Client Data Processing Standard

Organization: Igzibo Engineering Solutions, Inc.
Version: 1.0
Status: Living policy
Effective Date: September 16, 2026
Owner: Igzibo Engineering Solutions, Inc.
Review Cycle: At least annually and after material changes to applicable law, client requirements, technology, or business operations.

1. Purpose

Establishes baseline requirements for information processed by Igzibo on behalf of clients.

2. Scope

Employees, contractors, consultants, project managers, engineers, developers, recruiters, R&D personnel, and approved service providers handling Client Data.

Definitions

Client: An organization receiving services from Igzibo. Client Data: Information provided by, obtained from, or processed for a client in connection with an authorized engagement. DPA (Data Processing Agreement): An agreement establishing requirements for processing personal information or other regulated data. Data Owner: The person or organization responsible for determining appropriate classification, use, access, or handling requirements. Data Processor: A party that processes information on behalf of another party according to documented instructions. Igzibo: Igzibo Engineering Solutions, Inc. Personal Information: Information that identifies, relates to, describes, or can reasonably be linked to an identifiable individual, as defined by applicable law.

3. Core Principles

Client Data must be processed only for authorized purposes, protected according to classification, limited to authorized personnel, separated from unrelated engagements, retained as required, and returned or disposed of when required.

4. Client Instructions and Classification

Follow applicable contracts, SOWs, DPAs, security requirements, privacy requirements, and client instructions. Do not downgrade classification to avoid safeguards.

5. Access and Transfer

Access must be authorized, attributable, need-based, and removed when no longer required. Client Data must use approved transfer methods. Personal email, personal cloud storage, and unapproved file-transfer services are prohibited.

6. Development, Testing, and AI

Do not copy Client Data into development, testing, demonstrations, or research without authorization. Use synthetic, minimized, masked, or de-identified data where practical. Do not submit Client Data to unauthorized AI services or use it to train external AI systems without authorization.

7. Third Parties and International Processing

Third parties processing Client Data must be approved under the Technology and Third-Party Service Security Standard. International processing must comply with applicable law and client requirements.

8. Incidents, Retention, and Disposal

Promptly report suspected unauthorized access, disclosure, loss, alteration, destruction, or transfer under the Security Incident Response Procedure. Retain and dispose of Client Data according to contracts, legal holds, and applicable requirements.

9. Data Quality and Client Requests

Take reasonable steps to preserve data integrity. Route client requests concerning access, correction, deletion, transfer, or other legal rights to the responsible authority.

10. Exceptions and Enforcement

Exceptions require documented authorization. Violations may result in corrective action, access restrictions, contractual remedies, or termination.

11. References and Research Basis

• NIST, Cybersecurity Framework (CSF) 2.0.
• Federal Trade Commission, Consumer Privacy guidance.

Applicable client contracts and law may impose additional requirements.

Version History