Information Security/Privacy Policy and
Access Security Requirements
A Matter of Fact fully recognizes its obligation to support and implement policies that protect the confidential nature of the information we handle and to ensure respect for consumers’ rights to privacy.
This policy has been developed in accordance with local, state and federal law and the National Association of Professional Background Screeners (NAPBS) Provider Data Security Privacy Guidelines. The Operations Manager is responsible for implementing, managing and enforcing this policy.
A Matter of Fact is a locked facility. All visitors are met at the door by an authorized employee of A Matter of Fact and are never left unattended while in our offices. Visitors are not given access to consumer information unless legally authorized in writing.
Client Obligations
Only companies who are approved clients and have a permissible purpose for obtaining information are permitted access to our products.
Clients are Required to Sign Agreements That Certify Each of the Following: 1) All information and reports will be requested and used in accordance with the FCRA -- Fair Credit Reporting Act (including disclosure, written authorization, and copy distribution requirements). 2) Information and reports will not be used in violation of any federal or state equal opportunity law or regulation. 3) All information and reports obtained from A Matter Of Fact will be requested and used in accordance with all applicable state and federal laws and regulations (including disclosure, written authorization, and copy distribution requirements). 4) The information requested will only be used for employment purposes and only for the client's own use.Clients Agree to These Access Requirements:
- Usernames and passwords must be protected in such a way that usernames and passwords are known only to authorized persons. Under no circumstances should unauthorized persons have knowledge of your password. The information should not be posted in any manner within your work area or facility.
- Any system access software you may use, whether developed by your company or purchased from a third party vendor, must have your password “hidden” or embedded so that the password is known only to supervisory personnel. Each user of your system access software must then be assigned unique logon passwords.
- Your A Matter of Fact username and password are not to be released to anyone, even someone who claims to be an A Matter of Fact employee. A Matter of Fact will never ask you for your password.
- The ability to obtain credit information from A Matter of Fact must be restricted to a few key personnel.
- Access to consumer information is restricted to authorized persons and authorized persons alone. Authorization to obtain or process Consumer information, or to access any system or device used to obtain or process Consumer information, is restricted to those employees with a legal permissible purpose to do so.
- Any terminal device used to obtain consumer or credit information should be placed in a secure location within your work site or facility. Access to the device should be difficult for unauthorized persons.
- Any devices/systems used to obtain or process consumer information should be turned off and locked after normal business hours or when unattended by authorized persons.
- Access to any devices/systems used to obtain or process consumer information should be protected by a username, a strong password, and by a hardware firewall. Such devices should not be accessible via local wireless connections. Under no circumstances should unauthorized persons have access to consumer information.
- Consumer data must be transmitted over the Internet ONLY by an encrypted (SSL or VPN) link or by sending encrypted files. Under no circumstances should consumer information be transmitted by E-Mail except by using encrypted files. NOTE: If using a Fax to Email service or an Email to Fax service, please verify that all consumer information is properly transmitted within your supplier’s systems and between you and your supplier.
- Hard copy consumer reports are to be secured within your work site and protected against release or disclosure to unauthorized persons.
- Any consumer information stored on portable and/or removable electronic devices shall be encrypted.
- Following FTC Guidelines, work papers, consumer information and consumer reports are to be shredded/destroyed and/or deleted from any system or device when they are no longer needed and as soon as it is permitted to do so by applicable regulation(s) and law (including the Fair Credit Reporting Act and the Drivers Privacy Protection Act), taking measures to reasonably ensure that all such records and data are destroyed and unrecoverable.
- When no longer in use media (hard drives, floppy disks, DVDs, etc.) that have contained consumer information must be shredded/destroyed, according to applicable regulations, including the Fair Credit Reporting Act and the Drivers Privacy Protection Act.
- Procedures are in place to reasonably detect, investigate and respond to an information system intrusion, including consumer and/or customer notification where warranted.
A Client Certification Is Required For Each Order:
A Matter of Fact requires that the following certification be made each time a background check is requested: "I certify that this request is made in accordance with FCRA (Fair Credit Reporting Act), Americans with Disabilities Act, and all other applicable state and federal laws and regulations, including written disclosure to the consumer that a background check will be conducted, written authorization from the consumer to conduct the background check, receipt by the consumer of a copy of the report as required by law, and notification to the consumer including the name, address, and phone of the consumer reporting agency conducting the background check and a summary of the consumer’s rights. I certify that 1) all required steps have been taken, and 2) all required steps will be taken. I also certify that the information requested will be used only for employment purposes and only for the employer’s own use."
Employee, Subcontractor,
and Vendor Obligations
A Matter of Fact requires that all employees, subcontractors, and vendors hold Consumer information in strictest confidence, and requires them to take the following precautions to secure any system, device, or data used in the obtaining or processing of Consumer information:
- Usernames and passwords must be protected in such a way that usernames and passwords are known only to authorized persons. Under no circumstances should unauthorized persons have knowledge of your password. The information should not be posted in any manner within your work area or facility.
- Any system access software you may use, whether developed by your company or purchased from a third party vendor, must have your password “hidden” or embedded so that the password is known only to supervisory personnel. Each user of your system access software must then be assigned unique logon passwords.
- Your A Matter of Fact username and password are not to be released to anyone, even someone who claims to be an A Matter of Fact employee. A Matter of Fact will never ask you for your password.
- The ability to obtain credit information from A Matter of Fact must be restricted to a few key personnel.
- Access to consumer information is restricted to authorized persons and authorized persons alone. Authorization to obtain or process Consumer information, or to access any system or device used to obtain or process Consumer information, is restricted to those employees with a legal permissible purpose to do so.
- Any terminal device used to obtain consumer or credit information should be placed in a secure location within your work site or facility. Access to the device should be difficult for unauthorized persons.
- Any devices/systems used to obtain or process consumer information should be turned off and locked after normal business hours or when unattended by authorized persons.
- Access to any devices/systems used to obtain or process consumer information should be protected by a username, a strong password, and by a hardware firewall. Such devices should not be accessible via local wireless connections. Under no circumstances should unauthorized persons have access to consumer information.
- Consumer data must be transmitted over the Internet ONLY by an encrypted (SSL or VPN) link or by sending encrypted files. Under no circumstances should consumer information be transmitted by E-Mail except by using encrypted files. NOTE: If using a Fax to Email service or an Email to Fax service, please verify that all consumer information is properly transmitted within your supplier’s systems and between you and your supplier.
- Hard copy consumer reports are to be secured within your work site and protected against release or disclosure to unauthorized persons.
- Any consumer information stored on portable and/or removable electronic devices shall be encrypted.
- Following FTC Guidelines, work papers, consumer information and consumer reports are to be shredded/destroyed and/or deleted from any system or device when they are no longer needed and as soon as it is permitted to do so by applicable regulation(s) and law (including the Fair Credit Reporting Act and the Drivers Privacy Protection Act), taking measures to reasonably ensure that all such records and data are destroyed and unrecoverable.
- When no longer in use media (hard drives, floppy disks, DVDs, etc.) that have contained consumer information must be shredded/destroyed, according to applicable regulations, including the Fair Credit Reporting Act and the Drivers Privacy Protection Act.
- Procedures are in place to reasonably detect, investigate and respond to an information system intrusion, including consumer and/or customer notification where warranted.
Consumer Precautions
Consumer Requests for Information about their Background Checks:
- Proper identification is required before A Matter of Fact personnel will discuss or provide copies of a Consumer Report to the requesting consumer.
Website Privacy
Our informational website, www.amof.info, uses Google Analytics, a service provided by Google, Inc. (“Google”) to provide data about how our site is used (things such as the number of visitors to the various parts of the website). This data is used to improve the information on the site and to improve navigation within the site. We do not make any attempt to find out the identities of those visiting this website.
Google Analytics uses “cookies”, which are text files placed on your computer, to help analyze how users use our site. The information generated by the cookie about your use of our website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of our website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.
