INFORMATION SECURITY POLICY

Latest update. October 2023

Management of the lyntia Group (the “Company”), comprising Lyntia Networks, S.A.U. and Global Fontibre S.L., is aware of the importance of the security of its information and services to the Company and understands that harm to or loss of the information or services may impair its operations and jeopardise the Company’s continuity.

Accordingly, the Company is committed to working to ensure:

• The confidentiality and protection of its sensitive or valuable information.
• The integrity and accuracy of its information.
• The availability of its information in the service of its business needs.
• The authenticity of its information, the source of its services.
• The traceability of actions carried out by the Company.
• Compliance with legal and regulatory requirements.
• Suitable maintenance and updating of its security documentation, in particular, continuity plans.
• Information security and awareness training for all employees.
• Investigation of all high-impact information security incidents by the Information Security Officer and reporting to Company management.
• A risk management framework for mitigating technology risks to an acceptable level.

In line with this commitment, the Company has drawn up this Information Security Policy and corresponding Security Policies and Procedures for specific facets to address the Company’s internal needs and drive further implementation of information security controls (ISO 27001, Annex A and ENS [Spain’s National Security Scheme], Basic category, Annex II).

Management has set suitable security objectives to enable the Company to set out on a process of improving its Information Security Management System, in the conviction that this will enhance the processes and services offered to customers while at the same time scrupulously respecting their rights under the law.

To make this possible, Management formally states that it is committed to allocating the resources necessary for proper implementation of the aspects set out above, both at the outset of the project and to ensure its continued activities.

All current Security Policies will remain available on the Company’s intranet, and they will be regularly updated to adapt them to new organisational, environmental, and market requirements as they arise.

The Information Security Policy approved by the Company’s Joint Director’s will take effect the day after it is released.