Policy on data aggregation:

The primary principles is that any aggregated data released by Edge must be anonymized so that the source of the data cannot be identified from the data by reverse engineering.  

This involves:

• – having a sufficiently large sample size (number of petrol filling stations); and
• – having sufficient diversity of sources so that no source and the approximate data from that source can be identified by reverse engineering; and
• – having no source or group of sources which contribute to the data in a way that significantly skews the data (a very large or very small volume outlier).
  ‍

All three criteria must be satisfied for the data to be both meaningful and anonymized, and therefore usable.

EdgePetrol would not expect data to be useful, usable or necessarily anonymized if any one of the above contributes more than twenty five percent (25%) of the sample size or data.

Policy on PCI-DSS account data

EdgePetrol does not acquire, hold, or process account data as defined by the Payment Card Industry Data Security Standard (PCI-DSS), and maintains measures to prevent the acquisition of such data, and instructs and trains its staff not to seek to acquire such data.

The Client acknowledges and accepts its responsibility, and responsibility for any of its agents and third-party service providers, to not share account data either by electronic transfer, or by grant of system access to cardholder data environment (CDE), or through any other means of communications with EdgePetrol, and to maintain systems to ensure compliance.

Non-compliance by the Client will amount to a breach of the standard terms and conditions pursuant to which notice of termination may be given if not remedied in accordance with the terms. These obligations also apply under the GDPR and other data protection systems and both EdgePetrol and the Client mutually warrant compliance.

PCI-DSS Compliance: Our responsibilities as a Third-Party Service Provider (PCI-DSS Requirement 12.9.1)

This section outlines EdgePetrol’s compliance with PCI-DSS Requirement 12.9.1, ensuring that EdgePetrol, as a third-party service provider (TPSP), acknowledges its responsibilities to support its clients’ PCI-DSS compliance efforts. 

EdgePetrol does not store, process, or transmit any account data as defined by PCI-DSS. However, as a TPSP, EdgePetrol also recognises its responsibility to ensure that its operations do not compromise the security of its customers’ cardholder data environments. 

• To support this, EdgePetrol implements robust security measures, provides the necessary compliance information to customers, and incorporates clear contractual obligations regarding security responsibilities:
  
  
• – EdgePetrol is responsible for maintaining secure operations that do not compromise the security of its client’s cardholder data environment (CDE).

– EdgePetrol will not intentionally acquire, store, process, or transmit account data and will implement appropriate safeguards to ensure compliance with this policy.
– EdgePetrol will notify clients if any activity, incident, or service delivered by EdgePetrol could affect the security of the client’s account data and / or cardholder data environment (CDE)

PCI-DSS Compliance: Support for PCI-DSS Compliance (Requirement 12.9.2)

To further support its customers’ PCI-DSS compliance efforts, EdgePetrol agrees to the following upon request from a customer:

EdgePetrol will provide its PCI-DSS compliance status, including any documentation that demonstrates EdgePetrol’s adherence to applicable security standards, such as its PCI-DSS Attestation of Compliance (AOC) or relevant evidence confirming the implementation of security controls.

EdgePetrol will work with its clients to facilitate their PCI-DSS compliance. This includes providing timely information, participating in discussions related to compliance, and collaborating to resolve any security issues that may arise from services provided by EdgePetrol.