Privacy Policy

1. Purpose
   The purpose of this policy is to establish clear rules for providing public access to the
   building’s Wi-Fi network. It aims to provide visitors, customers, event attendees,
   contractors and other authorised users with convenient internet access while protecting
   the organisation’s IT systems, data, network infrastructure and users.
   Public Wi-Fi must be managed in a way that supports the safe and effective operation of
   the building without compromising business operations, safeguarding arrangements,
   information security or the delivery of events.
2. Scope
   This policy applies to all public or guest Wi-Fi services provided within the building and
   to all individuals accessing those services, including:
    Members of the public and visitors.
    Event attendees and customers.
    Students, where access is authorised.
    Contractors, suppliers and external service providers.
    External event organisers and their representatives.
    Staff using a public guest network where applicable.
   This policy applies to wireless internet access provided by the organisation or by a third-
   party service provider acting on its behalf.
   The public Wi-Fi network must not be treated as an extension of the organisation’s
   internal business network.
3. Policy Statement
4. The organisation may provide public Wi-Fi access as a convenience to visitors and
5. customers, subject to appropriate technical controls and operational requirements.
6. Public Wi-Fi access is provided on a reasonable-efforts basis and may be restricted,
7. suspended or withdrawn where necessary to protect network security, maintain service
8. availability, comply with legal requirements or support the safe operation of the
9. premises.
10. Access to public Wi-Fi does not give users permission to access internal systems,
11. confidential information, staff networks, CCTV systems, building management systems,
12. payment systems or other restricted resources.
13. All users are expected to use the service lawfully, responsibly and respectfully.
14. 4. Responsibilities
15. 4.1 Senior Management
16. Senior Management is responsible for approving this policy and ensuring that suitable
17. arrangements are in place for the provision and oversight of public Wi-Fi.
18. 4.2 Buildings and Operations Manager
19. The Buildings and Operations Manager is responsible for coordinating the operational
20. arrangements for public Wi-Fi within the premises, including:
21.  Ensuring that this policy is implemented.
22.  Liaising with the IT team or external service provider.
23.  Reporting faults, suspected misuse and security concerns.
24.  Ensuring that public Wi-Fi arrangements do not interfere with event operations,
25. emergency arrangements or other essential building services.
26.  Arranging for access to be restricted or suspended when reasonably necessary.
27. 4.3 IT Team or External Service Provider
28. The responsible IT team or service provider must implement and maintain appropriate
29. technical safeguards, including:
30.  Separating the public Wi-Fi network from internal business systems.
31.  Applying suitable access controls and security configurations.
32.  Maintaining and updating network equipment and firmware.
33.  Monitoring network performance and security events where appropriate and
34. lawful.

 Investigating reported faults and suspected misuse.
 Maintaining appropriate arrangements for incident response and service
recovery.
4.4 Users
Users are responsible for ensuring that their use of the public Wi-Fi network complies
with this policy and applicable law.
Users must protect their own devices and information and must not attempt to bypass
security controls or interfere with the service.
5. Network Security Requirements
The public Wi-Fi network must be configured and managed to reduce the risk of
unauthorised access to the organisation’s systems.
As a minimum, the organisation should ensure that:

1. Network separation: Public Wi-Fi is logically or physically separated from
   internal corporate, operational and other restricted networks.
2. Access controls: Users cannot access internal systems or other users’ devices
   through the guest network unless explicitly authorised for a legitimate purpose.
3. Secure administration: Network administration interfaces and credentials are
   restricted to authorised personnel.
4. Appropriate encryption: Wireless security is configured using suitable,
   supported security standards.
5. Updates: Network equipment and software are kept appropriately updated.
6. Capacity management: The service is configured, where practicable, to prevent
   excessive use by individual devices from significantly affecting other users or
   essential business operations.
7. Monitoring: Security and performance monitoring is proportionate, documented
   and carried out in accordance with applicable privacy and data protection
   requirements.
8. Third-party access: Any external provider responsible for the service must be
   subject to appropriate contractual and security arrangements.
   The public Wi-Fi network must not be used to provide access to sensitive business
   systems, payment card systems, CCTV, access control or building management
   systems.
9. Acceptable Use
   Users may use the public Wi-Fi service for lawful activities, including general internet
   browsing, email, messaging, online information services and other reasonable personal
   or business purposes.
   Users must not use the service to:
    Commit, facilitate or encourage unlawful activity.
    Access, download, store or distribute illegal content.
    Harass, threaten, abuse or intimidate another person.
    Access or distribute content that is unlawful or that breaches the organisation’s
   rules for the premises.
    Attempt to gain unauthorised access to any computer, network, account or
   information system.
    Intercept, monitor or interfere with another user’s communications.
    Distribute malware, viruses, ransomware or other malicious software.
    Conduct unauthorised vulnerability scanning, penetration testing or other security
   testing.
    Attempt to disrupt, overload or disable the Wi-Fi service or any connected
   system.
    Send spam, fraudulent messages or phishing communications.
    Circumvent access restrictions or technical security measures.
    Use the service in a way that compromises the safety, security or effective
   operation of the premises.
   Users must respect the rights, privacy and security of others when using the service.
10. User Device Security
    Users are responsible for the security of their own devices when connecting to public
    Wi-Fi.
    Users are advised to:
     Keep their devices, operating systems and applications updated.
     Use reputable security software where appropriate.

 Use secure websites and applications, particularly when entering passwords or
personal information.
 Use a trusted VPN where appropriate for additional protection.
 Disable file sharing and unnecessary network discovery.
 Avoid saving sensitive information on shared or publicly accessible devices.
 Disconnect from the network when access is no longer required.
The organisation cannot guarantee that the public Wi-Fi service will be uninterrupted or
that all internet traffic will be free from security risks. Users should not assume that
public Wi-Fi is suitable for transmitting highly sensitive information.
8. Access, Registration and Usage Restrictions
The organisation may require users to accept terms of use or complete a guest access
process before connecting.
Where technically available and appropriate, the service may apply reasonable
restrictions, including:
 Limits on connection duration or bandwidth.
 Restrictions on the number of devices connected by an individual user.
 Restrictions on certain categories of traffic where necessary for security, legal
compliance or service performance.
 Temporary access controls during events or periods of high demand.
 Suspension of access where misuse is suspected.
Any collection of registration information must be limited to what is necessary for a
defined and lawful purpose. Users must be provided with appropriate privacy
information where personal data is collected.
The organisation must not collect or retain personal information or detailed browsing
records without a lawful basis, a defined purpose and appropriate safeguards.
9. Children and Young People
Where children or young people may access the public Wi-Fi service, the organisation
will consider the nature of the premises, the activities taking place and the age and
needs of the intended users.
Where appropriate, proportionate filtering or other safeguards may be applied to reduce
exposure to harmful or unsuitable online content.

Users should be aware that public Wi-Fi filtering cannot guarantee that all harmful or
inappropriate content will be blocked.
Where Wi-Fi is provided to students or young people as part of an educational activity,
the relevant safeguarding, acceptable-use and IT policies must also be followed.
10. Privacy and Data Protection
The organisation will manage any personal information collected through the provision
or administration of public Wi-Fi in accordance with applicable data protection legislation
and its privacy arrangements.
Where applicable, users must be informed about:
 What personal information is collected.
 The purpose for which it is collected.
 The lawful basis for processing.
 Whether information is shared with an internet or Wi-Fi service provider.
 How long information is retained.
 How users can exercise their applicable data protection rights.
Network logs may be maintained where necessary for security, troubleshooting, service
management or compliance purposes. Access to such logs must be restricted to
authorised personnel and retention periods must be proportionate to the purpose.
Any suspected personal data breach must be reported promptly through the
organisation’s established incident-reporting procedure.
11. Misuse and Security Incidents
Any suspected misuse, cyberattack, unauthorised access or other security concern
relating to the public Wi-Fi network must be reported to the Buildings and Operations
Manager and the responsible IT team or service provider as soon as practicable.
Where necessary, the organisation may:

1. Restrict or suspend access to the affected network.
2. Disconnect a device or block a connection.
3. Preserve relevant technical information in accordance with applicable law and
   organisational procedures.
4. Investigate the incident and assess any impact on users, the building or the
   organisation.
5. Refer suspected criminal activity to the appropriate authorities.
6. Take further action under relevant organisational policies or contractual
   arrangements.
   Staff must not attempt to investigate a suspected cyber incident beyond their authority
   or technical competence.
   Where an incident may affect internal systems, business operations or personal data,
   the organisation’s relevant IT, information security and data protection procedures must
   also be followed.
7. Service