Incident Management Policy

1. Purpose

This policy defines how Atine Labs™ Limited identifies, classifies, responds to, and learns from security and service incidents — including personal data breaches.

2. Incident Classification

P1 — Critical: Complete service outage, data breach, ransomware, or compromised credentials with confirmed impact.
P2 — High: Significant service degradation, suspected unauthorised access, or potential data exposure.
P3 — Medium: Partial feature unavailability, unusual activity requiring investigation.
P4 — Low: Cosmetic issues, minor performance degradation, informational alerts.

3. Response Timelines

P1: initial response within 15 minutes; client notification within 30 minutes
P2: initial response within 1 hour; client notification within 2 hours
P3: initial response within 4 hours
P4: resolution within next business day

4. Personal Data Breach Procedures

Confirmed personal data breaches are assessed for notification obligations under GDPR (72-hour supervisory authority notification) and Uganda PDPO. Affected data subjects are notified without undue delay where the breach poses a high risk to their rights and freedoms.

5. Post-Incident Review

All P1 and P2 incidents are subject to a post-incident review within 5 business days. Findings, root cause analysis, and remediation actions are documented and shared with affected clients.

6. Incident Register