Scope: production systems for Cosmetic Wholesale Sync (sync.cosmeticwholesale.eu) and related Postgres. Related policies: privacy appendix, DPA, DLP.
1. Roles
- Incident Commander: engineering on-call / lead
- Notify management; involve legal/privacy if personal data is involved
- Contact: privacy@cosmeticwholesale.eu
2. Severity
- SEV1 — confirmed personal-data breach or prolonged outage of paid-order sync
- SEV2 — degraded sync or suspected unauthorised access
- SEV3 — contained bug, no personal-data exposure
3. Steps
- Detect
- Contain (rotate secrets, isolate affected systems)
- Investigate
- Eradicate
- Recover
- Notify merchants and authorities if legally required
- Post-mortem within five business days
4. Evidence
Preserve logs and avoid destroying forensic data until the Incident Commander clears retention for the case.
If Distraal B.V. adopts a company-wide incident response policy, this page will point to or be replaced by that document. This text is not independent legal advice.