📋 Legal & Compliance

M3ST Company Policies

Our full suite of company policies — covering privacy, data protection, compliance, employment, and more. All policies are reviewed annually by the Directors of M3ST Ltd.

Registered Company: M3ST Ltd
Registered in: England & Wales
Last Reviewed: March 2026
Next Review Due: March 2027
1

Privacy Policy

1.1 Introduction

M3ST Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.2 Data We Collect

We may collect and process the following personal data:

  • Name, job title, and contact details (email, telephone, address)
  • Company information and billing details
  • Technical data including IP addresses, login credentials, and usage data via our Client Portal
  • Communications records including support tickets and call logs
  • Any information you provide when contacting us or completing forms

1.3 How We Use Your Data

We use your personal data to:

  • Provide, manage, and improve our VoIP and telecoms services
  • Process payments and manage your account
  • Respond to enquiries and provide customer support
  • Send service updates, technical notices, and essential communications
  • Comply with legal and regulatory obligations
  • Improve our website and services through analytics

1.4 Legal Basis for Processing

We process your data under the following lawful bases:

  • Contract: To fulfil our obligations under our service agreement with you
  • Legal obligation: To comply with UK law and regulatory requirements
  • Legitimate interests: To operate and improve our business, provided this does not override your rights
  • Consent: Where you have explicitly opted in to marketing communications

1.5 Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Account data is retained for a minimum of 6 years following the end of a contract in line with HMRC requirements.

1.6 Data Sharing

We do not sell your personal data. We may share it with:

  • Trusted third-party service providers acting as data processors on our behalf
  • Regulatory authorities or law enforcement where legally required
  • Professional advisors including lawyers and accountants

All third parties are required to handle your data securely and in accordance with applicable data protection law.

1.7 Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Request erasure of your data (where applicable)
  • Restrict or object to processing
  • Data portability
  • Withdraw consent at any time

To exercise any of these rights, please contact us at [email protected].

1.8 Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.

2

Anti-Slavery & Human Trafficking Policy

2.1 Our Commitment

M3ST Ltd has a zero-tolerance approach to modern slavery and human trafficking in all its forms. We are committed to acting ethically and with integrity in all our business relationships and to implementing and enforcing effective systems and controls to ensure modern slavery is not taking place anywhere within our own business or our supply chains.

2.2 Scope

This policy applies to all persons working for or on behalf of M3ST Ltd, including employees, directors, contractors, consultants, and suppliers.

2.3 Our Supply Chains

M3ST Ltd operates primarily in the UK telecommunications sector. We source services and equipment from reputable, established suppliers. We take a risk-based approach to supply chain due diligence and expect all suppliers to operate to the same ethical standards we set for ourselves.

2.4 Due Diligence

We undertake the following due diligence procedures:

  • Screening new suppliers and partners prior to engagement
  • Including anti-slavery clauses in contracts with key suppliers
  • Requiring suppliers to confirm compliance with the Modern Slavery Act 2015
  • Monitoring and reviewing supplier relationships on an ongoing basis

2.5 Reporting

Any employee or stakeholder who suspects modern slavery or human trafficking in any part of our business or supply chain should report it immediately to a director or via our whistleblowing process. All reports will be investigated promptly and in confidence.

2.6 Training

We provide appropriate training to relevant staff to help them identify and report signs of modern slavery.

2.7 Responsibility

Overall responsibility for this policy rests with the Directors of M3ST Ltd, who will review it annually.

3

Anti-Bribery & Corruption Policy

3.1 Our Commitment

M3ST Ltd is committed to conducting all business in an honest and ethical manner. We have a zero-tolerance approach to bribery and corruption and are committed to acting professionally, fairly, and with integrity in all our business dealings and relationships, wherever we operate.

3.2 Legal Framework

This policy is in accordance with the Bribery Act 2010, which makes it a criminal offence to offer, give, request, or accept a bribe.

3.3 Scope

This policy applies to all individuals working at all levels and grades, including directors, employees, contractors, agents, and any other person associated with M3ST Ltd.

3.4 What Is Prohibited

The following are strictly prohibited:

  • Offering, promising, or giving a bribe to any person or organisation
  • Requesting, agreeing to receive, or accepting a bribe
  • Bribing a foreign public official
  • Facilitating tax evasion in any jurisdiction

3.5 Gifts & Hospitality

We recognise that the giving and receiving of gifts and hospitality is a normal part of doing business. However, it must never be used to gain improper advantage. Gifts and hospitality must be:

  • Reasonable, proportionate, and infrequent
  • Transparent and recorded
  • Never offered to or accepted from public officials without prior director approval

3.6 Reporting

Any concerns about bribery or corruption should be raised with a director immediately or via our whistleblowing process. M3ST Ltd will not retaliate against anyone who raises concerns in good faith.

3.7 Consequences

Breach of this policy may result in disciplinary action, including dismissal, and may also result in criminal prosecution.

4

Equal Opportunities Policy

4.1 Our Commitment

M3ST Ltd is committed to promoting equality of opportunity for all staff and job applicants. We aim to create a working environment in which all individuals can make the best use of their skills and in which all decisions are based on merit.

4.2 Legal Framework

This policy is designed to comply with the Equality Act 2010 and covers the nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation.

4.3 Scope

This policy applies to all aspects of employment including recruitment, pay and conditions, training, appraisals, promotion, and termination of employment.

4.4 Our Commitments

M3ST Ltd will:

  • Recruit, train, and promote on the basis of merit and ability alone
  • Ensure job advertisements and descriptions are free from discriminatory language
  • Make reasonable adjustments for employees or applicants with disabilities
  • Foster a culture of inclusion, dignity, and respect
  • Not tolerate discrimination, harassment, or victimisation of any kind

4.5 Responsibilities

All employees are responsible for their own conduct and for supporting a culture of inclusion. Managers are responsible for implementing this policy within their teams. Overall responsibility rests with the Directors.

4.6 Reporting

Any employee who believes they have been discriminated against, harassed, or victimised should raise the matter through our formal grievance procedure. All complaints will be taken seriously and investigated promptly.

5

Environmental Policy

5.1 Our Commitment

M3ST Ltd recognises the importance of environmental sustainability and is committed to minimising the environmental impact of our operations. We aim to continually improve our environmental performance and to comply with all applicable environmental legislation and regulations.

5.2 Our Approach

As a telecoms and VoIP provider, our direct environmental footprint is relatively low compared to manufacturing industries. Nevertheless, we are committed to:

  • Energy efficiency: Reducing energy consumption across our offices and infrastructure where possible, and favouring energy-efficient hardware and cloud-based solutions
  • Waste reduction: Minimising waste, encouraging recycling, and disposing of electronic equipment responsibly through approved WEEE recycling schemes
  • Paper reduction: Encouraging digital communication and reducing reliance on printed materials
  • Sustainable procurement: Favouring suppliers who demonstrate a commitment to environmental responsibility
  • Travel: Encouraging remote working, virtual meetings, and sustainable travel options where business travel is required

5.3 Responsibilities

All employees are expected to support our environmental commitments in their day-to-day activities. Directors are responsible for setting environmental objectives and monitoring progress.

5.4 Review

This policy will be reviewed annually and updated as our business grows and environmental best practices evolve.

6

Health & Safety Policy

6.1 Statement of Intent

M3ST Ltd is committed to ensuring the health, safety, and welfare of all its employees, contractors, visitors, and any other persons who may be affected by its activities, so far as is reasonably practicable. We comply fully with the Health and Safety at Work etc. Act 1974 and all associated regulations.

6.2 Responsibilities

Directors are responsible for:

  • Ensuring adequate resources are available to manage health and safety
  • Setting health and safety objectives and reviewing performance
  • Leading by example in health and safety matters

Managers are responsible for:

  • Implementing this policy within their area of responsibility
  • Carrying out risk assessments and implementing appropriate controls
  • Ensuring staff receive appropriate training and information
  • Reporting accidents and near-misses promptly

All Employees are responsible for:

  • Taking reasonable care of their own health and safety and that of others
  • Following safe working procedures and using equipment correctly
  • Reporting hazards, accidents, and near-misses to their manager

6.3 Risk Assessment

M3ST Ltd will conduct and regularly review risk assessments for all work activities, including office-based work and remote working arrangements.

6.4 Remote & Homeworking

As many of our staff work remotely, we provide guidance on safe home working practices including workstation setup, screen breaks, and mental health and wellbeing support.

6.5 Emergency Procedures

Clear emergency procedures, including fire evacuation plans, are maintained for all M3ST premises and are communicated to all staff.

6.6 Reporting Accidents

All accidents, injuries, and dangerous occurrences must be reported to a director immediately and recorded in our accident log. Reportable incidents will be reported to the Health and Safety Executive (HSE) under RIDDOR where required.

7

GDPR & Data Protection Policy

7.1 Introduction

M3ST Ltd processes personal data in the course of its business activities. This policy sets out our obligations and the standards we expect all staff to maintain when handling personal data, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

7.2 Data Protection Principles

All personal data must be:

  • Processed lawfully, fairly, and transparently
  • Collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes
  • Adequate, relevant, and limited to what is necessary
  • Accurate and kept up to date
  • Retained only for as long as necessary
  • Processed securely, protecting against unauthorised access, loss, or destruction

7.3 Roles & Responsibilities

  • The Directors of M3ST Ltd act as the senior responsible owners for data protection
  • All employees who handle personal data must complete data protection training and comply with this policy
  • Where required, M3ST Ltd will appoint a Data Protection Officer (DPO)

7.4 Data Subject Rights

M3ST Ltd will respond to all data subject access requests within one calendar month. Requests should be directed to [email protected].

7.5 Data Breaches

Any actual or suspected personal data breach must be reported to a director immediately. Where a breach is likely to result in a risk to the rights and freedoms of individuals, it will be reported to the ICO within 72 hours as required by UK GDPR.

7.6 Data Transfers

M3ST Ltd will not transfer personal data outside the UK without ensuring adequate protections are in place in accordance with UK GDPR requirements.

7.7 Training

All staff will receive data protection training upon joining and refresher training at least annually.

8

Whistleblowing Policy

8.1 Introduction

M3ST Ltd is committed to the highest standards of openness, honesty, and accountability. We encourage employees and others working with us to raise genuine concerns about malpractice, wrongdoing, or illegal activity without fear of retaliation. This policy is in accordance with the Public Interest Disclosure Act 1998 (PIDA).

8.2 What Is Whistleblowing?

Whistleblowing (or making a "protected disclosure") involves reporting concerns that relate to:

  • Criminal activity or fraud
  • Breaches of legal or regulatory obligations
  • Health and safety risks
  • Environmental damage
  • Modern slavery or human trafficking
  • Bribery or corruption
  • Deliberate concealment of any of the above

This policy is not intended for personal grievances, which should be raised through our grievance procedure.

8.3 How to Raise a Concern

Concerns should be raised in the first instance with a Director of M3ST Ltd. If the concern relates to a director, or if you do not feel comfortable raising it internally, you may report it to an external body such as:

  • The relevant regulatory authority (e.g., Ofcom, ICO, HMRC)
  • The Health and Safety Executive (HSE)
  • The Serious Fraud Office (SFO)
  • A prescribed person under PIDA

8.4 Confidentiality

All disclosures will be treated with the utmost confidentiality. We will not disclose the identity of a whistleblower without their consent unless required to do so by law.

8.5 Protection from Retaliation

M3ST Ltd will not tolerate any retaliation, victimisation, or detrimental treatment of any employee who raises a concern in good faith. Any such behaviour will be treated as a serious disciplinary matter.

8.6 Anonymous Disclosures

We encourage individuals to put their name to any concern they raise, as anonymous reports can be more difficult to investigate. However, anonymous reports will still be considered and investigated where possible.

All policies are owned by the Directors of M3ST Ltd and are reviewed annually. For any queries regarding these policies, please contact us at [email protected].

Contact Us