Information Security & Data Protection Policy

Jungle Mug Limited (CRO 735233, VAT IE4120187DH), Unit 7-8 Old Mill, Church Avenue, Portlaoise, Co. Laois, R32 VA4P, Ireland.
Version 1.0 · Adopted 30 October 2026 · Owner: Jason Penny, Director · Review: every 12 months, or sooner after any incident or major system change.
Contact for security and data protection matters: sales@junglemug.com

This document sets out how Jungle Mug Limited protects the personal data we handle when we sell and ship mugs through our own website (junglemug.com) and through online marketplaces such as TikTok Shop. It applies to the director, any staff or contractors, and every system we use to process customer orders, including our internal order-management system, JMOS.

1. Information Security Policy

We protect the confidentiality, integrity and availability of customer and business data. We collect only the data needed to fulfil orders, keep it in a small number of controlled systems, and remove it when it is no longer needed.

  • Systems in scope: JMOS (hosted on Supabase, AWS region eu-west-1, Dublin, Ireland); our Shopify store; marketplace seller portals; carrier systems (DHL eCommerce); company email and company computers.
  • Responsibility: the director is responsible for this policy, for approving access and for handling incidents.
  • Training: anyone given access to customer data is briefed on this policy before access is granted.

2. Network and Infrastructure Protection

  • Customer data is held in managed cloud services, not on office servers. JMOS runs on Supabase/AWS, where the database is isolated in the provider's private network and is reachable only through authenticated APIs.
  • Database tables containing personal data have row-level security switched on; public and anonymous roles have no access. Server-side functions authenticate every call with a signed token or a secret key.
  • Third-party credentials (marketplace, carrier and payment keys) are stored only as encrypted server-side secrets, never in code, email, chat or spreadsheets.
  • Company computers use the operating-system firewall, and the business internet connection uses a router firewall with a strong admin password and WPA2/WPA3 Wi-Fi. Guest devices use a separate guest network where available.
  • Provider logs (database, API and function logs) are reviewed when anything unusual is reported and at least monthly.

3. Endpoint Protection and Security Baseline

  • Every company computer runs anti-virus/anti-malware with real-time protection switched on (Microsoft Defender or equivalent) and automatic updates.
  • Operating system, browser and software security updates are installed promptly, and within 14 days for critical patches.
  • Screens lock automatically after 5 minutes of inactivity, and devices are locked whenever left unattended.
  • Passwords are at least 12 characters, unique for each service and stored in a password manager. Passwords are never shared.
  • Multi-factor authentication is enabled on email, Shopify, Supabase, marketplace seller accounts and carrier accounts wherever the service supports it.
  • Clear-desk rule: printed shipping labels and pick sheets are kept in the packing area only, used for that day's dispatch, and shredded if spoiled or not used.

4. Access Control Policy (Least Privilege)

  • Access to customer data is given only to people who need it for their job, at the lowest level that works (for example, read-only "viewer" access in JMOS).
  • Each person has their own named account. Shared logins are not allowed.
  • JMOS user access is controlled by an approved-users list. Access is reviewed every quarter and removed on the same day a person leaves or no longer needs it.
  • API keys and app secrets are only accessible to the director, and are rotated immediately if exposure is suspected.

5. Data Classification and Encryption Policy

Class Examples Handling
Confidential – personal data Buyer name, delivery address, phone, email, order contents Stored only in approved systems; encrypted in transit and at rest; least-privilege access; deleted per retention rules
Confidential – secrets API keys, app secrets, passwords, tokens Encrypted secret storage only; never written in plain text or shared
Internal Sales figures, supplier prices, SKU data Company systems only
Public Product listings, images, website content No restriction
  • In transit: all connections to JMOS, Shopify, marketplaces and carriers use HTTPS/TLS 1.2 or higher.
  • At rest: the JMOS database and file storage are encrypted at rest (AES-256) by the hosting provider. Company computers use full-disk encryption (BitLocker or equivalent).
  • Personal data is not copied to USB drives, personal email or personal cloud storage.

6. Marketplace Data (including TikTok Shop)

  • Order data received through marketplace APIs is used only to fulfil, ship, track and support that order, and to meet legal obligations. It is never used for our own marketing, never sold and never shared with anyone except the carrier delivering the parcel.
  • Marketplace data is stored and processed in Ireland (AWS eu-west-1, Dublin).
  • We will help the seller and the marketplace to access, correct or delete buyer data on request, within 7 days of the request.
  • When an integration or contract with a marketplace ends, we delete all customer data received from it within 30 days, except records we must keep by law, and confirm deletion on request.

7. Data Retention

  • Buyer contact and address details held in JMOS are deleted or anonymised 180 days after delivery, unless a return, claim or dispute is still open.
  • Shipping label files are deleted after 180 days.
  • Accounting records (invoice number, date, amount, VAT) are kept for 6 years, as Irish tax law requires.

8. Vulnerability and Threat Management

  • Security patches are applied as set out in section 3.
  • The JMOS database is checked with the hosting provider's security advisor at least monthly and after every schema change. Any critical finding is fixed within 7 days.
  • Software dependencies are kept to well-maintained libraries and are updated when security fixes are released.
  • Security notices from our providers (Supabase, Shopify, marketplaces, Microsoft) are monitored and acted on.

9. Incident Response Policy

Incident lead: Jason Penny, Director — sales@junglemug.com, +353 89 417 3064.

  1. Detect and report: anyone who suspects a security incident or data breach reports it to the incident lead immediately.
  2. Contain: revoke or rotate affected keys and passwords, disable affected accounts, and stop the affected integration if needed.
  3. Assess: work out what data, which people and which systems are affected.
  4. Notify:
    • Affected marketplace partners (e.g. TikTok Shop) and sellers: without undue delay, and within 24 hours of confirming an incident affecting their data.
    • The Data Protection Commission (Ireland): within 72 hours, where the breach is reportable under GDPR Article 33.
    • Affected individuals: without undue delay, where there is a high risk to them (GDPR Article 34).
  5. Recover and learn: fix the cause, record the incident in the incident log, and update this policy if needed.

10. Personal Data Protection (GDPR)

  • We process personal data lawfully, fairly and transparently. We use it for specified purposes only, keep it to the minimum needed, keep it accurate, keep it no longer than necessary, and keep it secure.
  • Our customer-facing Privacy Policy explains how customers can exercise their rights. Requests are answered within one month.
  • Jungle Mug Limited is a small company and is not required to appoint a Data Protection Officer under GDPR Article 37. Data protection matters are handled by the director at sales@junglemug.com.
  • This document and the Privacy Policy are reviewed at least every 12 months.