Information Security Management System Policy

The fundamental objective of ATRINIUM SL's Information Security Management System is to protect information, offering its employees, clients and suppliers a secure working environment through appropriate security measures and operating processes.

The principles of our information security policy are:

• Confidentiality: Information must be known only to authorised persons.
• Integrity: Information will at all times be complete, accurate, valid and free from tampering.
• Availability: Information will always be accessible to authorised users at all times, and its persistence will be guaranteed against any eventuality.
• These principles apply to the Hermes SaaS platform and to the software development services provided from our offices at C/ Albéniz 21, 29014 Málaga, and remotely, within the certified scope of the ISMS.

At ATRINIUM we are aware that our SaaS software development services require appropriate protection and management in order to ensure the continuity of our services and minimise any damage caused by information security failures.

To this end, we make the following commitments:

• ATRINIUM's ongoing commitment to information security management will be demonstrated through training and awareness programmes that encourage participative management in these areas, enabling staff skills to be used for the continuous improvement of the production process and of security.
• To ensure that our activities are carried out within the applicable rules and regulations, we will comply with the legislation and regulations in force, as well as with other requirements agreed with our clients, including those relating to information security and data protection.
• To meet the requirements and continuously improve the effectiveness of the Information Security Management System, by implementing systems for measuring and monitoring SaaS software development, as well as security objectives.
• To carry out and periodically review a risk analysis based on recognised methods that allows us to establish the level of information security and minimise risks through the development of specific policies, technical solutions and contractual agreements with specialised organisations.
• ATRINIUM staff will carry out their work focused on achieving the set objectives and, at all times, in accordance with legal requirements as well as those of the client.
• Selection of employees, suppliers and subcontractors based on information security criteria.
• To establish and review annually measurable information security objectives, consistent with this policy, and to allocate the resources needed to achieve them (clause 6.2 of ISO/IEC 27001:2022).
• To comply with applicable legal, regulatory and contractual requirements, in particular the GDPR and the LOPDGDD (Spanish Data Protection Act), the requirements of our insurance-sector clients (including those arising from Regulation (EU) 2022/2554, DORA, for ICT providers) and Regulation (EU) 2024/1689 on artificial intelligence insofar as it applies.
• To promote the responsible use of artificial intelligence, limited to approved tools and without entering confidential information or clients' personal data.
• To consider the effects of climate change and extreme weather events in the analysis of context and in service continuity (ISO/IEC 27001:2022/Amd 1:2024).
• To continuously improve the Information Security Management System.
• Any incident or weakness that could compromise, or has compromised, the confidentiality, integrity and/or availability of information must be recorded and analysed so that the corresponding corrective and/or preventive measures can be applied. It will also be communicated to the interested parties within the corresponding time frames.
• This policy is communicated to all staff when they join and with each new edition, is made available to interested parties, and is reviewed at least once a year in the Management Review.