Business Continuity Policy

1. Who We Are and the Purpose of This Policy

CloudNet Technologies Limited (“CloudNet”, “we”, “us” or “our”) is a private limited company registered in England and Wales under company number 14371617. Our registered office is 18 Alma Road, Manchester, England, M19 3NW. Our trading address is Unit 8B, Redfern Industrial Estate, Hyde, SK14 1RD.

This Business Continuity Policy sets out the principles CloudNet applies when preparing for, responding to and recovering from events that could materially disrupt our business operations or the technology services for which we are responsible.

Our objective is to reduce avoidable disruption, protect people and information, maintain appropriate communication and restore priority activities in a controlled and proportionate manner.

This policy does not represent a guarantee that interruption can never occur or that every service will remain continuously available in all circumstances.

2. Scope

This policy applies to business activities, personnel, systems, premises, suppliers and technology services for which CloudNet has operational responsibility.

Depending on the circumstances, continuity arrangements may apply to:

• software and digital services operated or supported by CloudNet
• cloud, hosting and infrastructure services under our management
• customer support and service-management activities
• business communications and administration
• development and technical operations
• access to business premises and essential technology
• critical suppliers and third-party service providers
• information, records and systems required for continued operations

Customer-specific contractual requirements may establish additional continuity, recovery, support or availability obligations for a particular service.

3. Our Continuity Principles

CloudNet takes a proportionate, risk-based approach to business continuity. Our approach is guided by the following principles:

• protecting the safety and welfare of people takes priority
• critical business and customer services should be identified and prioritised appropriately
• information and systems should be protected against avoidable loss or unauthorised access during disruption
• recovery decisions should take account of operational impact, customer requirements and available resources
• relevant customers and stakeholders should be informed where a material disruption affects them
• recovery should be controlled, documented where appropriate and subject to appropriate security measures
• lessons identified following significant disruption should inform future improvements

4. Business Continuity Risk Assessment

CloudNet considers events that could reasonably affect the continued operation of important business activities or customer services.

Depending on the nature of the service, relevant risks may include:

• loss of access to premises
• power, telecommunications or internet disruption
• failure of hardware, software or cloud infrastructure
• cyber-security incidents or malicious activity
• loss, corruption or unavailability of important information
• failure or disruption affecting a key supplier
• significant staff absence or loss of key personnel
• fire, flood, severe weather or other physical events
• public-health emergencies
• other events outside CloudNet’s reasonable control

The controls and recovery arrangements applied to a particular activity depend on its importance, architecture, contractual requirements, available technology and assessed risk.

5. Identification of Priority Activities

During significant disruption, CloudNet may prioritise activities according to their operational and customer impact.

Priority considerations may include:

• protection of people and information
• security and integrity of customer systems and data
• services supporting essential customer operations
• incident containment and recovery
• customer and stakeholder communications
• restoration of core technology and connectivity
• regulatory, legal and contractual obligations
• availability of personnel, infrastructure and third-party services

Not every business activity will necessarily receive the same recovery priority during a major incident.

6. Incident Assessment and Activation

Where an event materially affects, or has the potential to materially affect, normal business operations, CloudNet will assess the circumstances and determine the appropriate response.

Depending on the severity and nature of the event, actions may include:

• assessing the immediate impact and risks
• protecting people, systems and information
• containing the disruption where reasonably possible
• assigning appropriate personnel to coordinate the response
• prioritising affected services
• using alternative working or technology arrangements where appropriate
• contacting relevant suppliers or service providers
• communicating with affected customers or other stakeholders
• initiating restoration or recovery activities

7. Technology and Infrastructure Continuity

CloudNet considers resilience and recoverability when designing and operating technology services for which it is responsible.

Depending on the system, platform and contractual requirements, measures may include:

• appropriate backup arrangements
• use of cloud or infrastructure resilience features where available and appropriate
• monitoring of important systems and services
• controlled administrative access
• secure configuration and patch management
• documented technical information required to support recovery
• alternative access or working arrangements
• restoration procedures appropriate to the relevant system

The specific architecture and level of resilience provided for a customer service may vary according to the agreed service, customer configuration, technical platform and contractual terms.

8. Backup and Recovery

Where CloudNet is responsible for protecting operational or customer information, backup arrangements are applied where appropriate according to the relevant service and risk.

Backup and recovery measures may include:

• scheduled backups appropriate to the relevant system
• access restrictions protecting backup information
• separation of backup information from primary operational data where appropriate
• retention arrangements proportionate to business and contractual requirements
• periodic review or recovery testing where appropriate

Recovery capability depends on the architecture, service configuration, available backups and circumstances of the incident. CloudNet therefore does not publish a universal recovery-time or recovery-point commitment for all services.

Where specific recovery objectives are contractually required, they may be agreed separately for the relevant service.

9. Cyber-Security Incidents

A cyber-security incident may also become a business-continuity event where it materially affects the confidentiality, integrity or availability of systems or information.

Where appropriate, CloudNet may:

• restrict or isolate affected systems
• suspend particular access or functionality where necessary to reduce risk
• investigate the incident and preserve relevant evidence
• restore systems from a suitable known state where appropriate
• change credentials or access controls
• apply security updates or other remedial measures
• notify affected customers, controllers or authorities where required

Further information about our security approach is available in our Data Security Policy.

10. Premises and Alternative Working Arrangements

If normal access to CloudNet premises is materially disrupted, alternative working arrangements may be used where they are reasonably available, operationally suitable and sufficiently secure.

This may include authorised remote working or use of alternative locations where appropriate.

Security, confidentiality, access-control and data-protection obligations continue to apply when personnel are working away from normal business premises.

11. Personnel and Key Skills

CloudNet recognises that continuity depends on the availability of appropriately skilled personnel.

Where proportionate to the size and nature of our operations, we seek to reduce unnecessary dependency on a single individual by maintaining appropriate documentation, access arrangements, shared operational knowledge and allocation of responsibilities.

During periods of significant staff absence, CloudNet may reprioritise work, reallocate available personnel, adjust non-critical activities or use other reasonable continuity measures.

12. Suppliers and Third-Party Services

CloudNet relies on third-party suppliers for certain technology, telecommunications, cloud, software and business services.

Where a supplier is important to the delivery of a service, we consider relevant dependency and continuity risks as appropriate.

Where a disruption originates with an independent third-party provider, CloudNet will take reasonable steps within its control to manage the impact, communicate appropriately and use available recovery or alternative arrangements where practicable.

CloudNet cannot guarantee the uninterrupted operation of independent third-party networks, utilities, cloud providers, telecommunications services or other infrastructure outside our reasonable control.

13. Customer Communication During Disruption

Where a material disruption affects a customer service for which CloudNet has operational responsibility, we aim to provide appropriate information to affected customers.

Depending on the circumstances and information available, communications may include:

• the nature of the disruption
• services known to be affected
• important actions customers should take, where applicable
• recovery activity being undertaken
• further updates where appropriate

During an active incident, initial information may be incomplete and may be updated as investigation and recovery progress.

14. Data Protection During a Continuity Event

Data-protection, confidentiality and information-security obligations continue to apply during business disruption.

Continuity and recovery activities should therefore maintain appropriate controls over access, disclosure, transmission, storage and restoration of personal or confidential information.

Where a continuity incident also involves a personal data breach, the incident will be assessed in accordance with applicable UK data-protection requirements and our Data Security and Privacy policies.

15. Recovery and Return to Normal Operations

Recovery is managed according to the nature of the incident, affected services and available resources.

Before returning an affected service to normal operation, CloudNet may take steps such as:

• confirming that essential systems are functioning appropriately
• reviewing security and access controls
• checking the integrity or availability of relevant information
• confirming that required dependencies are available
• monitoring restored services for further issues

Where appropriate, normal operations may be restored in stages rather than simultaneously.

16. Review Following Significant Disruption

Following a significant continuity event, CloudNet may conduct an internal review appropriate to the nature and impact of the incident.

The review may consider:

• the cause and impact of the disruption
• the effectiveness of the response
• recovery performance
• communications with customers and stakeholders
• technical or operational weaknesses identified
• reasonable corrective or preventive actions

Lessons identified may be used to improve relevant systems, procedures, documentation or controls.

17. Testing and Review of Continuity Arrangements

Continuity and recovery arrangements are reviewed periodically and may be tested where appropriate to the relevant service, operational risk and contractual requirements.

Testing may take different forms, including review of procedures, recovery checks, technical restoration exercises or scenario-based discussion.

The nature and frequency of testing are proportionate to the importance and complexity of the relevant service and should not be interpreted as a guarantee that every possible disruption scenario can be anticipated.

18. Customer Responsibilities and Shared Dependencies

Some CloudNet services operate within infrastructure, devices, networks or systems controlled by the customer or by third parties selected by the customer.

In these circumstances, effective business continuity may depend on shared responsibilities, which can include:

• customer-controlled backups
• local infrastructure and internet connectivity
• customer account and identity management
• customer-selected hosting or third-party services
• timely provision of information or access required for recovery

The responsibilities applicable to a particular service are determined by its architecture and relevant contractual arrangements.

19. Events Outside Our Reasonable Control

Some disruptions may result from circumstances beyond CloudNet’s reasonable control, including failures of public utilities, telecommunications networks, third-party infrastructure, severe weather, natural disasters, public emergencies or other external events.

Where such circumstances arise, CloudNet will take reasonable and proportionate steps within its control to reduce disruption and support recovery.

Nothing in this policy alters any applicable contractual provisions concerning force majeure, service availability, liability or other events outside a party’s reasonable control.

20. Governance and Responsibility

Overall responsibility for business-continuity governance rests with CloudNet Technologies Limited.

Management is responsible for ensuring that material continuity risks are considered as appropriate to CloudNet’s operations and that responsibilities for significant incidents are assigned where necessary.

Employees, workers and contractors are expected to follow relevant continuity, security, confidentiality and incident-reporting requirements and to cooperate with reasonable recovery arrangements.

21. Relationship With Other CloudNet Policies

This Business Continuity Policy should be read alongside other relevant CloudNet policies and contractual documentation, including:

• Data Security Policy
• Privacy Policy
• Complaints Policy
• Terms & Conditions
• Workplace Policy
• Corporate Compliance & Social Responsibility

More detailed internal or service-specific continuity arrangements may apply where appropriate and are not necessarily published publicly for security and operational reasons.

22. Review of This Policy

We review this policy periodically and may review it sooner following:

• a significant business-continuity or service-disruption event
• a material change to CloudNet’s operations or infrastructure
• a significant change to a critical supplier or technology dependency
• changes to applicable legal, regulatory or contractual requirements
• lessons identified through continuity or recovery activity

Where this policy is updated, the revised version will be published on this page and the effective or last-reviewed date will be amended as appropriate.

23. Contact Us

For questions concerning this Business Continuity Policy or continuity arrangements relevant to a CloudNet service, please contact: