Reply politely: "Thank you. I have saved this securely in our password manager. For safety, could you delete the message and change the password when convenient? I can help set up a shared vault so we never need to send passwords again."
3. Tell your Campaign Lead.

4. The client owns every account

• If you create a new account or tool for a client, the client (or Narqix, if the contract says so) holds the master login. You get your own user seat.
• You are never the only administrator of anything.
• Phone numbers, sending brands, email domains and social pages used for customer contact are registered to the client, not to you.
• Never change account owners, recovery emails or recovery phone numbers to your own details.

5. Handling customer data

• Open only the records you need for the task in front of you.
• Card data: you never type, store or read back a full payment card number. If a customer sends one, redact it following the client's process and ask them not to send card details by message.
• Sensitive personal data (government ID numbers, bank details, health details, dates of birth) is handled only inside the client's systems and only when the task requires it.
• Call recordings are listened to inside the client's system. Never download them.
• Documents are stored only in client-owned folders, with access limited to named people. Never use "anyone with the link" sharing for sensitive files.
• Sending files: if an encrypted file must be emailed, send the password through a different channel.
• Wiring and payment instructions: never act on changed bank details received by email. Confirm by phone using a number already on file. This is one of the most common frauds in real estate and business.

6. Spotting phishing

Be suspicious of any message that:

• Creates urgency ("your account will be closed in 1 hour")
• Asks for a password, code, payment or gift cards
• Comes from an address that is almost right (one letter different)
• Contains an unexpected attachment or a link to a login page
• Asks you to change payment details

What to do: do not click, do not reply, do not forward to anyone except as instructed. Report it to your Campaign Lead and note it in your end-of-day report.

7. Incidents: report within 15 minutes

An incident is anything that may have exposed client or customer data. Examples:

• Lost or stolen device
• Clicked a suspicious link or opened a suspicious attachment
• Email or file sent to the wrong person
• 2FA request you did not trigger
• Customer data pasted into the wrong place (a public channel, an AI tool, a personal note)
• Someone else saw your screen with sensitive data
• A login alert from a place you were not

Your steps:

1. Stop. Do not try to fix it quietly or delete anything.
2. Report to your Campaign Lead within 15 minutes (if no reply in 10 minutes, the Operations Manager).
3. Write down what happened, when, and what data was involved.
4. Follow instructions. Narqix decides how and when to tell the client.

Narqix keeps an incident log. Reporting quickly is always treated as the right thing to do.

8. Offboarding: when you leave a campaign or Narqix

Within 24 hours of you leaving a campaign:

• Narqix removes your access to every client system and password vault.
• The client is asked to change any shared passwords you could see.
• You delete any local working files and confirm in writing that you have done so.
• You return or wipe any equipment as instructed.

Your duty of confidentiality continues after you leave. Client information stays confidential forever.

Check yourself (100% required)

1. A client emails you their CRM password. List the three things you do.
2. You receive a 2FA approval request on your phone, but you were not logging in. What do you do?
3. Where may client data be stored?
4. A seller emails new bank details for their payout two days before closing. What do you do?
5. You pasted a customer's phone number and address into a public team channel by mistake. What do you do and how fast?

Answers

1. Save it in the approved password manager, ask the client politely to delete the email and change the password, and tell your Campaign Lead.
2. Deny it and report it to your Campaign Lead immediately.
3. Only in the client's systems and your approved work device (in the designated working folder, deleted after the task). Never on phones, USB drives or personal cloud.
4. Do not act on it. Escalate to your lead and confirm by phone using a number already on file, following the client's process.
5. Report to your Campaign Lead within 15 minutes. Do not try to quietly fix it. Follow instructions on removal.

---

© Narqix Academy