Acceptable Use Policy

1. Who this policy applies to

This Acceptable Use Policy applies to every employee, contractor, temporary worker and consultant of Yoke ("the Company") who is given an account on Yoke Platform ("the Platform").

You are being asked to accept it because you have been given an account. If you do not accept it, you will not be able to use the Platform.

2. How this fits with your other obligations

This policy adds to your contract of employment or engagement, the staff handbook, and the Company's information security, data protection and regulatory compliance policies. It does not replace or reduce any of them. Where this policy and one of those documents genuinely conflict, the other document takes precedence and you should raise the conflict with your line manager.

3. Your account

• Your account is personal to you. Do not share your password, your one-time codes, or any part of your sign-in with anybody — including colleagues, managers and IT staff.
• Do not let anyone else work under your account, and do not work under anybody else's. Everything done in the Platform is recorded against the account that did it, and that record is relied on.
• Choose a password you do not use anywhere else, and keep it in the Company's approved password manager rather than written down or in a file.
• Lock your screen when you step away, and use the Platform only on devices the Company permits for work.
• If you think your account or your device has been compromised, report it immediately — see section 8.

4. What you may use the Platform for

The Platform is for the Company's business and for nothing else. In particular:

• Open a firm, case, review, client or contact record only where you have a genuine business reason to. Having permission to open a record is not the same as having a reason to. Curiosity about a client, a colleague's work, or somebody you know personally is not a reason.
• Record work accurately and promptly. Case and review statuses, time entries, notes and checklists are used to run the business, to bill for it, and to evidence what was done and when — including to the Company's clients and, where relevant, to a regulator.
• Do not record anything in a note, a document or a comment that you would not be comfortable defending later. Notes are permanent, attributed, and may be disclosed in a complaint, an audit, or a subject access request.

5. Client data and confidentiality

Almost everything in the Platform is confidential: it belongs to the Company's client firms, and much of it is personal data about their advisers and their advisers' own clients. Treat all of it as confidential unless you are certain otherwise.

• Do not copy data out of the Platform to personal devices, personal email, personal cloud storage, personal messaging apps, or removable media.
• Do not paste client or personal data into third-party tools — including generative AI assistants, translation sites and file converters — unless the tool is on the Company's approved list for that purpose.
• Do not take screenshots or photographs of Platform screens containing personal data except where you need them for a specific work purpose, and delete them as soon as that purpose is met.
• Share documents and links only with people who are entitled to see them. A link is not access control.
• Handle personal data in line with UK GDPR and the Data Protection Act 2018: collect only what is needed, keep it accurate, and do not keep it longer than the Company's retention schedule allows.

6. Monitoring and audit

You should use the Platform on the basis that your use of it is recorded. Specifically, the Platform keeps:

• a history of changes to records — what changed, from what to what, when, and which account made the change;
• sign-in records, including the time and the IP address you signed in from, and failed sign-in attempts;
• the notes, comments, time entries and documents you create, attributed to you.

The Company uses these records to keep the Platform secure, to investigate suspected misuse or a suspected data breach, to answer client queries and complaints, to meet its regulatory and contractual obligations, and to evidence the work it has done. It does not use them to monitor productivity on a keystroke or minute-by-minute basis.

This monitoring is carried out on the basis of the Company's legitimate interests in securing its systems and meeting its obligations, and, where applicable, its legal obligations. How the Company handles personal data about you is set out in the Privacy Notice and in the staff privacy notice issued with your contract.

7. What you must not do

• Attempt to reach records, firms or pages your account is not permitted to open, including by editing an address in the browser.
• Attempt to circumvent, disable or test the Platform's permissions, authentication or audit logging, unless you are expressly authorised to do so as part of a security test.
• Connect unapproved software, scripts, browser extensions or automations to the Platform, or extract data from it in bulk.
• Use the Platform to store personal or private material unrelated to your work.
• Use the Platform for anything unlawful, or to harass, bully or defame anyone. Notes and comments are attributed and permanent.
• Alter or delete a record to conceal a mistake. Correct it, and say what happened — the change history will show the correction either way, and a concealed error is treated far more seriously than the error itself.

8. Reporting problems

Report the following to [SECURITY CONTACT EMAIL] and to your line manager immediately, and in any event within 24 hours of becoming aware of them:

• a lost or stolen device that can reach the Platform;
• a password or one-time code that has been shared, guessed or phished;
• data sent to, or seen by, someone who should not have had it — including by mistake;
• anything that looks like unauthorised access to the Platform;
• a record you can open that you believe you should not be able to.

The Company may have as little as 72 hours to report a personal data breach to the Information Commissioner's Office, and that clock starts when the Company becomes aware of it. Reporting quickly and being wrong is always better than waiting to be sure. Nobody will be penalised for raising a concern in good faith.

9. Changing role, and leaving

Your access reflects your role and will be changed when your role changes. When you leave the Company, or when your engagement ends, your account will be locked and your access removed.

Everything you created in the Platform in the course of your work belongs to the Company and stays in the Platform. You must not copy or remove it, and you must delete any local copies you hold. Your obligations of confidentiality continue after you leave.

10. If this policy is breached

Breaching this policy may lead to your access being suspended and to action under the Company's disciplinary procedure, up to and including dismissal. A serious breach may also be a criminal offence — for example under the Computer Misuse Act 1990 or section 170 of the Data Protection Act 2018 — and may be reported to the police or to a regulator.

11. Changes to this policy

The Company may update this policy. When it does, the version number changes and you will be asked to read and accept the new version the next time you use the Platform. Your acceptance of each version is recorded, with the date and time.

Questions about this policy should go to [CONTACT EMAIL].