Univerza Company Master Policy

1. Purpose

This policy establishes the principles, minimum requirements, and shared responsibilities that every Univerza business unit, person, product, and system must follow. Its purpose is to support ethical and accountable operations, protect people and information, use data responsibly, manage risk, maintain resilient services, and produce evidence of compliance.

This document serves as the company master policy that connects the policies, standards, procedures, and product-specific annexes across Univerza. It does not replace the detailed requirements in subject-specific documents.

2. Scope and Applicability

This policy applies to:

• Directors, executives, employees, temporary staff, interns, and all other Univerza personnel.
• Contractors, advisers, service providers, processors, and other third parties with access to Univerza systems, information, or premises.
• Every Univerza-owned, controlled, developed, or commissioned business unit, project, product, application, website, API, internal system, infrastructure component, and cloud service.
• All information that Univerza creates, receives, stores, uses, discloses, transfers, backs up, or disposes of, in digital or physical form.

Stricter legal, regulatory, contractual, or customer obligations continue to apply.

3. Company Principles

Univerza decisions and operations shall follow these principles:

1. Act lawfully and accountably: Follow applicable laws, contracts, policies, and approval authorities, and remain accountable for decisions and outcomes.
2. Make risk-informed decisions: Identify, assess, treat, and monitor risk before making or changing decisions with material impact.
3. Protect people and information: Respect the rights, privacy, and legitimate expectations of users, customers, personnel, and partners.
4. Build in security and privacy: Treat security and privacy as requirements from the start of design, development, and operation rather than as later corrections.
5. Use data purposefully and proportionately: Use data for clear purposes, limit it to what is needed, maintain quality and ownership, and retain it no longer than necessary.
6. Be transparent and auditable: Maintain searchable evidence of material approvals, changes, incidents, exceptions, and decisions.
7. Separate duties appropriately: Separate proposal, review, and approval responsibilities for material-risk activities to reduce error, misuse, and conflicts of interest.
8. Maintain service resilience: Apply appropriate backup, incident response, business continuity, and recovery capabilities to critical services.
9. Improve continuously: Use complaints, incidents, assurance findings, measures, and operational lessons to improve controls and ways of working.

4. Governance Document Hierarchy

Univerza governance documents apply in this order:

1. Laws, regulatory directions, contracts, and binding external obligations.
2. Governance frameworks and corporate charters.
3. This Company Master Policy.
4. Subject-specific policies, including Privacy, Security, Data Governance, Risk, and Compliance policies.
5. Standards, procedures, guidelines, plans, and templates.
6. Product Annexes and application- or service-specific requirements.
7. Records, registers, logs, reports, and operational evidence.

Where requirements conflict, the requirement issued under higher authority or providing stronger protection shall apply. The matter shall be escalated to the Document Owner and the relevant Legal, Risk, Privacy, or Security function. No corporate control may be reduced without an approved exception.

5. Company Minimum Requirements

5.1 Governance and Decision-making

• Material activities shall have a clear owner, approval authority, decision scope, and traceable approval evidence.
• Conflicts of interest shall be managed, duties appropriately separated, and matters exceeding delegated authority escalated.
• Governance documents shall identify their code, version, status, owner, approver, effective date, and review cycle.

5.2 People and Acceptable Use

• Personnel and contractors shall use company systems, information, accounts, and devices only for authorized purposes.
• Access shall be based on job need, reviewed periodically, and removed when no longer required.
• Relevant parties shall receive role-appropriate communication or training and promptly report suspected incidents, breaches, or risks.

5.3 Privacy and Personal Data

• Personal data collection, use, disclosure, and transfer shall have a clear purpose, lawful basis, and appropriate notice.
• Personal data shall be limited to what is needed, individual rights supported, and personal data breaches handled through the approved procedure.
• Changes that may create high risk to individuals shall undergo a Privacy Impact Assessment before production use.

5.4 Information Security

• Systems shall apply authentication, access control, encryption, logging, vulnerability management, and backup controls proportionate to risk.
• Software development shall include appropriate review, approval, testing, and environment separation.
• Security incidents shall be classified, contained, communicated, evidenced, resolved, and reviewed for lessons learned.

5.5 Data Governance

• Material datasets shall have a Data Owner or Data Steward, a classification, and defined access, sharing, quality, and retention requirements.
• Data imports, exports, analytics, reporting, and AI use shall have a clear purpose, accountable owner, quality checks, and use restrictions.
• Data that is no longer needed shall be securely disposed of, anonymized, or retained under a documented and approved justification.

5.6 Products, Applications, and Services

• Every application shall have an owner, defined service scope and intended users, and an inventory of relevant systems, data, and external providers.
• Applicable company documents shall be identified, a Product Annex created where specific requirements are needed, and current Risk Registers, Data Flows, and Control Mappings maintained.
• Material changes shall receive risk-appropriate Product, Security, Privacy, Data, Legal, and Operations review before release.

5.7 Service Providers and Third Parties

• Suitability, risk, security, privacy, resilience, and contract terms shall be assessed before onboarding.
• Contracts shall address responsibilities, data use and return, incident notification, audit rights, subprocessors, and exit obligations as appropriate.
• Service owners shall monitor provider performance, risk, and material change throughout the relationship.

5.8 Risk, Compliance, and Assurance

• Material risks shall have an owner, treatment plan, due date, status, and documented residual-risk acceptance.
• Applicable laws, contracts, standards, and commitments shall be monitored and translated into practical responsibilities and controls.
• Univerza may review systems, processes, and evidence to confirm compliance. Scope owners shall remediate findings according to risk.

6. Roles and Responsibilities

• Board / CEO: Approves this policy, sets direction, and oversees high-impact risks and exceptions.
• Executive Owner: Owns the master policy, coordinates adoption, and reports material matters to the appropriate governing authority.
• Governance Lead: Maintains the document register, hierarchy, versions, reviews, communications, and relationships between governance documents.
• Legal, Risk & Compliance, Privacy / DPO, Information Security, and Internal Audit: Translate obligations into requirements, advise, challenge, review, and escalate risk within their mandates.
• Product, Application, System, Service, and Data Owners: Identify applicable requirements, implement controls, maintain evidence, and review adequacy within their scope.
• People Managers: Ensure personnel understand their responsibilities, maintain role-appropriate access, and address non-compliance.
• Personnel, contractors, and third parties: Follow requirements, use resources appropriately, protect information, and report incidents or concerns in good faith.

7. Application and Product Adoption

Each Application or Product Owner shall, at a minimum:

1. Register the application and assign accountable owners.
2. Identify in-scope information, systems, repositories, infrastructure, and service providers.
3. Select the applicable company policies and standards.
4. Create a Product Annex for specific requirements. An annex may strengthen but shall not unilaterally weaken corporate controls.
5. Record relevant risks, data flows, privacy and security assessments, and control mappings.
6. Retain traceable evidence of approval, testing, release, monitoring, and remediation.

8. Exceptions and Risk Acceptance

Where a requirement cannot be met, the scope owner shall request an exception under UNI-GOV-007 before proceeding, or as soon as practicable in an emergency. The request shall identify:

• The requirement and scope affected.
• The rationale, impact, and residual risk.
• Compensating controls.
• The risk owner, approver, start date, and expiry date.
• The plan to return to compliance and the monitoring approach.

An exception does not amend this policy and shall be reviewed before expiry.

9. Monitoring and Minimum Evidence

Each business unit shall retain evidence proportionate to its risks and obligations, including:

• Approval, decision, and change records.
• Relevant Application, System, Data, Vendor, Risk, and Exception registers.
• Access assignment and review, training, and acknowledgement evidence.
• Assessment, testing, monitoring, audit, and remediation results.
• Incident, notification, response, and lessons-learned records.

Evidence shall be accurate, attributable to an owner and time period, retained as required, and protected from unauthorized access or alteration.

10. Reporting and Non-compliance

Anyone who identifies a suspected breach, incident, or control weakness shall promptly report it through an approved company channel. Univerza shall assess impact, contain harm, preserve evidence, notify relevant parties, and track remediation according to risk.

Non-compliance may result in access restriction, disciplinary action, contract review, recovery of loss, or legal action, considering the facts, severity, intent, and applicable law. A person who reports a concern in good faith shall not be retaliated against.

11. Approval, Communication, and Review

• An effective version requires Board / CEO approval and an assigned Effective Date.
• The Governance Lead shall communicate the policy and define role- and risk-appropriate training or acknowledgement.
• The policy shall be reviewed at least annually and after material legal, contractual, organizational, strategic, product, system, data, vendor, or risk change.
• Amendments shall follow version control, impact review, and approval requirements under UNI-GOV-005.

12. Related Documents

• UNI-GOV-001 — Univerza Trust, Data Governance & Security Framework
• UNI-GOV-002 — Corporate Governance Charter
• UNI-GOV-003 — Roles, Responsibilities and RACI Matrix
• UNI-GOV-004 — Delegation of Authority
• UNI-GOV-005 — Policy Governance and Document Control Policy
• UNI-GOV-006 — Product Governance and Product Annex Standard
• UNI-GOV-007 — Policy Exception and Risk Acceptance Procedure
• All policies, standards, procedures, plans, templates, and Product Annexes listed in the Univerza Governance Master Document Register

13. Production Readiness Gate

• ☐ The Executive Owner has verified completeness and alignment with actual operations.
• ☐ Governance, Legal, Risk, Privacy, Security, Data, and Product Owners have reviewed the relevant sections.
• ☐ The Board / CEO has approved the policy and assigned an Effective Date.
• ☐ Owners and adoption plans have been assigned for affected business units and applications.
• ☐ Communication, training, acknowledgement, and supporting evidence are ready.
• ☐ approval_status=approved, target_environment=production, and production_eligible=true.