Kickass Online Ltd ("KO") is committed to the highest standards of openness, integrity, and accountability. This policy provides a mechanism for employees to raise concerns about wrongdoing in confidence, and confirms that KO will not retaliate against anyone who raises a concern in good faith.
Whistleblowing (or making a 'protected disclosure') is the reporting of suspected wrongdoing or dangers in the workplace, including: criminal activity; breach of a legal obligation; miscarriage of justice; danger to health and safety; damage to the environment; or deliberate cover-up of any of the above. A concern must be raised in the public interest (not solely a personal grievance, which should be dealt with via the Grievance Procedure).
Under the Public Interest Disclosure Act 1998, workers who make a qualifying disclosure are protected from dismissal, detriment, or victimisation. KO will not tolerate any retaliation against an employee who raises a concern in good faith.
All concerns raised under this policy will be treated in confidence. The identity of the discloser will be protected to the extent possible, having regard to the need to investigate.
If an investigation establishes that a concern was raised maliciously or without reasonable grounds, disciplinary action may be considered.
This policy will be reviewed annually.
Last reviewed: May 2026.
Kickass Online Ltd ('KO') is committed to providing a safe and healthy working environment for all employees, contractors, and visitors. This policy is made pursuant to the Health and Safety at Work etc. Act 1974 (HASAWA 1974), the Management of Health and Safety at Work Regulations 1999, and all other applicable UK health and safety legislation.
Emergency evacuation procedures, fire marshal details, and assembly points will be communicated to all employees on induction and reviewed annually.
H&S training relevant to each role will be provided on induction and refreshed periodically. Records of training will be maintained by HR.
This policy will be reviewed annually by the competent person and a Director. Last reviewed: May 2026.
Signed by: Panagiotis Zmpigknief Zavatzki, 18 May 2026.
Kickass Online Ltd ('KO') is committed to supporting the wellbeing of all employees. This policy sets out entitlements and procedures for annual leave in compliance with the Working Time Regulations 1998 (WTR 1998).
This policy applies to all employees. Workers (including contractors engaged on a worker basis) have separate statutory rights under the WTR 1998. Part-time employees receive a pro-rata entitlement calculated on the same basis.
KO observes the standard bank and public holidays in England and Wales. These are included within the 28-day entitlement. Employees required to work on a bank holiday will receive a substitute day's leave.
Payment on Termination
On termination of employment, employees will be paid for any accrued but untaken annual leave. If an employee has taken more leave than accrued at the date of termination, the excess may be deducted from final pay, subject to the employee's written agreement in their contract.
This policy will be reviewed annually or when legislation changes.
Last reviewed: May 2026.
Purpose: To ensure all travel undertaken on behalf of Kickass Online Ltd ('KO') is organised efficiently, cost-effectively, safely, and in line with KO's values and obligations.
Scope: This policy applies to all KO employees and contractors required to travel for business purposes, including client meetings, networking events, team meetups, and conferences.
KO provides a daily meal allowance aligned with HMRC's approved benchmark rates to avoid a taxable benefit arising:
The per diem is provided in lieu of receipts for meals. Receipts are not required for individual meal purchases within the per diem limit. Expenses above the per diem — or expense categories not covered by the per diem (e.g. business entertainment, specific work-related costs) — require receipts and a brief note of the business purpose.
Alcohol consumed at client entertainment may be included in an expenses claim only where it forms part of a legitimate business meal and is reasonable in the context of the occasion.
KO is committed to minimising the environmental impact of business travel, consistent with our Environmental Policy:
Consistent with KO's Modern Slavery Policy, employees should be mindful of the ethical standards of travel suppliers — hotels, transport providers, and contractors — particularly when travelling internationally. Any concerns about supplier practices should be raised with the Director.
Expenses incurred outside this policy without prior approval may not be reimbursed. Repeated or deliberate non-compliance may be treated as a disciplinary matter in accordance with the Disciplinary Policy.
This policy will be reviewed annually or when KO's travel arrangements or supplier agreements change.
Last reviewed: May 2026.
At Kickass Online Limited ("KO"), we are committed to the wellbeing and overall happiness of our team. This policy sets out the statutory entitlements all employees hold as a matter of UK law, followed by the enhanced contractual benefits KO provides on top of those minimums.
Statutory entitlements are a legal floor and cannot be waived or reduced. Contractual benefits are provided at KO’s discretion and may be amended with reasonable notice.
All full-time employees are eligible for KO’s contractual benefits. Part-time employees are eligible on a pro-rata basis where applicable. Statutory entitlements apply to all employees regardless of hours or contract type, subject to the qualifying criteria set by the relevant legislation.
| PART A — STATUTORY ENTITLEMENTS |
The following rights are provided by UK law. They apply regardless of any contractual benefits KO offers.
1. Annual Leave
2. Statutory Sick Pay (SSP)
3. Family-Friendly Leave
4. Right to Request Flexible Working
5. Workplace Pension (Auto-Enrolment)
6. DSE Eye Tests
7. Statutory Redundancy Pay
8. National Minimum and Living Wage
| PART B — KAO ENHANCED BENEFITS |
The following benefits are provided by KO above and beyond statutory requirements. They form part of the overall employment package and may be amended by KO with reasonable notice.
1. Eye Tests (Enhanced Reimbursement)
2. Gym Membership Subsidy
| Tax note: this is a taxable benefit in kind and will be reported on your P11D. You may have an income tax liability as a result. |
3. Mortgage and Financial Planning Advice
4. Life Insurance
| Tax note: employer-paid life insurance may be a P11D benefit if it falls outside the HMRC exemption for Relevant Life Policies. HR will advise on the tax treatment applicable to your policy. |
5. Private Health Insurance
| Tax note: private health insurance is a taxable benefit in kind and will be reported on your P11D. |
6. Mental Health Support
7. Flexible Working (Enhanced)
8. Professional Development
9. Enhanced Pension Contributions
This policy will be reviewed annually or whenever legislation changes.
Last reviewed: May 2026.
Disclaimer: This policy provides a summary of statutory and contractual entitlements. It does not constitute legal or financial advice. Employees with questions about their individual tax position should seek independent advice.
Purpose: At Kickass Online Ltd ('KO'), we are committed to creating and maintaining a work environment where all individuals are treated with respect and dignity. We recognise the value of diversity and are committed to providing equal opportunities for all employees and applicants.
Scope: This policy applies to all aspects of employment, including recruitment, hiring, job assignments, promotions, training, compensation, benefits, disciplinary actions, and termination.
KO is an equal opportunity employer. We do not discriminate on the basis of any protected characteristic as defined by the Equality Act 2010, including: age, disability (including neurodivergent conditions), gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation.
We strive to create an inclusive environment where diverse perspectives are valued. We expect all employees to treat each other with respect and professionalism at all times.
Our recruitment processes are designed to be fair and unbiased. Job descriptions focus on the skills and competencies required for the role. Shortlisting and selection decisions are made solely on merit and relevant criteria.
We provide equal opportunities for training and development to all employees. This supports our commitment to career growth and skill enhancement for everyone, regardless of background or protected characteristic.
We are committed to making reasonable adjustments for employees and applicants with disabilities, in accordance with the Equality Act 2010 (s.20). This includes adjustments to the work environment, equipment, working hours, or processes. Employees requiring adjustments should speak to their line manager or contact us at info@kickassonline.com.
Any employee who believes they have been subjected to discrimination, harassment, or victimisation can raise their concerns without fear of reprisal, in accordance with our Grievance Procedure. All complaints will be investigated promptly and confidentially.
KO will periodically review the diversity of its workforce to inform recruitment, development, and inclusion strategies. Any data collected for this purpose will be anonymised and handled in accordance with the UK GDPR and Data Protection Act 2018. Participation in diversity monitoring is voluntary.
KO recognises that unconscious bias can influence decisions around hiring, promotion, and day-to-day working relationships. Training on unconscious bias and inclusive practice will be provided to all employees, with particular focus on anyone involved in recruitment or performance decisions.
KO supports employees who wish to establish or participate in informal networks or groups that promote inclusion and provide peer support. Requests to set up a network should be raised with the line manager.
KO will, where practicable, consider diversity and ethical practice when selecting suppliers, contractors, and partners — promoting inclusion beyond our immediate workforce.
All employees are responsible for supporting and upholding this policy. Managers and team leaders have a specific responsibility to ensure fair treatment within their teams and to address any issues of discrimination they become aware of. Breaches of this policy may result in disciplinary action.
This policy will be reviewed annually and updated as required to ensure compliance with the Equality Act 2010 and any subsequent legislation.
Last reviewed: May 2026.
Purpose: Kickass Online Ltd ('KO') is a fully remote business. This policy sets out how remote working operates at KO — the expectations, support, tools, health and safety obligations, and working practices that apply to all employees.
Scope: This policy applies to all KO employees. As KO has no physical office, all employees are remote workers for the purposes of this policy and UK employment law.
Remote working is not a perk or exception at KO — it is the foundation of how we operate. Our team is distributed across different locations and time zones, and we have built our processes, tools, and culture around making remote work effective, sustainable, and enjoyable.
This policy should be read alongside the IT, Communications and BYOD Policy (which covers device security and data protection) and the Health and Safety Policy (which covers DSE assessments and home working risk).
Employees are responsible for maintaining a suitable, safe, and ergonomically sound home working environment. This means:
KO does not currently provide a home office equipment allowance as standard, but employees who identify a genuine equipment need (e.g. a monitor, keyboard, or ergonomic chair) should raise this with the Director. Any equipment purchased by KO remains KO's property.
Under the Health and Safety (Display Screen Equipment) Regulations 1992, KO is required to ensure that all DSE users — which includes all KO employees — have an adequate workstation assessment. On joining KO, employees must complete a home DSE self-assessment form, provided by the line manager. This should be repeated whenever the home working setup changes materially. Where the assessment identifies a risk, KO will work with the employee to address it.
KO does not operate a rigid 9-to-5 structure. We trust employees to manage their time effectively and deliver their work to the standard and deadlines agreed. However:
KO does not expect employees to be contactable outside their agreed working hours. Managers should not routinely send messages or requests outside working hours with an expectation of immediate response. Employees should feel free to set clear working hours and communicate them to the team.
KO's primary communication and collaboration tools are:
Employees must use their KAO Google Workspace account (@kickassonline.com) for all business email and document storage. Personal email accounts and personal cloud storage must not be used for company work. Full requirements are in the IT, Communications and BYOD Policy.
All data security requirements for remote workers are set out in the IT, Communications and BYOD Policy — including device encryption, antivirus, LastPass, MFA, and network security. Compliance with that policy is a condition of remote employment at KO.
In summary, employees must:
KO will reimburse the following remote working expenses where pre-approved:
Employees must submit expense claims within 5 working days with receipts. KO will reimburse within 10 working days of approval.
Remote working brings real benefits but also risks — including isolation, overworking, and blurred boundaries between work and personal life. KO takes these seriously.
Employees are encouraged to:
Managers will check in regularly with remote employees on workload and wellbeing, not just task delivery.
All KO employees have the right to request flexible working arrangements from day one of employment, under the Employment Relations (Flexible Working) Act 2023. Full details are in the Benefits Policy. KO is genuinely open to flexible arrangements and encourages employees to have that conversation rather than assume a request would be refused.
When on video calls with clients or in virtual meetings where KO is represented:
This policy will be reviewed annually or when KO's working arrangements change materially.
Last reviewed: May 2026.
Purpose: This policy provides guidelines for the responsible use of social media by all Kickass Online Ltd ('KO') employees. It aims to protect KO's reputation and client relationships while respecting employees' right to a private life and lawful personal expression.
Scope: This policy applies to all KO employees and covers: use of social media during working hours; use of official KO social media accounts; and personal social media use outside working hours where it references KO, its clients, competitors, or colleagues, or where it could reasonably be linked back to KO.
This policy does not restrict employees from making protected disclosures under the Public Interest Disclosure Act 1998 (see the Whistleblowing Policy).
All employees must conduct themselves professionally when posting on social media in a context connected to KO — whether on official accounts or personal accounts where their association with KO is apparent. This includes interactions with clients, competitors, and members of the public.
Confidential information about KO, its clients, suppliers, or business partners must never be shared on social media. This includes: client names or project details (unless the client has given written consent); commercially sensitive information; unreleased products, pricing, or business strategies; and any information that is not already in the public domain.
Breaching client confidentiality on social media is a serious disciplinary matter and may constitute a breach of contract.
Social media posts — including those made on personal accounts outside working hours — must not be discriminatory, offensive, or harassing towards colleagues, clients, or any group with a protected characteristic under the Equality Act 2010. Posts of this nature can constitute harassment under the Act even if made outside the workplace, and will be treated as a disciplinary matter.
Do not engage in arguments, pile-ons, or heated public disputes that could reflect negatively on KO.
Employees are free to use personal social media accounts as they choose outside working hours. However, where your association with KO is apparent (e.g. in your bio or profile), you should:
KO will only take action regarding personal out-of-hours social media activity where there is a clear and direct impact on KO's reputation, client relationships, or the working environment — for example, discriminatory content, breach of confidentiality, or conduct that would undermine trust in KO's professional integrity.
Employees authorised to post on KO's official social media channels (LinkedIn, Instagram, and others) must:
Access credentials for official KO accounts must be stored in LastPass and must not be shared outside the authorised team.
KO uses AI tools as part of its content workflow. When publishing AI-assisted content on official KO channels or in a professional capacity linked to KO:
All social media activity must comply with applicable law, including:
Employees who become aware of social media content that misrepresents KO, breaches client confidentiality, or could damage KO's reputation should report it to their line manager or to info@kickassonline.com promptly.
Breaches of this policy may result in disciplinary action in accordance with KO's Disciplinary Policy, up to and including dismissal. The severity of any action will be proportionate to the nature of the breach.
This policy will be reviewed annually.
Last reviewed: May 2026.
KO is committed to a working environment free from harassment and bullying. This policy reflects KO's obligations under the Equality Act 2010 and the Worker Protection (Amendment of Equality Act 2010) Act 2023, which came into force on 26 October 2024.
Under the Worker Protection (Amendment of Equality Act 2010) Act 2023, KO has a proactive legal duty to take reasonable steps to prevent sexual harassment of employees in the course of their employment. This includes third-party harassment (e.g. by clients, suppliers, or visitors). Failure to comply with this duty may result in the Equality and Human Rights Commission (EHRC) taking enforcement action and any Employment Tribunal award being uplifted by up to 25%.
Any employee who experiences or witnesses harassment or bullying should report it as soon as possible to their line manager or, if the line manager is involved, to Panagiotis Zmpigknief Zavatzki at pazbi@kickassonline.com. All reports will be treated seriously and in confidence.
This policy will be reviewed annually, and specifically in response to any changes in EHRC guidance.
Last reviewed: May 2026.
KO is committed to resolving workplace concerns quickly and fairly. This procedure is designed to be compliant with the ACAS Code of Practice on Disciplinary and Grievance Procedures (2015). Employees are encouraged to raise concerns promptly.
In the first instance, employees are encouraged to raise any concern informally with their line manager or, if the grievance relates to the line manager, with the next level of management or the HR contact. Many issues can be resolved informally and quickly.
Depending on the nature of the grievance, KO may conduct an investigation before or alongside the grievance hearing. Where a grievance involves a complaint against another employee, that employee will be made aware of the allegation(s) and given the opportunity to respond.
If the employee is dissatisfied with the outcome, they may appeal in writing within 5 working days of receiving the written decision. The appeal will be heard by a more senior manager, wherever possible someone not previously involved. The outcome of the appeal is final.
Concerns about wrongdoing or illegal activity are covered by the Whistleblowing Policy (see separate policy). Employees raising such concerns have additional legal protections under the Public Interest Disclosure Act 1998.
All grievances will be handled with discretion and confidentiality, consistent with the need to investigate effectively.
Policy Review
This policy will be reviewed annually.
Last reviewed: May 2026.
Purpose: This policy sets out Kickass Online Ltd's ('KO') procedure for managing disciplinary matters fairly, consistently, and in compliance with the ACAS Code of Practice on Disciplinary and Grievance Procedures (2015). All managers and employees should read this policy alongside the ACAS Code.
Scope: This policy applies to all KO employees. It does not form part of any employee's contract of employment and may be amended from time to time. It does not apply to redundancy situations or the non-renewal of a fixed-term contract on expiry.
Employees are expected to maintain high standards of conduct and performance, including compliance with all KO policies, professional behaviour in dealings with colleagues, clients, and third parties, and achievement of agreed performance objectives. Where standards are not met, KO will act promptly, fairly, and in accordance with this procedure.
This policy follows the ACAS Code of Practice on Disciplinary and Grievance Procedures (2015), which is a statutory code. Employment Tribunals are required to take the Code into account when considering unfair dismissal and other claims. Where KO unreasonably fails to follow the Code, a Tribunal may increase any compensation awarded by up to 25%. Where an employee unreasonably fails to follow the Code, compensation may be reduced by up to 25%.
Many conduct and performance issues can and should be resolved informally. Before initiating any formal process, the line manager will seek to address concerns through a supportive conversation, clear feedback, and agreed targets for improvement. A brief note of the discussion will be kept. Informal resolution is not a disciplinary sanction and will not appear on the employee's formal record.
Before any formal disciplinary action is taken, a reasonable investigation will be conducted. This is a requirement of the ACAS Code and a fundamental element of procedural fairness.
Where the allegation is serious, or where the employee's continued presence at work could compromise the investigation or pose a risk, KO may suspend the employee on full pay pending the outcome of the investigation.
Suspension is a neutral precautionary measure — it is not a disciplinary sanction and must not be treated as such. It does not imply guilt. KO will keep the period of suspension as short as possible and will review it regularly.
If the investigation concludes there is a case to answer, the following procedure will apply:
Step 1 — Written notice of hearing The employee will be invited in writing to a formal disciplinary hearing with a minimum of 48 hours' notice. The written invitation will set out: the nature of the allegation(s); the potential outcome if the allegation is upheld; the evidence KO intends to rely on; and the employee's right to be accompanied.
Step 2 — The hearing The hearing will be conducted by a manager with appropriate authority. The employee will be given the opportunity to respond to the allegation(s), present their case, call witnesses, and ask questions of KO's evidence. The hearing may be adjourned if further investigation is needed.
Step 3 — The outcome Following the hearing, KO will notify the employee of the outcome in writing, normally within 5 working days. Possible outcomes are:
First written warning: Issued for a first instance of misconduct or a performance failing that has not improved following informal steps. The warning will specify the issue, the required improvement, the support available, and the timescale for review. Active for 12 months from the date of issue, after which it will be disregarded for disciplinary purposes.
Final written warning: Issued where misconduct or performance continues after a first written warning, or where a first offence is sufficiently serious to warrant it. Active for 12 months from the date of issue (or longer in exceptional circumstances, which will be specified in writing). A further breach during this period may result in dismissal.
Dismissal with notice: Where the issue has not been resolved after a final written warning, or where the conduct is serious but does not amount to gross misconduct. The employee will receive their contractual or statutory notice, whichever is greater.
Summary dismissal (without notice): Reserved for gross misconduct only — see below.
Gross misconduct is conduct so serious that it fundamentally and irreparably breaches the employment relationship, justifying immediate dismissal without notice or pay in lieu of notice. Examples of gross misconduct at KO include, but are not limited to:
This list is illustrative, not exhaustive. Whether conduct amounts to gross misconduct will depend on the facts and circumstances of each case.
Under the Employment Relations Act 1999, employees have a statutory right to be accompanied at any formal disciplinary hearing by a trade union representative or a fellow worker of their choice. The companion may address the hearing, confer with the employee, and sum up the employee's case — but may not answer questions on the employee's behalf.
Employees must make a reasonable request to be accompanied in advance of the hearing. KO may postpone a hearing by up to 5 working days if the employee's chosen companion is not available at the proposed time.
Employees have the right to appeal against any formal disciplinary sanction. The appeal must be submitted in writing to the Director within 5 working days of receiving the written outcome, setting out clearly the grounds of appeal.
Grounds of appeal may include: procedural unfairness; the sanction being disproportionate to the misconduct; new evidence that was not available at the time of the hearing; or bias or conflict of interest on the part of the hearing manager.
The appeal will be heard by a manager more senior than the original hearing manager, wherever possible someone not previously involved in the matter. The outcome of the appeal will be confirmed in writing. The appeal decision is final.
Where the issue relates to performance rather than conduct, KO will follow a structured performance improvement process, which will include: clear identification of the performance shortfall; agreed, measurable targets and timescales for improvement; regular review meetings with documented feedback; and reasonable support including training, coaching, or adjusted workload where appropriate. Formal disciplinary action for performance will only be taken where the employee has been given a fair opportunity to improve and has failed to do so despite reasonable support.
All records relating to disciplinary proceedings — including investigation notes, hearing notes, outcome letters, and appeal decisions — will be kept confidentially in the employee's personnel file. In accordance with UK GDPR data retention principles, records will be retained for a minimum of 6 years following resolution of the matter. Warning letters will be removed from the active record once the active period has expired, though may be retained securely for limitation purposes.
All disciplinary matters will be handled consistently, proportionately, and without discrimination. Employees in similar situations will be treated similarly. Where precedent is relevant, KO will take it into account. No disciplinary action will be taken on grounds that relate to a protected characteristic under the Equality Act 2010, the exercise of a statutory right, or whistleblowing under PIDA 1998.
This policy will be reviewed annually and whenever the ACAS Code is updated.
Last reviewed: May 2026.
This policy governs the secure and responsible use of information technology, communications systems, and personal devices at Kickass Online Ltd (‘KO’). As a fully remote team, all staff use their own devices to carry out company work. This policy establishes the minimum security standards required, reflects KO’s obligations under UK law, and protects both the company and its employees, clients, and data.
This policy applies to all employees, contractors, and freelancers working for KO who access company systems, data, or communications — regardless of location or device ownership. It covers all personal devices used for work purposes (BYOD), all KO-provisioned accounts, and all company data however stored.
This policy is issued in compliance with and with reference to:
| PART A — IT & COMMUNICATIONS POLICY |
1. Acceptable Use
KO’s IT and communications systems — including Google Workspace, project management tools, and all company accounts — are provided primarily for business purposes. Reasonable personal use is permitted provided it does not:
Employees remain subject to this policy when accessing company systems outside normal working hours.
2. Google Workspace
Google Workspace is KO’s primary productivity and communications platform. All employees are issued a KO Google Workspace account (@kickassonline.com). The following rules apply:
3. Email and Communications Etiquette
4. Internet Use
5. Software and Applications
6. Data Security and Confidentiality
7. Monitoring Notice
KO may, from time to time and in accordance with the Investigatory Powers Act 2016 and Regulation of Investigatory Powers Act 2000, monitor activity on company-provided accounts and systems (including Google Workspace, email, and any other KO-administered service). Such monitoring may include:
Monitoring will only be carried out for legitimate business purposes including: security investigation, compliance with legal obligations, or where there is reasonable suspicion of a policy breach. Employees are notified of this possibility by the existence of this policy. Content monitoring of personal devices or personal accounts is not carried out.
8. Reporting
9. Training
All employees will receive IT security awareness training on induction and at least annually thereafter. This will cover phishing awareness, password hygiene, UK GDPR obligations, and safe use of company tools.
| PART B — BRING YOUR OWN DEVICE (BYOD) POLICY |
10. Overview
As a fully remote team, all KO employees use their own personal devices — laptops, desktops, tablets, and smartphones — to carry out their work. This section sets out the minimum security requirements that all personal devices used for KO work must meet.
By using a personal device to access KO systems, data, or communications, employees agree to comply with the requirements in this section. Non-compliance may result in access being suspended or withdrawn, and may lead to disciplinary action.
| Important: KO does not have remote management (MDM) software installed on personal devices. Security compliance is therefore based on trust and self-attestation, verified periodically by the line manager. |
11. Mandatory Device Requirements
The following requirements are mandatory for any personal device used to access KO systems or data:
| FULL-DISK ENCRYPTION | All devices must have full-disk (device) encryption enabled. On Windows: BitLocker. On macOS: FileVault. On iOS/Android: enabled by default when a device passcode is set. Encryption must be active at all times. |
| DEVICE PASSCODE / PASSWORD | All devices must be protected by a strong passcode, PIN, or password. Biometric unlock (fingerprint / Face ID) is permitted as a secondary method but must not be the sole means of access. Auto-lock must be set to 5 minutes or less of inactivity. |
| ANTIVIRUS / ENDPOINT SECURITY | All Windows and macOS devices must have reputable, up-to-date antivirus / endpoint protection software installed and active. Recommended: Malwarebytes, Bitdefender, or equivalent. Real-time scanning must be enabled. iOS and Android devices are exempt from this specific requirement but must meet all other requirements. |
| OPERATING SYSTEM UPDATES | Operating systems and all work-related applications must be kept up to date. Security patches must be applied within 14 days of release. Employees must not use end-of-life operating systems (e.g. Windows 10 after October 2025, older macOS versions no longer receiving security updates). |
| SCREEN LOCK | Devices must be set to lock automatically after a maximum of 5 minutes of inactivity, requiring re-authentication to resume. |
12. Password Management — LastPass
KO requires all employees to use LastPass as the company’s approved password manager for all work-related accounts.
| Never store the LastPass master password in the vault itself, in a browser, or as a note on your device. |
13. Multi-Factor Authentication (MFA)
Multi-factor authentication (MFA) is mandatory on all KO work accounts. There are no exceptions.
| Google Workspace admins: enforce MFA organisation-wide via the Google Admin Console (Admin → Security → 2-Step Verification → Enforcement). This should be set to ‘On’ for all users with no exceptions. |
14. Google Workspace Security Settings
Because Google Workspace is KO’s primary platform, the following security settings must be maintained:
15. Network Security
16. Personal and Company Data Separation
| Recommended: Set up a dedicated work browser profile in Chrome signed in to your KO Google account. This keeps bookmarks, extensions, passwords (via LastPass), and history separate from personal browsing. |
17. Lost, Stolen, or Compromised Devices
18. Compliance, Attestation & Audits
On joining KO, and annually thereafter, employees must confirm in writing (via the HR onboarding or annual review process) that their devices meet the requirements of this policy. The compliance checklist below summarises the mandatory requirements:
| Requirement | Mandatory | Applies To |
| Full-disk encryption enabled | YES | All devices |
| Device passcode / strong password set | YES | All devices |
| Auto-lock set to 5 minutes or less | YES | All devices |
| Antivirus / endpoint protection installed and active | YES | Windows / macOS |
| Operating system up to date (patches within 14 days) | YES | All devices |
| LastPass installed and KO vault in use | YES | All staff |
| All work passwords stored in LastPass (16+ chars, unique) | YES | All staff |
| MFA enabled on Google Workspace | YES | All staff |
| MFA enabled on LastPass | YES | All staff |
| MFA enabled on all other work accounts | YES | All staff |
| MFA method: authenticator app (not SMS only) | YES | All staff |
| Separate browser profile for work (Chrome recommended) | Recommended | All staff |
| Home Wi-Fi using WPA2/WPA3 encryption | YES | All staff |
| VPN in use on public Wi-Fi | YES | All staff |
| Company data stored in Google Drive only (not personal cloud) | YES | All staff |
19. Privacy of Personal Devices
KO recognises that employees use their own devices and respects their personal privacy. Accordingly:
20. Departures and Offboarding
When an employee leaves KO, the following steps will be completed on or before the last working day:
Retention of company data, client information, or KO credentials after departure may constitute a breach of the Computer Misuse Act 1990 and/or the UK GDPR, and KO reserves the right to take appropriate action.
Compliance with this policy is a condition of employment. Failure to comply may result in:
Employees who are uncertain about any aspect of this policy should contact their line manager before taking any action.
This policy will be reviewed annually or when there are material changes to KO’s technology stack, working arrangements, or applicable legislation.
Last reviewed: May 2026.