Version: 1.8
Last updated: July 2025
Applies to: All systems managed or administered by D Harvey Media Ltd (“DHM”)

1. Purpose

This policy defines how and when access may be granted to third parties, including client representatives and external IT providers, within systems managed by D Harvey Media Ltd.
It ensures that security, confidentiality, and compliance obligations under UK GDPR and contractual terms are maintained at all times.

2. Scope

This policy applies to all client systems managed by DHM, including but not limited to:

  • Microsoft 365 tenancies

  • Domain name servers (DNS)

  • Web hosting and email servers

  • WordPress environments and control panels

  • Analytics and marketing integrations

3. Ownership and Control

Where systems are owned by the client (for example, Microsoft 365 tenants, domain names, or other client-registered platforms), DHM acts as an authorised administrator or data processor under the terms of the service agreement with that client.

Where systems are owned by DHM (for example, hosting infrastructure, shared environments, or licensed tools used to deliver services), DHM retains full ownership and control. Client access to these systems is restricted to their own website, data, or service area, in accordance with DHM’s intellectual property and data-segregation framework.

In both cases, DHM ensures that access is granted only with appropriate authorisation, logging, and compliance safeguards.

  • DHM administers and secures systems on behalf of its clients.

  • The underlying hosting environments, configurations, and licensing (including proprietary themes, plugins, and scripts) owned by DHM remain the intellectual property of DHM unless otherwise agreed in writing.

  • Clients and third parties are granted access only for legitimate operational or audit purposes, under DHM’s supervision.

4. Access Authorisation

This policy applies equally to DHM-managed systems that are client-owned and to DHM-owned environments used to host or deliver client services.

All requests for access to DHM-managed systems must be:

1. Made in writing, specifying the purpose, scope, and duration of access;

2. Approved by both the system owner (client) and DHM; and

3. Documented in the DHM Access Log.

No access will be granted without written confirmation from the client that they authorise the third party to act on their behalf.

5. Access Levels

Access levels will be limited strictly to what is required:

Role Typical Use Access Rights
Viewer / Reader Governance or audit review Read-only, no configuration rights
Contributor Content updates or marketing integration Limited write access, no system settings
Administrator Full technical maintenance Restricted to DHM personnel only

6. Temporary Access

Where temporary access is granted:

  • Credentials will be created specifically for the authorised party.

  • Access will be restricted to the minimum required resources.

  • The account will be disabled or deleted immediately upon completion of the task or at the expiry of the agreed duration.

  • All such actions will be recorded in the Access Log.

7. Confidentiality and NDAs

Before any access is provided to a third party, DHM requires a Non-Disclosure Agreement (NDA) or equivalent confidentiality clause to be signed by that party, covering all data, configurations, and intellectual property.  This is to protect both DHM and DHM’s clients. 

8. Monitoring and Revocation

All privileged systems are monitored for access activity.
DHM reserves the right to:

  • Suspend or revoke access immediately if misuse or security concerns arise;

  • Audit any third-party actions taken during access sessions.

9. Client Responsibilities

Clients are responsible for:

  • Ensuring that third parties requesting access are legitimate and authorised;

  • Notifying DHM immediately if any access credentials are lost, compromised, or misused;

  • Respecting DHM’s intellectual property and access governance framework.

10. Review and Updates

This policy is reviewed annually or following any major security or operational change.
Updates are communicated to clients where relevant.

Approved by:
Danny Harvey
Director – D Harvey Media Ltd
Date: July 2025