Information Security Policy
Business: Psychic Bournemouth
Website: www.alisoncassidy.co.uk
Platform: WordPress / WooCommerce
Payment Processor: PayPal Payments
Hosting Provider: one.com
Date: 8 June 2026
Purpose
This policy describes how Psychic Bournemouth protects customer information and maintains PCI DSS compliance for online card payments.
Cardholder Data
Cardholder data is not stored on the website, hosting account, local computers, email systems, or paper records. Payment card data is processed by PayPal.
Access Control
Only Alison Cassidy is authorised to administer the website, hosting account, PayPal account and related business systems. Strong passwords and multi-factor authentication are used where available.
System Security
WordPress, WooCommerce, plugins and themes are kept up to date. Security updates are applied promptly. Malware and antivirus protection are maintained on devices used to administer the website.
Incident Response
Any suspected security incident will be investigated immediately. Relevant providers including PayPal, one.com and payment partners will be notified where required.
Data Disposal
Any business records containing sensitive information will be securely deleted or destroyed when no longer required.
Policy Review
This policy will be reviewed annually.
Appendix A – Devices
| Device | Description | User | Location |
|---|---|---|---|
| Business Computer | Website administration and email | Alison Cassidy | Business Premises |
| Mac Mini | Website administration and business operations | Alison Cassidy | Business Premises |
| Android Tablet | Business access and administration | Alison Cassidy | Business Premises |
| PC Laptop | Website administration and business operations | Alison Cassidy | Business Premises |
| Android Phone | Business email, PayPal and website administration | Alison Cassidy | Mobile |
| iPhone | Business email, PayPal and website administration | Alison Cassidy | Mobile |
| Broadband Router | Network connectivity | Alison Cassidy | Business Premises |
Appendix B – Third Party Service Providers
| Provider | Service | PCI Compliant | Notes |
|---|---|---|---|
| PayPal | Payment Processing | Yes | Processes payment card data |
| one.com | Website Hosting | N/A | Hosting provider |
| WooCommerce | E-commerce Platform | N/A | Online store software |
| WordPress | Website CMS | N/A | Website platform |
| Gmail | Business Email | N/A | Email provider |
| Viking Cloud | PCI Compliance | N/A | PCI compliance management |