INFORMATION SECURITY POLICY

Latest update. February 2022

The Management of the lyntia group (“the Company”), made up of the companies lyntia Networks, S.A.U., lyntia Access S.L.U. and Gunalta ITG, S.L.U., is aware of how important it is for the Company to keep its information and its services secure, because loss or damage to any of them has an impact on its operations and could put the continuity of the Company at risk.

This is why the Company is committed to working to guarantee:

• Confidentiality and protection of valuable or sensitive information.
• Completeness and accuracy of the information.
• Availability of information, in order to meet business needs.
• Compliance with legal and regulatory requirements.
• Adequate updating and maintenance of security documentation and, more specifically, continuity plans.
• Information security training and awareness for all employees.
• That all information security incidents that have a significant impact are reported to the Company’s Management and investigated by the Information Security Manager.
• Acceptable mitigation of technology risks through a risk management framework.

In order to fulfil this commitment, the Company has developed this Information Security Policy and the corresponding Security Policies and Procedures that address specific aspects, requiring even stricter application of the information security controls and responding to the needs within the Company.

The Management has defined the most appropriate security goals for the Company to undertake a process to improve its Information Security Management System, with the conviction that this will improve processes and services offered to customers, scrupulously respecting their legal rights.

In order to make all of this possible, the Management expresses its formal commitment to allocate the necessary and sufficient resources to properly apply what is established here, both at the beginning of the project and during maintenance in the future.

All of the Security Policies in force will be available on the Company intranet and will be updated regularly to adapt to any new organisational, sector or market requirements that arise.

The Information Security Policy approved by the Company’s Joint Director will be applicable on the day after it is published.