Data Security and Data Cleansing Policy

RSL Copiers Ltd
Website: www.rslcopiers.co.uk
Policy Owner: Managing Director
Effective Date: 26 August 2026
Review Frequency: Annually

1. Purpose

RSL Copiers Ltd recognises that photocopiers, multifunction devices (MFDs), printers and associated equipment can contain sensitive business and personal information within internal hard drives, solid-state storage, memory and other storage media.

The purpose of this policy is to establish the principles and controls used by RSL Copiers to protect customer information and to ensure that data stored on equipment entrusted to us is handled securely throughout collection, storage, data cleansing, recycling, resale or disposal.

This policy applies to employees, contractors and other personnel involved in the collection, handling, storage, processing, cleansing, recycling or disposal of equipment containing customer data.

2. Scope

This policy applies to:

• Photocopiers and multifunction devices.
• Printers and other imaging equipment containing data storage.
• Internal hard disk drives and solid-state drives.
• Removable storage media where encountered.
• Equipment received through asset-recovery services.
• Equipment purchased directly from customers or businesses.
• Equipment held for resale, recycling or export.
• Customer and business information associated with equipment and services.
• Documentation and records relating to data-cleansing activities.

RSL Copiers provides nationwide asset-recovery services and equipment collected by its trained teams is stored in secure warehouses in Bedfordshire and Buckinghamshire.

3. Data Security Commitment

RSL Copiers is committed to protecting customer information against unauthorised access, disclosure, alteration, loss, misuse or destruction.

We will take reasonable and proportionate technical, physical and organisational measures to protect information throughout the equipment lifecycle. Our approach includes:

• Controlling access to customer equipment.
• Maintaining secure storage arrangements.
• Limiting access to authorised personnel.
• Handling equipment in a controlled manner.
• Using appropriate data-cleansing or destruction procedures.
• Maintaining appropriate records of data-cleansing activities.
• Providing certification where agreed with the customer.
• Reporting and investigating suspected security incidents.
• Continually reviewing our data-security practices.

4. Customer Responsibilities

Customers remain responsible for identifying equipment that may contain confidential, personal, financial, commercially sensitive or otherwise protected information.

Before equipment is collected, customers should, where appropriate:

• Identify devices containing storage media.
• Notify RSL Copiers of any specific security requirements.
• Provide relevant instructions concerning data stored on equipment.
• Identify any equipment requiring specific treatment.
• Maintain any necessary backups or records before data cleansing or destruction.

Where customers have particular regulatory, contractual or security requirements, these should be agreed with RSL Copiers before collection or processing.

5. Collection and Transportation

RSL Copiers operates its own UK vehicle fleet and dedicated transport team for collections and deliveries.

Equipment containing or potentially containing customer information will be handled responsibly during collection and transportation.

Reasonable measures will be taken to:

• Prevent unauthorised access to equipment.
• Minimise unnecessary handling.
• Maintain equipment securely during transportation.
• Ensure equipment is delivered to the appropriate RSL Copiers facility or agreed destination.
• Maintain appropriate records relating to collections where required.
• Escalate any suspected loss, damage or security incident.

Where particularly sensitive equipment is involved, additional arrangements may be agreed with the customer.

6. Secure Storage

Equipment received through asset recovery or other services may be held at RSL Copiers’ secure warehouse facilities. RSL Copiers operates secure warehousing in Bedfordshire and Buckinghamshire.

Access to stored equipment will be restricted to authorised personnel with a legitimate business requirement.

Where reasonably practicable, equipment awaiting data cleansing will be identifiable and managed so that its security status is understood before it is released for resale, recycling, export or other processing.

7. Identification of Storage Media

Where appropriate, equipment will be assessed to identify internal storage media capable of retaining customer information. This may include:

• Hard disk drives (HDDs).
• Solid-state drives (SSDs).
• Flash memory.
• Other internal or removable storage media.

The appropriate treatment will depend upon the equipment, storage technology, customer requirements and intended final disposition.

8. Data Cleansing

RSL Copiers provides data-cleansing services for used photocopiers and multifunction devices.

The objective of data cleansing is to ensure that information stored on equipment is removed or rendered inaccessible before the equipment is subsequently reused, sold, exported, recycled or otherwise released.

RSL Copiers uses dedicated data-cleansing equipment and can provide HDD cleansing certificates for individual machines where required.

Data cleansing will be undertaken by appropriately trained personnel using suitable procedures and equipment.

9. Data Destruction

Where equipment or storage media cannot appropriately be cleansed for reuse, or where a customer specifically requires physical destruction, the storage media will be subject to an appropriate destruction process where this service has been agreed.

The method selected will take account of:

• The type of storage media.
• The condition of the storage media.
• The customer’s requirements.
• The intended final disposition of the equipment.
• Applicable legal, contractual and security requirements.

RSL Copiers provides a certified data-destruction process and HDD certification.

10. Certification

Where agreed or requested, RSL Copiers can provide documentation confirming completion of a data-cleansing or destruction process.

Certification may identify relevant equipment or storage media and the service undertaken.

Records should be retained in accordance with RSL Copiers’ record-retention requirements and any applicable customer agreement.

Customers requiring certificates for individual machines should communicate this requirement before or during the asset-recovery process.

11. Reuse and Resale

RSL Copiers specialises in the purchase, preparation and resale of used photocopiers and multifunction devices.

No equipment should be released for resale, export or other onward use where RSL Copiers has identified that customer data remains present and requires cleansing or destruction.

Where equipment is suitable for reuse, data-cleansing should be completed in accordance with the agreed process before the equipment is released.

12. Recycling and End-of-Life Equipment

Where equipment is unsuitable for reuse, RSL Copiers may arrange appropriate recycling or disposal. RSL Copiers can dispose of used copiers in accordance with the WEEE Directive.

Where equipment contains storage media, reasonable steps will be taken to ensure that data-bearing components are appropriately treated before final recycling or disposal.

13. International Export

RSL Copiers exports used photocopiers and multifunction devices internationally.

Equipment will not be released for international export where RSL Copiers has been instructed to perform data cleansing or destruction and the agreed process has not been completed.

Customers with specific contractual, regulatory or geographic restrictions relating to equipment or data should notify RSL Copiers before export arrangements are finalised.

14. Access Controls

Access to customer information and equipment containing potentially sensitive information will be limited according to business need.

RSL Copiers will seek to ensure that:

• Personnel only access information required for their role.
• Security-sensitive activities are undertaken by authorised personnel.
• Confidential customer information is not unnecessarily disclosed.
• Access to physical equipment is appropriately controlled.
• Credentials and other security information are not shared unnecessarily.

15. Confidentiality

Employees and relevant contractors are expected to maintain the confidentiality of customer and business information obtained through their work.

Information relating to customers, equipment, stored data, data-cleansing activities and certificates must only be disclosed to authorised persons or where disclosure is required by law.

16. Data Protection

RSL Copiers recognises that information contained on customer equipment may constitute personal data under applicable UK data-protection legislation.

Where RSL Copiers processes personal data on behalf of a customer, the respective responsibilities of the parties will be determined by the nature of the service and applicable contractual arrangements.

Where required, appropriate data-processing terms will be agreed with the customer.

This policy should be read alongside RSL Copiers’ Privacy Policy.

17. Security Incidents

Any suspected loss, unauthorised access, accidental disclosure, theft, damage or other security incident involving customer information or data-bearing equipment must be reported to management as soon as reasonably practicable.

RSL Copiers will:

• Assess the incident.
• Take reasonable steps to contain and mitigate the issue.
• Preserve relevant information where appropriate.
• Investigate the circumstances.
• Notify affected customers where appropriate.
• Consider whether notification to a regulator or other authority is required.
• Implement corrective or preventative measures where appropriate.

Where an incident involves personal data, RSL Copiers will assess its obligations under applicable UK data-protection legislation.

18. Staff Training and Awareness

Personnel involved in the handling of customer equipment or information will be made aware of their data-security responsibilities.

Relevant personnel should understand:

• The importance of protecting customer information.
• The risks associated with copier and MFD storage media.
• The importance of following approved data-cleansing procedures.
• Physical-security requirements.
• Confidentiality requirements.
• Incident-reporting procedures.

Additional training will be provided where operational requirements make this appropriate.

19. Records and Audit Trail

Where appropriate, RSL Copiers will maintain records relating to:

• Equipment received for data cleansing.
• Identification of data-bearing equipment.
• Data-cleansing or destruction activities.
• Certificates issued.
• Equipment released following successful cleansing.
• Security incidents.
• Customer-specific instructions.

Records will be retained for an appropriate period having regard to contractual, legal, operational and evidential requirements.

20. Third-Party Service Providers

Where a third party is used in connection with data-bearing equipment or data destruction, RSL Copiers will take reasonable steps to ensure that the provider is suitable for the service and operates appropriate security arrangements.

Where required, contractual arrangements will establish appropriate confidentiality, data-protection and security obligations.

21. Continuous Improvement

RSL Copiers is committed to reviewing and improving its data-security and data-cleansing practices. We will consider:

• Changes in technology.
• Changes in storage technology.
• Emerging security risks.
• Customer requirements.
• Relevant legal and regulatory developments.
• Industry good practice.
• Lessons identified from incidents or operational reviews.

22. Policy Compliance

Failure by an employee or contractor to follow this policy may result in appropriate management action.

Any deliberate or negligent misuse, disclosure, destruction or unauthorised access to customer information or equipment may be investigated and dealt with in accordance with applicable company procedures.

23. Related Policies

This policy should be read alongside, where applicable:

• Privacy Policy.
• Cookie Policy.
• Environmental Policy.
• Information Security procedures.
• Data Protection procedures.
• Asset Recovery procedures.
• Waste and Recycling procedures.
• Incident Management procedures.

24. Contact

For questions concerning data security, data cleansing or the handling of equipment containing customer information, please contact:

RSL Copiers’ published contact details are available on its website.

25. Policy Review

This policy will be reviewed at least annually and whenever there are significant changes to:

• Data-cleansing technology or procedures.
• The services provided by RSL Copiers.
• Applicable UK legislation or regulatory requirements.
• Customer contractual requirements.
• Security risks or operational processes.

Approved by: Managing Director, RSL Copiers Ltd
Effective date: 26 August 2026
Next review: August 2027