Jasper’s Treat Shop

Email Protection & Security Policy

Policy Owner: Matthew White
Business: Matthew White trading as Jasper’s Treat Shop
Version: 1.0
Effective Date: 15 September 2026
Review Frequency: At least annually and following any significant security incident or material change to email systems.

1. Purpose

Jasper’s Treat Shop relies on email to communicate with customers, suppliers, delivery providers and other organisations.

This policy establishes the measures used to protect business email accounts, customer and business information, and Jasper’s Treat Shop systems against threats including phishing, malware, impersonation, unauthorised access, accidental disclosure and business email compromise.

The objective is to maintain the confidentiality, integrity and availability of information handled through email and to reduce the risk of personal information being accessed, altered, lost or disclosed without authorisation.

2. Scope

This policy applies to all email accounts, mailboxes, devices, applications and services used to conduct Jasper’s Treat Shop business.

It applies particularly to the primary customer contact address:

[email protected]

It also applies to any additional Jasper’s Treat Shop email addresses created in the future and any personal device authorised to access business email.

3. Account Security

All Jasper’s Treat Shop email accounts must be protected using strong, unique passwords that are not reused for other services.

Multi-factor authentication (MFA/2FA) must be enabled wherever supported.

Passwords must not be shared with another person or transmitted by email, text message or other insecure means.

Where recovery email addresses, telephone numbers or authentication applications are configured, these must remain current and under the control of the account owner.

Access to email accounts must be removed immediately when an individual no longer requires access.

4. Approved Devices

Business email should only be accessed using devices reasonably considered secure.

Devices accessing Jasper’s Treat Shop email must, where supported:

• Be protected by a password, PIN or biometric authentication.
• Use automatic screen locking.
• Receive current operating-system and security updates.
• Run supported software and browsers.
• Use device encryption where available.
• Be protected against unauthorised physical access.

Lost or stolen devices capable of accessing Jasper’s Treat Shop email must be treated as a potential security incident.

5. Phishing and Suspicious Email

Unexpected emails requesting passwords, payment details, account credentials or urgent financial action must be treated with caution.

Links and attachments must not be opened where the sender or content appears suspicious.

Particular care must be taken with messages claiming to originate from:

• Customers requesting unusual refunds.
• Banks and payment providers.
• WooCommerce or WordPress.
• Website hosting providers.
• Domain or email providers.
• Royal Mail or Evri.
• Suppliers requesting changes to bank details.
• HMRC or other government bodies.

Requests to change supplier bank details must be independently verified using previously established contact information rather than telephone numbers or links contained within the change request.

Jasper’s Treat Shop will never intentionally request a customer’s account password or full payment-card credentials by email.

6. Attachments and Links

Unexpected attachments must not be opened until their legitimacy has been established.

Executable files, scripts, macros and other potentially dangerous file types should not be opened unless there is a legitimate business requirement and their origin has been verified.

Links should be checked before opening where there is any doubt about their destination.

Suspicious attachments and links must not be forwarded to other people except through an appropriate security reporting process.

7. Customer Personal Information

Email must only contain customer personal information where reasonably necessary for a legitimate business purpose.

The amount of personal information included in an email should be minimised.

Highly sensitive information, passwords and complete payment-card information must not be sent through ordinary email.

Customer information must only be sent to the intended recipient. Email addresses and attachments should therefore be checked carefully before sending.

Where an email is being sent to multiple unrelated customers, their email addresses must not be exposed to each other. An appropriate mailing system or BCC should be used where applicable.

8. Payment Information

Jasper’s Treat Shop will use its approved ecommerce/payment systems for processing customer payments.

Customers should not be asked to send full payment-card details by email.

If payment-card information is unexpectedly received by email, it must not be unnecessarily copied, forwarded or retained. Appropriate action should be taken to protect the information and direct the customer towards an approved payment method.

9. Supplier and Financial Fraud

Requests involving changes to supplier payment information, bank details or unusual payments must be independently verified.

Email alone must not be considered sufficient verification for a significant or unexpected change to payment instructions.

Where possible, verification should be performed using trusted contact information already held by Jasper’s Treat Shop.

10. Email Authentication and Domain Protection

Jasper’s Treat Shop should maintain appropriate technical controls for the jasperstreatshop.com domain.

These should include, where supported:

• SPF (Sender Policy Framework)
• DKIM (DomainKeys Identified Mail)
• DMARC (Domain-based Message Authentication, Reporting and Conformance)
• TLS encryption for mail transport
• Anti-spam and anti-malware protection

DMARC reports should be reviewed where practical, particularly when implementing or changing email services.

Email authentication records must be reviewed when a new service is authorised to send email on behalf of Jasper’s Treat Shop.

11. Business Email and Marketing

Transactional email and marketing email should be appropriately distinguished.

Marketing communications must comply with applicable UK privacy and electronic-marketing requirements.

Marketing emails must provide an appropriate means of opting out or unsubscribing.

Customer marketing preferences must be respected.

12. Retention and Deletion

Email must not be retained indefinitely simply because storage is available.

Messages containing personal or commercially sensitive information should be retained only for as long as reasonably necessary for the relevant business, contractual, legal, accounting, security or dispute-resolution purpose.

Emails no longer required should be securely deleted in accordance with Jasper’s Treat Shop’s data-retention practices.

Records that are required for accounting, contractual, regulatory or legal purposes must be retained for the appropriate period.

13. Email Forwarding

Automatic forwarding of Jasper’s Treat Shop email to personal or unauthorised external email accounts should not be enabled.

Any forwarding rule required for a legitimate business purpose must be reviewed to ensure that it does not unnecessarily disclose personal or confidential information.

Unexpected forwarding or mailbox rules are an indicator of possible account compromise and must be investigated.

14. Public and Shared Networks

Additional caution must be exercised when accessing business email using public or shared networks.

Business email should not be accessed from public or shared computers unless absolutely necessary.

Users must ensure that credentials are not saved on devices that are not under their control.

15. Suspected Email Compromise

If a Jasper’s Treat Shop email account is suspected of being compromised, the following actions should be taken as soon as practicable:

1. Secure the affected account and change its password.
2. Confirm that multi-factor authentication remains correctly configured.
3. Review active sessions and revoke unknown or unnecessary sessions.
4. Review forwarding rules, mailbox rules and recovery information.
5. Review recent sent, deleted and login activity for unauthorised activity.
6. Check whether other accounts use the compromised password and change them where necessary.
7. Determine what customer, supplier or business information may have been accessed or disclosed.
8. Preserve appropriate evidence and maintain an incident record.
9. Notify affected service providers, customers or suppliers where necessary.
10. Assess whether the incident constitutes a personal data breach.

16. Personal Data Breaches

A security incident involving personal information must be assessed under UK data protection law.

Jasper’s Treat Shop will document personal data breaches, including the nature of the incident, information affected, consequences and remedial action taken.

Where a personal data breach is likely to result in a risk to people’s rights and freedoms, Jasper’s Treat Shop will consider whether notification to the Information Commissioner’s Office is required.

Where notification is legally required, it will be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to affected individuals, those individuals will also be informed where required.

17. Backup and Business Continuity

Important information required to operate Jasper’s Treat Shop should not exist solely within an individual email message or mailbox.

Important supplier documents, contracts, compliance documentation, invoices and other business-critical records should be retained within an appropriate business record system or secure backup location.

Email recovery options and business continuity arrangements should be periodically checked.

18. Security Monitoring and Review

Email security settings should be reviewed periodically and whenever:

• A new email service is introduced.
• A new application is permitted to send email using the Jasper’s Treat Shop domain.
• Website or WooCommerce email systems are changed.
• An email account is compromised.
• Significant phishing activity is detected.
• An individual is granted or removed from mailbox access.
• Relevant regulatory or security requirements materially change.

19. Responsibilities

As proprietor, Matthew White is responsible for ensuring that appropriate email-security measures are maintained for Jasper’s Treat Shop.

Any person subsequently authorised to access Jasper’s Treat Shop email must follow this policy and promptly report suspected phishing, accidental disclosure, lost devices, suspicious account activity or other security incidents.

20. Policy Review

This policy will be reviewed at least annually and following any significant email-security incident or material change to the systems used by Jasper’s Treat Shop.

Approved by: Matthew White
Trading as: Jasper’s Treat Shop
Version: 1.0
Date: 15 September 2026