‍

3. Introduction

This document outlines the information & privacy security policies put in place by senior management of QS Quacquarelli Symonds (QS). QS offers unrivalled data, expertise, and solutions for the global higher education sector. Key services include Institutional Performance (QSIP MoveIN & MoveON), University Branded Services (QSUBS) and Employability Management (QSEM 1Mentor). These services are enabled by technology solutions and software that are cloud based. The QS ISMS and PIMS Policy below is supported by various subordinate policies, procedures, guidelines, templates, and checklists.

This policy and supporting policies, as part of the IPSMS, are to be adhered to by all entities included in the QS scope.

The confidentiality, integrity, availability, and privacy of information, in all its forms, are critical to the ongoing functioning and good governance of QS. Failure to secure information increases the risk of financial and reputational losses from which it may be difficult for QS to recover. This information & privacy security policy outlines the QS approach to information & privacy security management.

QS ISMS & PIMS Policy

We, at QS, continually strive to enhance the competitiveness of our customers with a range of value-added products and provide world-class support to institutions at large by adopting a process approach to excellence.

This shall be enabled by implementing an Information & Privacy Security Management System (IPSMS), with the involvement of relevant stakeholders for:

• Ensuring enhanced customer experience & meeting applicable requirements.
• Proactively protecting & ensuring security & privacy of PII (Personally Identifiable Information) data and information assets.
• Fulfilling compliance obligations to applicable country-specific privacy laws and regulations.
• Ensuring information security & privacy through design, risk management, change management & applicable controls.
• Cascading information security and privacy requirements to suppliers, thereby ensuring the customer value chain is compliant.
• Continually improving the information management system and processes.

This policy and supporting policies, are part of the IPSMS, are to be adhered to by all entities included in the QS scope.

The confidentiality, integrity, availability, and privacy of information, in all its forms, are critical to theongoing functioning and good governance of QS. Failure to secure information increases the risk offinancial and reputational losses from which it may be difficult for QS to recover. This information &privacy security policy outlines the QS approach to information & privacy security management .

It provides the guiding principles and responsibilities necessary to safeguard the security & privacy of the QS information systems. Supporting policies, codes of practice, procedures, and guidelines as documented in QS’ Information & Privacy Security Management System (ISMS & PIMS), provide further details.

QS is committed to a robust implementation of Information & Privacy Security Management. It aims to ensure the appropriate confidentiality, integrity, availability of data and protection of privacy as potentially affected by the processing of PII (Personally Identifiable Information). The principles defined in this policy will be applied to all the physical and electronic information assets for which QS is responsible. QS is specifically committed to protection of privacy while processing PII, preserving the confidentiality, integrity, and availability of documentation and data supplied by, generated by, and held on behalf of third parties pursuant to the carrying out of work agreed by contract in accordance with the requirements of ISO 27001 & ISO 27701 and applicable country-specific legal/regulatory compliance requirements, specifically GDPR (EU 2016/679).

4. Scope

This document is applicable to all locations whereInstitutional Performance (QSIP MoveON & MoveIN), University BrandedServices (QSUBS) and Employability Management (QSEM 1Mentor) services areprovided. It is applicable to QS staff – part-time, full-time and contractors(referred as “Employees”). It also applies to information received fromexternal service providers and/or guests (hereinafter referred to as “Externalparties”), to whom non-disclosed information is communicated or made availableby QS. This document will be revised annually or when major changes occur.

5. Purpose

The purpose of this policy is to protect the QS informationassets from all threats, whether internal or external, deliberate, oraccidental.

The structural elements of this policy:

·      Policy context and the objectives defined bysenior management.

·      System governance and organization forinformation & privacy security of QS.

·      Developed principles and security & privacyrules conform to the best practices of information & privacy security andare applicable within the entire QS.

6. Revisions

Revisions to this document will be made annually, orwhenever deemed necessary.

‍

‍