Email and internet usage are an important part of effective communication and information gathering within the workplace. They can be a fast and reliable method of communicating both internally and with outside bodies such as family members, suppliers etc., therefore can have obvious significant advantages to our organisation.
Email and internet usage are limited to legitimate business purposes only.
This organisation recognises its responsibility to ensure that all reasonable precautions are taken to provide and maintain working conditions that are safe, healthy and compliant with all statutory requirements and codes of practice

If you are issued with any equipment such as a laptop, mobile phone with email or internet access, personal data assistant (PDA,) etc., you should take all reasonable steps to ensure the safekeeping of both the equipment and any data either stored or displayed on any such device. If any such equipment is lost, damaged or stolen as a result of your negligence, we may deduct the cost, or partial cost, of the repair or replacement of any items, from any monies owing to you. We may also invoke the disciplinary process.
All data relating to our organisation, including that relating to any person in any way related to our organisation such as a customer or supplier etc. must not be stored on any equipment which does not belong to the organisation. If you are found to have done so you will be liable to disciplinary action.
Care should also be taken to protect the data from being accessed or read by any unauthorised person. You should therefore ensure that your computer screen is switched off when away from your workstation. If you are accessing information from a mobile device, then care should be taken to ensure it cannot be read by anyone around you (e.g. if sitting in a cafe or on the train etc.). The Data Protection Code of Practice should be adhered to at all times when dealing with sensitive personal data.
If passwords are issued, then you should not give your password to any other person, either within the organisation or external to it.
Our email and internet systems may only be used by persons authorised to do so.
Unauthorised access may result in disciplinary action.
You must not modify any existing systems, programs, information or data without permission from a Director. When deleting any information, you should ensure that such a deletion could not harm the organisation or expose us to any risk.
You are forbidden from downloading or installing any software from any source without express permission from a director. This includes using USB flash drives, PDA, mobile phone etc.

Email can be used both to contact and pass information to others both formally and informally.
Care should be taken to ensure the most appropriate method of communicating with each party is used. You should remember that any offer or contract etc. is just as binding when sent by email as by any other way. The organisation’s standard disclaimer should always be in evidence on emails sent by you.
Care should be taken when transmitting personal, sensitive or confidential information. If you are unsure you should check if the recipient’s email address is confidential and that they know the nature of the information being transmitted.
You should not breach any copyright or intellectual information when transmitting the information.
You should not send any inappropriate material to any party which could be deemed to be offensive, abusive, obscene, discriminatory, harassing, defamatory or derogatory, whether or not the recipient indicates they would not object. If you receive any transmission which you deem to be offensive or upsetting, you should immediately notify a director.
Additionally, you should not:

When you visit websites, devices are often employed to enable the site owner to identify the source of the visit. It is therefore important that you only visit reputable sites which are necessary for the performance of your duties.
You must not visit any site or download any information which is illegal, immoral, offensive, abusive, obscene, discriminatory, harassing, defamatory or derogatory. If you have reason to believe any other employee is doing so, you should report your concerns to a director as soon as possible.
You should not attempt to access any information which you know is restricted and you are not authorised to view.

Occasional and reasonable use of the internet for personal purposes is regarded as acceptable provided that:

The organisation reserves the right to monitor all email and internet usage to ensure adherence to this policy regardless of whether the usage is during or outside of normal business hours. Subsequently, any private usage should be authorised by a director. We will monitor the use of our email and internet system, including where appropriate opening and reading emails (in line with data protection legislation). It is therefore important that you do not send any personal emails, particularly of a sensitive or embarrassing nature.
We will monitor usage to ensure:

You are forbidden from accessing social media for personal purposes whilst at work, whether on our computer equipment or your own (except during authorised breaks). Social media is a type of interactive online media that allows parties to communicate instantly with each other or to share data in a public forum. This includes online social forums such as Twitter, Facebook and LinkedIn. Social media also covers blogs, video and image-sharing websites such as YouTube and Flickr; however, this is not an exhaustive list.
We understand that many employees make use of social media in a personal capacity. While you are not acting on behalf of the organisation, you must be aware that you can still damage the organisation if you are recognised as being one of our employees.
Whilst you are allowed to say that you work for us and sometimes want to discuss your work on social media you must not make any derogatory comments regarding our business, other employees, management, suppliers, or any other person, business or other entity in any way connected to our business. This applies whether or not it is on our equipment or your own and if communicated in works time or your own time.
Your online profile username (for example, the name of a blog or a Twitter name) must not contain the business’ name.
If you do discuss your work on social media (for example, giving opinions on their specialism or the sector in which the organisation operates), you must include on your profile a statement along the following lines: “The views I express here are mine alone and do not necessarily reflect the views of my employer”.
Any communications that you make in a personal capacity through social media must not:
1. Bring the organisation into disrepute, e.g. by:
o Criticising or arguing with people in their care or their family members, colleagues or rivals.
o Making defamatory comments about individuals or other organisations or groups.
o Posting images that are inappropriate or links to inappropriate content.
2. Breach confidentiality, e.g. by:
o Revealing trade secrets or information owned by the organisation.
o Giving away confidential information about an individual (such as a colleague or customer contact) or organisation (such as a rival business).
o Discuss the organisation’s internal workings (such as deals that it is doing with a client or its future business plans that have not been communicated to the public).
3. Breach copyright, e.g. by:
o Using someone else’s images or written content without permission.
o Failing to give acknowledgement where permission has been given to reproduce something.
4. Do anything that could be considered discriminatory against, or bullying or harassment of, any individual, e.g. by:
o Making offensive or derogatory comments relating to age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, sexual orientation, or perceived sexual orientation.
o Using social media to bully another individual (such as an employee of the organisation).
o Posting images that are discriminatory or offensive or links to such content
5. Be of a nature that would cause us to lose faith in your integrity, or any of the people we care for or their family members to lose faith in the integrity of the organisation.

You must not make any derogatory comments regarding our business, other employees, management, suppliers, or any other person, business or other entity in any way connected to our business. This applies whether or not it is on our equipment or your own and if communicated in works time or your own time.
You should also take care to limit who has access to view your comments or photographs etc. on such sites. Alternatively, if your behaviour is deemed to have brought the organisation into disrepute, or caused any client, supplier, other business or any other entity connected to our business, to lose faith in the organisation’s integrity, you will be liable to disciplinary action, which depends upon the circumstances, could lead to your summary dismissal.

Mobile devices, such as smart phones and tablet computers, are important tools for the organisation and their use is supported to achieve business goals.
However, mobile devices also represent a significant risk to information security and data security because if the appropriate security applications and procedures are not applied, they can be a conduit for unauthorised access to the organisation’s data and IT infrastructure. This can subsequently lead to data leakage and system infection.
This organisation has a requirement to protect its information assets to safeguard its customers, intellectual property and reputation.

All mobile devices, whether owned by this organisation or owned by employees and have access to corporate networks, data and systems, not including corporate IT managed laptops, this includes smart phones and tablet computers.
Exemptions: Where there is a business need to be exempted from this policy (too costly, too complex, adversely impacting other business requirements) a risk assessment must be conducted and authorised by security management

Devices must be configured with a secure password that complies with this organisations password policy. This password must not be the same as any other credentials used within the organisation.
Except for those devices managed by IT, devices are not allowed to be connected directly to the internal corporate network.

Any personal portable appliances such as laptops and their charging leads brought in to work by staff must be in good working order and cables free from damage.
All electrical appliances will be part of any electrical inspections carried out in the workplace.
If these pieces of equipment or leads are seen to be faulty, they will be taken out of commission and the owner informed of this fire risk.

The organisation maintains the following procedures regarding mobile phone use.

All staff issued with a phone should follow the guidance below regarding the use of mobile phones:

It is the organisational policy that business calls from landlines to mobile phones be kept to a minimum, as calls to mobile phones cost more than four times as much as calls to a landline.

In line with legislation, drivers of any vehicle must not use a hand-held mobile phone or similar hand-held device whilst in control of the vehicle. This includes periods when the vehicle is stationary with the engine on. In addition, the Department for Transport has advised that a driver may risk prosecution for failing to have proper control of a vehicle if the driver uses a hands-free phone when driving. If there is an incident, the use of any phone or similar device might justify charges of careless or dangerous driving. For this reason, the organisation’s policy for the use of mobile phones is that: neither hand-held nor hands-free models are to be used by the driver whilst any vehicle is under their control and on care organisation business, and that care organisation business is not to be conducted on a hands-free or hand-held phone by a driver of any vehicle at other times. It is therefore recommended that all phones should be switched off whilst driving, with voicemail activated to allow messages to be left if necessary.

Although WhatsApp is great for communicating with friends and family there are many reasons why using WhatsApp for workplace communication is seen as a high-risk choice.

WhatsApp for business use must be risk assessed, managed and mitigated to reduce the risks and to protect the individuals using our service. It is the responsibility of management to manage and mitigate the risks.
A user protocol is in place and includes the following

Where an assessment for a home oxygen service has been agreed this organisation will co-operate and assist, as advised by the oxygen service provider. Staff must be fully involved in the provision of the service so that they can monitor any equipment installed and report any malfunction in an appropriate and timely way.

There are numerous systems, App based, available for a multitude of communication formats, for businesses and they are GDPR compliant in use.

The type of data now communicated by mobile phone use has changed considerably. Personal data must be kept confidential, so phones should always be

Code of Conduct for Workers
Confidentiality
Cyber Security
Data Protection Legislative Framework (GDPR)
Monitoring and Accountability
Social Media and Public Relations

Cyber Aware:
https://www.ncsc.gov.uk/cyberaware/

Department of Health and Social Care leaflet: Mobile Phones and Health
https://www.gov.uk/government/publications/mobile-phone-base-stations-and-health

ICO General Data Protection Regulation Guide:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/

Training will be given to all staff using office-based IT equipment to enable them to use it safely. All staff, during induction, are made aware of the organisation’s policies and procedures, all of which are used for training updates. All policies and procedures are reviewed and amended where necessary, and staff are made aware of any changes. Observations are undertaken to check skills and competencies. Various methods of training are used, including one to one, online, workbook, group meetings, and individual supervisions. External courses are sourced as required.

Date Reviewed: May 2021
Person responsible for updating this policy: Carly Fortune
Next Review Date: May 2022

All Internet users will be required to sign the following statement before being allowed access to the internet:

• I have read the company’s Internet/Intranet Acceptable Use Policy and fully understand the terms and conditions and agree to abide by them.
• I understand that the company’s security systems will record for management use all Internet activity undertaken by me, including the addresses of websites visited or attempted to be visited and any material transmitted or received.
• I understand that violation of this policy may lead to disciplinary action, including termination of employment, and could also lead to personal criminal prosecution.

Signed…………………………………………………….

Print ………………………………………………………

Date ……………………………………………………….