Background Check Policy

1. Definitions

Term	Definition
Background Check	A comprehensive verification process to confirm the identity, qualifications, employment history, and suitability of individuals before granting access to vStream systems, facilities, or sensitive information.
Identity Verification	The process of confirming that an individual is who they claim to be through review of government-issued identification documents and other authoritative sources.
Staged Access	A phased approach to granting system access where new employees initially receive limited access (development and staging environments only) until background checks are completed, after which production access may be granted.
Production Access	The ability to access, modify, or manage live production systems including the ShineVR application, customer data, production databases, and Google Cloud Platform production resources.
Sensitive Data	Information requiring enhanced protection including personal data, healthcare information (such as ShineVR trial data), intellectual property, authentication credentials, and business confidential information.
Right to Work	Legal authorisation to work in Ireland, verified through passport, visa, work permit, or other documentation as required by Irish employment law.

2. Policy Statement

vStream Digital Media is committed to protecting customer data, business assets, and maintaining the trust of healthcare customers. Background checks are a critical security control that helps ensure only trustworthy, verified individuals gain access to sensitive systems and information, particularly production environments hosting the ShineVR healthcare application.

All employees and contractors with access to vStream systems must undergo appropriate background verification before being granted production access. This policy establishes comprehensive requirements for identity verification, reference checks, employment verification, and staged access provisioning to minimise insider threat risks and comply with customer security requirements.

Background checks are conducted in compliance with Irish data protection law, GDPR, and employment regulations. All information collected is handled confidentially and used solely for employment screening and security purposes.

3. Purpose

The purpose of this policy is to:

• Verify the identity and credentials of individuals before granting access to production systems
• Minimise insider threat risks by screening for potential security concerns
• Protect customer data, particularly sensitive healthcare information in ShineVR applications
• Ensure compliance with healthcare customer security requirements
• Confirm right to work in Ireland and employment eligibility
• Verify qualifications and employment history relevant to role requirements
• Demonstrate due diligence in personnel security for regulatory compliance and customer audits

4. Scope

This policy applies to:

• All new permanent employees regardless of role or seniority
• All contractors and consultants requiring access to vStream systems
• Temporary staff with system access or handling sensitive information
• Re-screening when employees change roles requiring elevated access
• Periodic re-verification for employees with production access (every 3 years)

5. Background Check Requirements

5.1 Identity Verification

Comprehensive identity verification is required for all new hires:

• Government-Issued Photo ID: Passport, national identity card, or driving licence. Must be current and not expired
• Proof of Address: Utility bill, bank statement, or official correspondence dated within last 3 months
• PPS Number: Personal Public Service Number for Irish residents, required for employment records
• Right to Work: Passport with work visa or EU/EEA citizenship documentation. Verified and photocopied for HR records
• Document Verification: Original documents inspected in person (not photocopies). Certified copies retained in employee file
• Digital Verification: For remote employees, identity verified via video call with live document inspection plus third-party identity verification service where appropriate

5.2 Employment History Verification

Verification of employment history for the most recent 5 years or 2 previous employers (whichever is greater):

• Direct Contact: Contact previous employers directly (not through candidate) to verify employment dates, job title, and responsibilities
• Employment Gaps: Gaps exceeding 3 months must be explained and verified where possible
• Contractor Verification: For contractors or self-employed individuals, verify through client references or contract documentation
• Documentation: Written confirmation from employers or reference letters on company letterhead. Notes from phone verification calls retained

13. Roles and Responsibilities

13.1 Chief Technology Officer

• Overall responsibility for background check policy and procedures
• Review and approval of all background check results
• Decision authority on production access based on background check outcomes

13.2 Hiring Managers

• Initiate background check process during recruitment
• Collect required documents and information from candidates

15. Contact Information

Data Protection Officer / Chief Technology Officer:

Andrés Pitt

Email: andres@vstream.ie

Phone: (086) 788 6570

Company Address:

vStream Digital Media

37 Leeson Close

Dublin 2, D02 H344

Ireland

Website: vstream.ie