META Channel Corporation Limited is a Praxis House for regulatory, legal and technological execution. Our work demands that the information systems supporting our operations, and the data of our clients, partners and associated institutions, be managed with the utmost rigour. This policy sets out the principles, reference frameworks and commitments that govern information security at META Channel Corporation Limited.
As an organisation that advises on and delivers regulatory compliance projects within the European regulatory framework, we apply internally the same standards that we require of, and help implement for, our clients. Consistency between what we deliver for others and what we practise in-house is not optional: it is the basis of our credibility.
1. Regulatory reference frameworks
Information security management at META Channel Corporation Limited is aligned with the following regulatory frameworks and international standards:
| GDPR (EU) 2016/679 | The core framework for the protection of personal data. It sets out technical and organisational security obligations under Articles 25 (data protection by design) and 32 (security of processing). |
| NIS2 (EU) 2022/2555 | Directive on cybersecurity across the European Union. META Channel Corporation Limited adopts its risk-management principles as an operational reference framework and as a basis for supporting the clients we assist with compliance. |
| DORA (EU) 2022/2554 | Regulation on digital operational resilience for the financial sector. Directly applicable to many META Channel Corporation Limited clients in the fintech, tokenisation and litigation finance sectors. We adopt its principles as an internal reference and implementation model. |
| ISO/IEC 27001:2022 | International standard for Information Security Management Systems (ISMS). A reference framework for identifying assets, assessing risks, implementing controls and continual improvement. |
| AI Act (EU) 2024/1689 | European regulatory framework for artificial intelligence systems. META Channel Corporation Limited manages its AI systems and tools in line with the principles of transparency, human oversight and risk minimisation, anticipating the requirements that apply to its clients. |
| LOPDGDD (Organic Law 3/2018) | Spanish legislation supplementing the GDPR (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights). Applies to processing carried out from Spain, including META Channel Corporation Limited’s operations in Tenerife and Madrid. |
| Data Protection Act 2018 (IE) | The data protection framework of the Republic of Ireland. Applies to META Channel Corporation Limited as a company incorporated in Ireland under the Companies Act 2014. |
2. Core security principles
| Confidentiality | Only authorised personnel have access to the data and information of META Channel Corporation Limited, its clients and partners. Access is managed through role-based controls and the principle of least privilege. All staff and partners with access to systems are bound by a duty of confidentiality of indefinite duration. |
| Integrity | The data and information managed by META Channel Corporation Limited are kept accurate, complete and consistent. Controls are in place to detect and correct unauthorised changes to documents, case files and management systems. |
| Availability | The systems and information critical to META Channel Corporation Limited’s operations are available to authorised personnel when needed. Contingency plans and incident recovery procedures are maintained. |
| Data protection by design and by default | In accordance with Article 25 GDPR, the protection of personal data is built into the design of every new process, system or product. The default settings of all systems ensure the highest level of privacy without any action required from the data subject. |
| Operational resilience | META Channel Corporation Limited manages its technology dependencies with resilience in mind: identifying critical assets, assessing technology providers, maintaining continuity plans and ensuring the ability to recover from disruptions or cyber incidents. |
| Accountability | In accordance with Article 5(2) GDPR, META Channel Corporation Limited not only complies with its security obligations but is able to demonstrate that compliance at any time. Documentation, records and internal procedures provide the evidence of that commitment. |
| Continual improvement | META Channel Corporation Limited regularly reviews the effectiveness of its controls, updates its procedures in response to regulatory or technological change, and applies the lessons learned from incidents and review exercises. |
| Proportionality | Security controls are implemented in proportion to the actual risk of each processing operation and asset. Neither too many nor too few measures are acceptable: security must be appropriate, effective and operationally sustainable. |
3. Technical and organisational measures
META Channel Corporation Limited applies the following measures in accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope and purposes of processing:
Encryption and secure communications
- Encryption in transit using TLS 1.2/1.3 for all web communications (HTTPS).
- Encryption at rest on storage systems where personal data is processed.
- Internal communications over encrypted channels. Transmission of sensitive data over unencrypted channels is prohibited.
Access control and authentication
- Mandatory two-factor authentication (2FA) for access to systems containing personal data.
- Principle of least privilege: each user has access only to the data needed for their role.
- Regular review of permissions, and immediate revocation of access when a role changes or a working relationship ends.
Management of suppliers and processors
- Data processing agreements (Article 28 GDPR) in place with all providers that have access to personal data.
- Prior assessment of technology providers in terms of security and regulatory compliance.
- International transfers covered by appropriate mechanisms in accordance with Chapter V GDPR.
Incident and breach management
- Internal personal data breach response protocol, activated within the first 4 hours.
- Notification to the DPC (Ireland) and/or the AEPD (Spain) within a maximum of 72 hours, where required.
- Internal register of all incidents, whether notifiable or not, in accordance with Article 33(5) GDPR.
- Documented procedure for informing affected data subjects where the risk is high.
Continuity and resilience
- Regular backups of critical systems and data, with integrity checks.
- Recovery procedures for technology failures and cyber incidents.
- Assessment of critical technology dependencies and contingency plans in case providers become unavailable.
Training and awareness
- All staff and partners with access to systems are informed of their information security obligations.
- Regular updates on relevant threats and cybersecurity good practice.
- A contractually formalised duty of confidentiality of indefinite duration.
4. Impact assessments and risk analysis
META Channel Corporation Limited carries out Data Protection Impact Assessments (DPIAs) in accordance with Article 35 GDPR for processing likely to result in a high risk to the rights and freedoms of data subjects. Risk analysis takes place before any new processing begins or any existing processing is substantially changed.
The risk analysis methodology is based on the criteria of the European Data Protection Board (EDPB) and on the principles of ISO/IEC 27005 for information security risk management. The results of each assessment are documented and retained as part of META Channel Corporation Limited’s accountability framework.
5. Regulatory consistency: we practise what we deliver
META Channel Corporation Limited advises on and delivers compliance projects under the most demanding European regulatory frameworks: GDPR, NIS2, DORA, the AI Act, MiCA and the cybersecurity frameworks of the ENS (Esquema Nacional de Seguridad, Spain’s National Security Framework). Our credibility as a Praxis House for regulatory execution rests on a premise that admits no exceptions: we rigorously apply internally the same standards we help our clients achieve.
This means that when a client entrusts us with a NIS2 compliance project or the implementation of a DORA framework, they do so in the knowledge that the team delivering it already works to those principles. We do not sell compliance we do not practise. This consistency is in itself a guarantee for our clients and institutional partners.
6. Review, updates and contact
This policy is reviewed at least once a year and whenever there is a relevant regulatory change, a significant incident or a substantial change to META Channel Corporation Limited’s systems or processing operations. The version in force is always the one published at metachannelcorp.com/en/security-policy/.
For any questions about this policy, or to report a security vulnerability or incident: privacidad@metachannelcorp.com
Competent supervisory authorities: Data Protection Commission (DPC) — Ireland · Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency)
