Access Control Policy

 

 

1. Introduction

Lovinas Concept Limited (“Lovinas,” “we,” “us,” or “our”) is committed to protecting the security and integrity of our website, systems, and customer data. This Access Control Policy establishes the rules and procedures for managing access to our website, internal systems, and digital assets. It applies to all employees, contractors, and authorized users who interact with Lovinas’ digital infrastructure.

The purpose of this policy is to ensure that only authorized personnel can access the information and resources necessary for their job functions, thereby safeguarding customer privacy, preventing unauthorized data breaches, and maintaining the operational stability of our services.

 

2. Scope and Definitions

This policy applies to all systems and data related to the Lovinas Concept Limited website, including but not limited to:

  • Website Backend: The administrative interface, content management system (CMS), and e-commerce platform.
  • Customer Database: All user information, order history, and personal data.
  • Internal Systems: Any other digital tools or platforms used by Lovinas staff for operations.

Key Definitions:

  • User: Any individual who is granted access to Lovinas’ systems.
  • Role: A defined set of permissions and privileges assigned to a user, such as “Administrator,” “Content Creator,” or “Customer Service.”
  • Access Control: The process of granting or denying specific requests to access a system or data.
  • Principle of Least Privilege: Granting users only the minimum level of access required to perform their job duties.

 

3. User Roles and Responsibilities

Access to Lovinas’ systems will be granted based on the “Principle of Least Privilege.” Users will be assigned a specific role, and their access will be limited to the functions and data necessary for that role.

Examples of Roles:

  • System Administrator: Full access to all website functions, including settings, user management, and data. Responsible for system maintenance and security.
  • Content Creator/Marketing: Access to create, edit, and publish blog posts, product descriptions, and promotional content. No access to customer data or financial information.
  • Customer Service Representative: Access to view customer order history and contact information to assist with inquiries. No access to financial data, system settings, or the ability to delete user accounts.
  • Order Fulfillment/Logistics: Access to view order details, shipping addresses, and inventory levels. No access to sensitive customer data or website settings.

All users are responsible for the security of their login credentials. Passwords must be kept confidential and never shared.

 

4. Access Granting and Termination Procedures

Granting Access:

  1. Authorization: A user’s access request must be formally approved by a department head or a senior manager.
  2. Role Assignment: The System Administrator will assign the user a role based on their job responsibilities, ensuring the Principle of Least Privilege is applied.
  3. Credential Creation: The user will be provided with a unique username and a temporary password that they must change upon their first login.

Terminating Access:

  1. Immediate Termination: Upon an employee’s separation from the company, their access to all Lovinas systems must be terminated immediately.
  2. Deactivation: The System Administrator is responsible for deactivating the user account and revoking all access permissions.

 

5. Password Policy

All users with access to Lovinas’ systems must adhere to the following password rules:

  • Complexity: Passwords must be at least 12 characters long and include a combination of uppercase letters, lowercase letters, numbers, and special characters.
  • Uniqueness: Passwords must not be reused across different systems.
  • Expiration: Passwords will expire every 90 days and users will be required to change them.
  • Confidentiality: Passwords must never be written down or shared with anyone.

 

6. Data Access and Handling

  • Confidentiality: All customer data, including names, addresses, phone numbers, and order history, is considered confidential and must not be disclosed to unauthorized individuals.
  • Data Minimization: Users should only access the customer data necessary to perform their specific tasks. For example, a Content Creator has no need to view a customer’s address.
  • Prohibited Actions: No user, including administrators, is permitted to copy, download, or transfer customer data to an external device or service without explicit authorization.

 

7. Monitoring and Enforcement

Lovinas Concept Limited will implement monitoring tools to track and log all user activities on its backend systems. This includes logging login attempts, data access, and any changes made to the website.

  • Audits: Regular audits will be conducted to ensure that user access privileges are up-to-date and comply with this policy.
  • Policy Violation: Any violation of this policy may result in disciplinary action, up to and including termination of employment or contract. Unauthorized access or data breaches may also lead to legal action.

 

8. Policy Review

This Access Control Policy will be reviewed and updated annually, or as needed, to ensure it remains relevant and effective in addressing evolving security threats and changes in our business operations.

 

9. Contact Information

For questions or concerns about this policy, please contact our support team at:

Email: lovinasconcept@gmail.com

Phone: ‪08169414229, 08103539177

Address: Road 1 Ikota Shopping Complex, VGC Ajah, Lekki Lagos