Information Classification, Labelling & Handling Policy
Updated 06.10.2026
A document forming part of the Immercial IMS.
Information Classification, Labelling & Handling Policy
Document Name: Information Classification, Labelling & Handling Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change
Purpose
Immercial Limited classifies and handles information according to its confidentiality, integrity and availability requirements and any applicable legal, contractual, client or other interested-party requirements.
Information Classification
Immercial uses the following proportionate classifications:
| Classification | Typical information | Handling |
|---|---|---|
| Public | Website content, published policies, approved marketing material | May be shared publicly once approved |
| Internal | Routine business information, internal procedures and operational records | Available only to authorised business users unless approved for wider release |
| Confidential | Client information, commercial data, personal data, contracts, pricing, project records and proprietary information | Restricted to authorised persons and approved systems |
| Restricted | Passwords, cryptographic keys, recovery credentials, highly sensitive client information and security administration data | Strict need-to-know access and enhanced protection |
Classification is determined according to the sensitivity of the information, the consequences of unauthorised disclosure or alteration, availability requirements and applicable contractual or legal obligations.
Labelling
Where practical and appropriate:
- Public information requires no special label;
- internal material may be identified as Internal;
- confidential material should be identified as Confidential where the classification would not otherwise be clear;
- restricted information should be clearly identified or held within a system/location whose access controls make its restricted status clear.
Immercial applies labelling proportionately and does not require unnecessary marking where classification is already evident from the controlled system, location or context.
Handling and Storage
Information must:
- be accessed only by authorised persons;
- be stored within approved Immercial systems;
- be protected according to its classification;
- not be copied to personal accounts or unauthorised services;
- be retained and securely disposed of in accordance with applicable requirements;
- be handled in accordance with client-specific confidentiality and security requirements where these are more restrictive.
Restricted information such as passwords, private keys and recovery credentials must not be stored in ordinary documents, shared by unsecured channels or disclosed unnecessarily.
Information Transfer
Information may be transferred only through approved and proportionate methods, including controlled business email, OneDrive/Microsoft 365, approved portals or other authorised systems.
Before transferring Confidential or Restricted information:
- the intended recipient must be verified;
- access must be limited to authorised recipients;
- appropriate access restrictions or encryption must be used where warranted by the sensitivity or contractual requirement;
- personal email accounts and unauthorised file-transfer services must not be used;
- client-specific transfer requirements must be followed where applicable.
Where information is transferred to external parties, applicable confidentiality, contractual, data-protection and information-security requirements remain in force.
Responsibility and Review
The Directors are responsible for approval and oversight of this policy.
Relevant personnel and external parties are informed of applicable classification and handling requirements where necessary.
This policy is reviewed annually and following significant changes to services, systems, legal or contractual requirements, information-security risks or business operations.