Data Security Policy

Effective Date: 01/01/2025
Last Updated: 07/02/2025

Bollard Inspection Services (“we,” “our,” or “the Company”) is committed to protecting the security, confidentiality, and integrity of all client information, inspection data, and supporting media collected during the course of business. This Data Security Policy outlines our current practices regarding the collection, storage, use, and safeguarding of both digital and physical data.

This policy applies to all employees, subcontractors, systems, and devices involved in the handling of inspection-related data, including but not limited to photographs, reports, and client communication.

1. Data Types We Handle

We collect and protect the following categories of data:

• Personally identifiable information (PII): names, phone numbers, email addresses, and property addresses

• Inspection data: photographs, reports, 3D scans, aerial drone images, thermal media, and condition notes

• Transactional records: inspection dates, property details, invoicing history, and authorized payment data

• Insurance industry information: where applicable, claims identifiers or carrier-specific portal fields

No credit card information is collected or stored directly. All transactions are handled securely by PCI-DSS compliant vendors such as Stripe and Square.

2. Data Collection, Storage, and Retention

Client data is collected through secure forms, vendor portals, and field uploads. We use a combination of local storage, cloud storage, and encrypted backups.

• Sensitive data is not stored locally beyond what is necessary for immediate delivery

• Reports are retained for 24 months

• Finance records are stored for 7 years in accordance with accounting and tax obligations

• Photos and videos may be retained indefinitely unless deletion is requested in writing

• Inspection photos and drone media are removed from field devices (including cameras and drones) within 12 hours, or as soon as project delivery allows

All data access is restricted to staff and subcontractors on a need-to-know basis. Contractors may upload data, but do not retain client access or authorization beyond the scope of the job.

3. Access Control and Device Protection

• Access to client data is password-protected using strong authentication protocols

• Devices are secured via biometric lock, PIN, or strong password and are locked when not in use

• Workstations and laptops are updated regularly and protected by antivirus and firewall tools

• Access to cloud-based systems is managed via account-level access controls and two-factor authentication
  
  

4. Data Transmission and Encryption

• Our website and booking systems use SSL/TLS encryption for all client communication

• Files and reports are delivered via email, client-facing portals, cloud sharing, or printed at client request

• No reports or personal information are sent in plain-text email without consent

• All payments are securely processed using Stripe or Square. We do not store or transmit payment card details.
  
  

5. Contractor and Vendor Handling

We minimize the data shared with contractors and vendors, providing only what is required to complete the job.
Our subcontractor agreements prohibit data reuse, sale, or external sharing.
While we cannot fully control individual contractor devices, we require and reinforce secure handling expectations through onboarding, signed agreements, and regular policy reminders.

6. Physical Security and Backup

• All hardware used for inspections is secured on-site or locked in vehicles when in transit

• Office workspace is locked outside of business hours

• All critical files are backed up both locally and to encrypted cloud environments

• External cold storage drives are used where warranted for archival purposes
  
  

7. Breach Response and Notification

We maintain an internal SOP for data breach response.
In the event of a breach or suspected unauthorized access, we will:

• Immediately investigate the incident

• Notify any affected individuals, clients, or partners

• Disclose the breach to legal or regulatory authorities if required

• Document all corrective actions taken
  
  

8. Client Rights and Requests

Clients may request:

• A summary of the data we hold on them

• Correction or deletion of outdated data

• Deletion of photos or videos unless retention is required for regulatory or legal purposes

Requests can be submitted via email to legal@bollardinspects.com.

9. Regulatory Compliance

This policy aligns with applicable federal and New Jersey state data privacy laws, including consumer protection laws and digital record retention guidelines.
We also align our practices with insurer expectations, ensuring that data integrity, transparency, and retention support industry documentation standards.

10. Contact

To request data access, report a concern, or inquire about data handling, please contact:
Email: legal@bollardinspects.com
Mailing Address: Bollard Inspection Services, 781 State Route 57, Port Murray, NJ 07865