SYSTEM AND DATA SECURITY
Protecting data, controlling access and supporting service resilience.
Public version · Updated: 25 September 2026
BBS group entities are covered by PCI DSS certification for payment card data security. This certification forms part of the group’s payment data protection framework, combining access controls, system security, monitoring and oversight of security measures. Controls are integrated into operational processes and relationships with relevant providers.
This policy describes security measures implemented for BBS activities, information and systems. Management, technology teams, risk and compliance functions, and service providers have defined responsibilities. Risks, exceptions and corrective measures are assessed, approved and tracked in documented records.
Access rights are individual, limited to business needs and granted on a least-privilege basis. Multifactor authentication protects privileged access and other access for which it is required. Permissions are reviewed periodically and removed when a person leaves or changes roles. Sharing accounts or passwords is prohibited.
Payment data collection and retention are limited to authorized needs. Card numbers are masked when displayed and protected when stored. Card verification codes, PINs and full track data are not retained after authorization, even if encrypted. Such information is excluded from emails, support tickets and application logs.
Sensitive exchanges use encrypted channels and maintained protocols. Stored data is protected according to its classification and applicable requirements. Encryption keys, technical credentials, tokens and API secrets are accessible only to authorized people, managed throughout their lifecycle and excluded from shared source code.
Integrations provide call authentication, authorization checks, input validation and controls against abusive use. Development, testing and production environments are separated. Sensitive changes are approved, tested and traceable. Real data is avoided for testing or protected in accordance with applicable requirements.
Systems, software and components are inventoried and maintained. Vulnerabilities are assessed and remediated according to their severity, exposure and applicable deadlines. Security reviews, vulnerability scans and penetration tests are planned according to risk and service scope. Any intervention on a system requires prior authorization.
Sensitive access and events are logged to support anomaly detection, analysis and investigation. Logs are protected against unauthorized access and alteration. Their contents are limited to necessary information, excluding authentication secrets and prohibited payment data. Retention meets applicable obligations and evidentiary needs.
Providers with access to data or systems undergo a risk-based assessment. Contracts define security responsibilities, confidentiality, incident handling, subcontracting conditions and data return or deletion. Where a service falls within PCI DSS scope, the provider’s compliance scope and allocation of controls are verified and monitored.
Any suspected incident is reported, assessed and escalated to the appropriate responsible teams. The response covers containment, preservation of evidence, impact analysis, recovery and corrective-action tracking. Communications to customers, partners and authorities follow applicable legal and contractual requirements.
Continuity arrangements identify priority activities, critical dependencies and recovery procedures. Backups are protected and restoration tested periodically. Recovery objectives and procedures are appropriate to each service, documented and reviewed after major changes or significant incidents.
Staff receive awareness guidance on data protection, fraud, phishing and incident reporting. People performing sensitive functions receive instructions suited to their responsibilities. Control findings, lessons learned and changes in risk inform procedure updates and security-action tracking.
Send your report to compliance@bbsmastergroup.com, identifying the affected service, date, issue description and a way to contact you. Include only the information needed for an initial assessment. Do not send passwords, private keys, verification codes, full card numbers or card verification codes. Secure exchange arrangements will be specified if further information is required.
This website presents BBS activities and provides contact information. It does not include a card-data entry form or a supporting-document upload form. Use its HTTPS address and verify the identity of your contact before following sensitive instructions. Rules governing personal data processing are detailed in the Privacy Policy.
The measures described in this policy complement internal procedures, the Compliance Policy, the Privacy Policy and each service’s contractual commitments. The risk and compliance function is the contact point for enquiries about this policy and security reports.
LET’S MOVE YOUR PROJECT FORWARD
Tell us about your business, the countries involved and your needs. Our teams will help assess your project.