INFORMATION SECURITY POLICY

Latest update: December 2024

The Management of the lyntia group (“the Company”) comprising the companies Lyntia Networks, S.A.U. and Global Fontibre S.L., is aware of the importance for the Company of the security of its information and services, such that the damage or loss of any information could affect the performance of its operations and could jeopardise the continuity of the Company. 

Accordingly, the Company is committed to working to ensure: 

• The confidentiality and protection of valuable or sensitive information. 
• The completeness and accuracy of the information. 
• The availability of information, in order to meet business needs. 
• The authenticity of the information, which is the source of the services. 
• The traceability of the actions carried out by the entity. 
• Compliance with legal and regulatory requirements. 
• The adequate updating and maintenance of documentation regarding security and, more specifically, continuity plans. 
• Information security training and awareness for all employees. 
• All high-impact information security incidents are reported to Company Management and investigated by the Information Security Officer. 
• Technology risks are mitigated to an acceptable level through a risk management framework. 

To meet this commitment, the Company has developed this Information Security Policy and corresponding Security Policies and Procedures that address specific aspects, further enforcing the implementation of information security controls (Annex A of ISO 27001, NIST2 Directive (including Annex I) and Annex II of the HIGH ENS category) and addressing needs within the Company. 

The Management has defined the most appropriate security targets for the Company to undertake a process of improvement of the Information Security Management System, convinced that this will result in the improvement of processes and services offered to customers, while scrupulously respecting their legally established rights. 

To achieve this, the Management declares its formal commitment to allocate the necessary and sufficient resources for the proper development of the provisions established herein, both at the start of the project and in its future maintenance. 

All current Security Policies shall remain available on the Company’s intranet and shall be regularly updated and adapted to new organisational, environmental and market requirements that may arise. 

The Information Security Policy approved by the Joint Director of the Company shall be applicable as of the day following the day of its publication. 

This Information Security Policy was approved by the CEO of the Company, and shall be applicable as of the day following its publication on the corporate website.