1. Purpose and scope
HoneyNotify is committed to conducting business lawfully, honestly, fairly, and with appropriate respect for customers, recipients, personnel, suppliers, public authorities, and the communities affected by our work. This policy applies to people acting for HoneyNotify and informs the standards we expect from organisations in our supply chain.
Compliance is risk-based. The laws and contractual duties relevant to an activity depend on the countries involved, the people and data affected, the service being supplied, and the customer's use case. This policy does not claim that every law listed applies in every situation and does not replace a customer's independent legal assessment.
2. Governance and accountability
Responsibility for compliance remains with the relevant business owner and cannot be delegated away merely because a supplier or automated system is involved. Material legal, privacy, security, financial, sanctions, or ethical risks should be identified before a new service, market, supplier, or high-risk processing activity is approved.
HoneyNotify will maintain proportionate policies, contractual controls, access restrictions, records, and escalation routes. Decisions should be documented when the risk, legal effect, or potential impact warrants it. Suspected violations must be investigated fairly and remediated promptly, with specialist advice obtained where needed.
3. Data protection, privacy, and security
HoneyNotify will process personal information in accordance with applicable data-protection and electronic-communications requirements, including the UK GDPR, Data Protection Act 2018, and PECR where they apply. Our Privacy Notice explains our controller and processor roles, and our Cookie Policy explains browser storage.
Access should follow least-privilege principles. HoneyNotify supports scoped API keys, restricted public client keys, role-aware organisation access, MFA, audit records, encrypted provider credentials, signed webhooks, tenant-aware queries, retention controls, and controlled export and deletion workflows. These safeguards reduce risk but do not remove the need for secure customer implementation.
Personal information and confidential material must not be collected, accessed, disclosed, or retained merely because it may be useful. Security incidents and suspected unauthorised access must be escalated without delay so containment, investigation, notification assessment, and recovery can begin.
4. Responsible customer use
Customers control the purpose, audience, content, timing, and legal basis of messages sent through their accounts. They must obtain necessary permissions, honour opt-outs and platform choices, provide required notices, protect credentials, and avoid unlawful, deceptive, discriminatory, abusive, or harmful communications.
HoneyNotify may investigate, reject, throttle, quarantine, or suspend activity where reasonably necessary to protect recipients, providers, customers, shared infrastructure, or legal compliance. Provider acceptance is not proof of delivery, engagement, or legal permission to contact a recipient.
5. Business integrity
Bribery, fraud, and improper advantage
HoneyNotify prohibits bribery, facilitation payments, kickbacks, fraud, falsified records, and any offer or acceptance intended to secure an improper advantage. Gifts, hospitality, charitable contributions, sponsorships, and expenses must be reasonable, transparent, lawful, and never used to influence a decision improperly.
Conflicts of interest
Actual or potential conflicts between personal interests and HoneyNotify responsibilities must be disclosed and managed. No person should take part in a decision where an undisclosed relationship, investment, gift, or outside role could impair-or reasonably appear to impair-their judgement.
Sanctions, trade, and financial controls
HoneyNotify will not knowingly provide services, make payments, or enter arrangements prohibited by applicable sanctions, export controls, money-laundering rules, or other financial restrictions. Higher-risk parties, ownership structures, destinations, and payment patterns may require proportionate verification or refusal.
Fair competition and intellectual property
HoneyNotify competes fairly and does not seek confidential competitor information through improper means, coordinate prices or markets unlawfully, or make misleading claims. Software, content, brands, licences, open-source obligations, and third-party confidential information must be respected.
6. Suppliers and business partners
Supplier selection should consider capability, security, privacy, resilience, reputation, legal risk, labour standards, and value. The depth of due diligence and contractual protection should reflect the service and risk. Material concerns may require corrective action, additional assurance, restricted access, suspension, or termination.
Suppliers are expected to comply with applicable law, avoid bribery and exploitation, protect confidential and personal information, maintain safe working practices, and raise credible concerns. Our Modern Slavery Policy gives further detail on labour exploitation and supply-chain expectations.
7. Speaking up and reporting concerns
Anyone with a good-faith concern about unlawful conduct, security, privacy, fraud, bribery, sanctions, discrimination, harassment, exploitation, financial reporting, or retaliation should report it through the support or business contact available in the dashboard. Urgent threats to people or systems should be clearly identified.
Reports will be handled as confidentially as reasonably possible, investigated by an appropriate person, and shared only where needed to assess or address the concern. HoneyNotify prohibits retaliation against a person who raises a genuine concern or assists an investigation in good faith. Knowingly false reports may themselves be misconduct.
8. Training, records, monitoring, and review
People with relevant responsibilities should receive proportionate guidance or training. HoneyNotify may retain due-diligence, approval, incident, audit, investigation, and remediation records where necessary for accountability and legal obligations.
This policy will be reviewed as the business, services, risk profile, or law changes. A violation may result in access removal, disciplinary or contractual action, supplier remediation or termination, customer suspension, recovery of loss, or referral to an authority where appropriate.