Security, Data Protection and Management Systems Policy

Scope

This policy applies to:

• All information managed by the Company, regardless of format, including digital, physical, or oral information.
• All employees, contractors, suppliers, and third parties who have access to the Company’s systems, networks, data, and/or facilities.
• The processes, systems, and applications that interact with the services, as well as the Company’s IT processes.

Mission and objectives of the organization

The mission of the Company is:

To foster an environment where every employee feels valued, inspired, and empowered to reach their full potential, contributing to Hard2bit’s success and sustainable growth. To provide services, technological solutions, and management capabilities that help and enable our customers to proactively prevent and resolve challenges related to information security and other areas of IT governance.

In line with the Company’s mission, the following main objectives have been defined. These objectives constitute the reference framework for the development and alignment of the specific objectives of its management systems:

Regulatory framework under which security activities are carried out

Responsibilities related to information security, taking into account the nature of the Company’s activities, are developed under the following regulatory framework:

Roles and functions, defining for each one their duties and responsibilities, as well as the procedure for their appointment and renewal

The following structure ensures the systematic integration of the Company’s business strategy in relation to information security:

Source: Spanish National Cryptologic Centre (CCN).

The positions designated to occupy the security structure roles are:

The management and supervision of information security are covered by the following roles and assigned positions:

With regard to the appointment and renewal of roles, Senior Management shall evaluate the candidates and decide on their appointment or continuity on a biennial basis, taking into account performance criteria, suitability for the organization’s strategic needs, changes in the regulatory and technological context, as well as the evolution of identified risks and opportunities.

This assessment shall also:

• Verify the competence and continuous qualification of the persons involved.
• Ensure that assigned roles maintain independence, impartiality, and the absence of conflicts of interest.
• Guarantee alignment with the requirements established by applicable standards and regulations, such as ENS, ISO/IEC 27001, GDPR, and other management system standards and criteria established by the Company.
• Formally document the decisions adopted, ensuring traceability and effective communication to all interested parties.

The Company shall process personal data under its responsibility in compliance with the following data protection and information security principles

Structure and composition of the committee or committees for the management and coordination of security, detailing their scope of responsibility and relationship with other elements of the organization

The structure and composition of the Security, Data Protection and Crisis Committee are as follows:

Guidelines for the structuring of system security documentation, its management, and access

The structuring of the Company’s documentation is organized at the following levels:

Risks arising from the processing of personal data

Responsibility for monitoring risks lies with their owners, without prejudice to the fact that this function may be delegated on a day-to-day basis. For the purposes of the management system, the risk owners are:

• The Information Owner is the owner of risks relating to information.
• The Service Owner is the owner of risks relating to services.

The most relevant risks in relation to the processing of personal data are described below:

• Unauthorized access: risk that unauthorized persons access sensitive information.
• Unauthorized disclosure: leakage or improper exposure of personal information.
• Regulatory non-compliance: legal or reputational sanctions for failure to comply with regulations such as the GDPR.
• Privacy risks: infringement of the rights and freedoms of data subjects, such as misuse of data or loss of confidentiality.

To control these risks, the Company shall carry out continuous monitoring and periodic reassessments of the implemented measures and the overall state of security, in accordance with the following principles:

Relationship with suppliers

All suppliers who handle or have access to Company information must:

• Comply with applicable security regulations and standards.
• Sign confidentiality agreements and contracts including security clauses.
• Participate in periodic security assessments carried out by the Company.
• Immediately notify any security incident that may affect the Company’s information.

Dispute resolution mechanism

• Any incident, dispute, or non-compliance relating to information security must be immediately reported to the Security Officer.
• All conflicts shall be documented in an incident register, detailing the nature of the conflict, the parties involved, and the date of detection.
• The Security Officer, with the support of the Security, Data Protection and Crisis Committee, shall assess the situation, determining associated risks and possible impacts on information security.
• A graduated approach shall be adopted:
  • Level 1: direct internal resolution between the parties involved, mediated by the Security Officer.
  • Level 2: intervention by the Security, Data Protection and Crisis Committee to mediate and propose formal solutions.
  • Level 3: escalation to the organization’s management or to external bodies as appropriate, including legal measures if necessary.
• Following resolution, follow-up actions shall be carried out to ensure the implementation of corrective and preventive measures, thereby avoiding recurrence.
• The mechanism shall be reviewed annually or whenever significant changes occur in the organization, applicable regulations, or relevant security incidents.

Exceptions and consequences

Exceptions

Any exception to this policy must be approved in writing by the Company’s Information Security Committee. Requests for exception must include a detailed justification, as well as the compensating measures to be implemented.

Consequences

Failure to comply with this policy may result in:

• Internal disciplinary actions.
• Legal action in the event of serious negligence or intentional non-compliance.
• Review of contractual relationships with third parties.

Policy approval

The Company’s senior management endorses this integrated policy and undertakes to provide the resources necessary to effectively implement and maintain all measures required to comply with associated legal requirements, stakeholder requirements, and the normative requirements of the management systems.

This policy shall be reviewed annually to ensure that it remains relevant and effective in achieving the intended objectives.