Security Policy

Information Security Policy

Tuxedo Fashions handles sensitive information daily.  Sensitive Information must have adequate safeguards in place to protect the account data that includes cardholder data, cardholder privacy, and to ensure compliance with various regulations, along with guarding the future of the organisation.

Tuxedo Fashions commits to respecting the privacy of all its customers and to protecting any customer data from outside parties.  To this end management are committed to maintaining a secure environment in which to process cardholder information so that we can meet these promises.

Employees handling sensitive cardholder data will ensure:

• Handle Company and account data information in a manner that fits with their sensitivity and classification;
• Limit personal use of Tuxedo Fashions information and telecommunication systems and ensure it doesn’t interfere with your job performance;
• Tuxedo Fashions reserves the right to monitor, access, review, audit, copy, store, or delete any electronic communications, equipment, systems and network traffic for any purpose;
• Do not use e-mail, internet and other Company resources to engage in any action that is offensive, threatening, discriminatory, defamatory, slanderous, pornographic, obscene, harassing or illegal;
• Do not disclose personnel information unless authorised;
• Protect sensitive account data including cardholder information;
• Keep passwords and accounts secure;
• Request approval from management prior to establishing any new software or hardware, third party connections, etc.; 
• Tuxedo Fashions will not install unauthorised software or hardware, including modems and wireless access. 
• Tuxedo Fashions always leave desks clear of sensitive cardholder data and lock computer screens when unattended;
• Information security incidents will be reported, without delay, to the individual responsible for incident response locally.
• Tuxedo Fashions employees will attend security awareness training on an annual basis

We each have a responsibility for ensuring our company’s systems and data are protected from unauthorised access and improper use.  

1. Protect Stored Data  

• Tuxedo Fashions and its employees are not to store cardholder data in form of PAN or sensitive authentication data in electronic format at all.
• All sensitive account data including cardholder data stored and handled in hard copy by Tuxedo Fashions and its employees must be securely protected against unauthorised use at all times. Any sensitive card data that is no longer required by Tuxedo Fashions for business reasons will be discarded in a secure and irrecoverable manner.
• If there is no specific need to see the full PAN (Primary Account Number), it has to be masked when displayed and showing six first and last four numbers of PAN maximum.
• PAN’S which are not protected as stated above should not be sent to the outside network via end user messaging technologies like email, chats, ICQ messenger etc.,

Tuxedo Fashions is strictly prohibited to store: 

1. The contents of the payment card magnetic stripe (track data) or chip equivalent track data on any media whatsoever.  
2. The CVV2/CVC2/CAV2/CID (the 3 or 4 digit number on the signature panel on the reverse of the payment card) on any media whatsoever.  
3. The PIN or the encrypted PIN Block under any circumstance.