INFORMATION SECURITY POLICY

    I.     INTRODUCTION

This document sets out the general Information Security Policy (ISP) of the companies within the Group of GVC GAESCO (GVC Gaesco Holding, GVC Gaesco Valores, GVC Gaesco Gestión, GVC Gaesco Pensiones, GVC Gaesco Alternative Investments and GVC Gaesco Correduría), hereinafter GVC GAESCO, that enacts the basic principles of action and management of the organisation in terms of Information Security.

Security is understood as an integral process made up of all technical, human, material and organisational elements related to the information systems, excluding any type of specific action or temporary treatment.

The rest of the documents related to the Information Security of the GVC GAESCO Group shall be aligned with the guidelines contained in this general Information Security Policy.

The continuing digital transformation of our society, the impact on strategic sectors, such as the financial sector, the new cybersecurity scenario and the advancement of application technologies are producing significant changes at an international level.

Likewise, it has been shown that information systems are increasingly exposed to cyberspace threats, noticing an increase in cyberattacks, both in volume and frequency as well as in sophistication, with greater technical and operational skilled agents and actors.

These threats arise in a high dependence context on information and communication technologies in our society and of great interconnection of information systems.

     II.        OBJECTIVE

The aim of this general Information Security Policy is to establish a common regulatory framework for the GVC GAESCO Group to identify, develop and implement the technical and organisational measures required to ensure the security and protection of information, privacy of persons included, as well as information systems that support the activity of the GVC GAESCO Group.

   III.        DISSEMINATION

This document will be published on the intranet of the GVC GAESCO Group and communicated to all relevant parties, especially the internal staff handling the information assets of the GVC GAESCO Group.

This document will also be published on the GVC GAESCO Group website to share it with the relevant parties from outside of the organisation.

   IV.        MANAGEMENT COMMITMENT

Information, especially the personal data of employees, customers and suppliers, as well as the systems that support it, represent strategic assets for GVC GAESCO, who intends to protect them against threats such as errors, sabotage, terrorism, extortion, industrial espionage, privacy violations, service interruptions and natural disasters, in order to ensure the efficient and effective achievement of the defined business objectives.

GVC Gaesco Group Management is committed to leading and promoting security at all levels, in accordance with the Security Policy and the objectives defined therein.

    V.        POLICY

a) Scope

The GVC GAESCO Group protects the resources involved in the information management related to the normal development of its functions, in compliance with the current legislation, preserving the confidentiality and privacy of information and ensuring its availability, authenticity, integrity, and maintenance. These objectives also cover the information systems used to carry out their activity.

The GVC GAESCO Group is determined to establish conditions of trust when using electronic means and the continuous provision of its services, by adopting the required measures aimed at protecting the organization’s information systems from those threats to which they are exposed, to ensure the security of information systems, minimise risks and thus consolidate the basis for preventing, detecting, reacting to and recovering from possible incidents that may arise.

This general Information Security Policy is intended to the entire scope of action of the GVC GAESCO Group, that is:

• All the resources, services and business processes that make up the GVC GAESCO Group. Thus, it shall apply to all the information systems involved in the services provision and to all those support systems for the different functions and liabilities of the GVC GAESCO Group.
• To all users, whether internal or external linked, directly or indirectly, to the GVC GAESCO Group who make use of the systems described in the abovementioned point.

b)    Objectives of Information Security

The objectives to achieve are addressed to:

• Guarantee, ensure and implement the appropriate and necessary security measures on all resources, processes, functions and services directly and indirectly related to internal and external users, and to customers, suppliers, partners or other third parties, for the purposes of ensuring the availability, confidentiality and integrity of information, according to the applicable legislation.
• To guarantee the continuity, security and quality of the services offered.
• Implement and maintain continuous improvement processes to enhance the efficiency and effectiveness of the information security measures.
• Minimise potential security incidents and their impact, should they occur.
• To have the means, by which the different users of the services and processes of the GVC GAESCO Group make proper use of the information, information systems and resources used in the development of their functions, obligations and responsibilities, as well as those that do not compromise the information security of the GVC GAESCO Group.
• Align with the international and standards best practices on information security and/or cybersecurity in force at all times.
• Implement the appropriate security measures on the information and personal data in hard copy or electronically processed that the GVC GAESCO Group manages within the scope of its competences. This information shall be governed by the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as by Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (LOPDGDD).

In accordance with the abovementioned objectives, this general Information Security Policy seeks the adoption of the following security principles, ensuring:

• Availability: Information and information systems can be used in time and due form.
• Confidentiality: data and information systems shall only be accessed by duly authorised persons.
• Authenticity: Property that focuses on verifying the entity/person or data comes from its claimed source.
• Integrity: accuracy of information and information systems against alteration, loss or destruction, whether accidental or fraudulent.
• Legality: information is processed in accordance with the regulatory framework.
• Training: in accordance with the principle of comprehensive security, ensure an adequate level of information security awareness and training for all the staff of the organization.
• Incident management: risks analysis and management as an essential part of the organization’s security process, keeping the environment controlled and minimizing risks, in accordance with prevention, detection, reaction and recovery measures, and establishing protocols for the exchange of incident-related information.

c)    Regulatory Compliance

This general Information Security Policy and other associated documentation are aligned with the current legal scope of laws, rules and regulations that apply to the GVC GAESCO Group, with respect to any material or territorial scope.

Please refer to the following document for further information: GVC_NOR_005_Cumplimiento legal requirements.

d)    Implementation of resources

Management of the GVC GAESCO Group declares its commitment to guarantee, within the scope of its functions and responsibilities, the necessary resources provision to implement and maintain the processes related to the security information of the GVC GAESCO Group and their continuous enhancement. The aim is to achieve the strategic objectives, dissemination, consolidation and compliance with this general Information Security Policy, as well as implementing the appropriate distribution and publication mechanisms so as it can be known by the relevant users.

e)     Roles and responsibilities

Any user affected by this Policy shall be require to:

• Always comply with the general Information Security Policy, rules, procedures and instructions of the Information Security of the Organization.
• To take an active role in the cybersecurity of any assets that are subject to protection within the scope of this Policy.
• Maintain professional secrecy and confidentiality about the information of the Organization.
• Report, in accordance with the corresponding regulations, suspicious or anomalous situations, security incidents, and non-conformities or breaches of security of the organization’s information systems and/or assets of the Organisation.

The overall liability for the Information Security falls on the person assigned as responsible for the Information Security Management System (ISMS).

Regarding the breach of the Information Security Policy of the GVC GAESCO Group and other documents related to the information security, by anyone to whom they apply and that jeopardises the security of information in any of its dimensions, Management of the GVC GAESCO Group reserves the right to initiate the corresponding actions according to the codes and internal rules of behaviour and the legal framework in force.

f)     Compliance monitoring

The degree of implementation of the policy will be periodically measured (at least annually) through self-assessments coordinated by the ISMS manager and through internal or external audits (at least annually), and whenever there are substantial changes in the information systems of the GVC GAESCO Group. The approval of this policy is carried out in the Management Review, indicated in the ISMS.

g)    Information Security Regulations

This Information Security Policy shall be supported and complemented by a set of specific documents. These documents are the so-called Information Security Regulations and shall be based on the best market practices and aligned with the specific requirements of the GVC GAESCO Group.

h)    Information Classification

All information must be classified by virtue of its importance to the organization and must be treated according to that classification, in accordance with the provisions of GVC_NOR_008_Clasificación of the Information.

i)      Access Control

The GVC GAESCO Group shall implement physical security measures according to the risk scenarios to prevent unauthorized physical access, as well as a logical access control system for all information residing in the Organization’s ICT information systems. The specific measures are developed in the documents GVC_NOR_015_Control physical access and logical access GVC_NOR_019_Control.

j)      ICT Security Testing

The GVC GAESCO Group establishes and implements an ICT security testing plan to validate the effectiveness of its developed ICT security measures and ensures that this plan takes into consideration the threats and vulnerabilities identified as part of the ICT risk management framework.

k)    Acquisition, development and maintenance of ICT systems

The GVC GAESCO Group designs and implements, where appropriate, a procedure that regulates the acquisition, development and maintenance of ICT systems following a risk-based approach. The specific measures are developed in the following documents: GVC_NOR_011_Security of the Information on relations with suppliers; GVC_NOR_013_Security in the life cycle of the development and GVC_NOR_029_Maintenance of the equipment.

l)      ICT Project and changes of ICTs

The GVC GAESCO Group develops, documents and implements an ICT project management procedure and defines the roles and responsibilities for its implementation. Likewise, the GVC GAESCO Group. documents and implements an ICT change management procedure to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner and with appropriate safeguards to preserve the organization’s digital operational resilience.

The concrete measures are developed in the GVC_NOR_032_Projects Management and GVC_NOR_020_ Management of changes.

m)   Risk-based security management and risk analysis and management

All systems affected by this Security Policy must be subject to a risk analysis, assessing the threats and risks to which they are exposed. This analysis will be repeated:

• Regularly, at least once a year.
• When the information handled and/or the services provided change significantly.
• When a serious security incident occurs or serious vulnerabilities are detected.

The ISMS Manager will be responsible for carrying out the risk analysis, as well as identifying shortcomings and weaknesses and bringing them to the attention of the Information Security Committee.

n)    Suppliers and Third Parties

All relevant purchases of goods or services or that have an impact on the services or systems of the GVC GAESCO Group will be subject to a risk analysis process.

The information security requirements for the mitigation of the risks associated with the supplier must be agreed with the supplier and documented, and the provisions of the security regulations established and that complement this policy must be followed.

o)    Liability for non-compliance

The breach of the Policy hereof and its derived Regulations shall be considered a serious offence, giving rise to the application of the Disciplinary Regime regulations without prejudice to any other responsibilities that may arise.

Similarly, any collaborating member, subcontractor, or consultant member who fails to comply with this Policy will be subject to removal from the GVC GAESCO Group’s premises and termination of the relationship with the Organization.

p)    Exception handling

Any exception to this Information Security Policy must be registered and reported to the person responsible for the ISMS of the GVC GAESCO Group. These exceptions will be analysed to assess the risk that might cause to the company. Considering the categorization of these risks, they must be assumed by the requestor of the exception together with those responsible for the business.

q)    Climate change

The GVC GAESCO Group has carried out the analysis of the services provided by the organization as well as its normal operations to provide them. As a result of such analysis, no aspects that may impact on the climate change have been found beyond those generated by the air conditioning systems and vehicles emissions that provide services to the organization, in both cases, complying with the regulatory requirements.

Once analysed the requirements of the interested parties, none of those has been found as specifically related to climate change.

Based on both analysis, it is concluded that there is no need to implement measures beyond the applicable legal standard and requirements.

r)     Approval and review

The general Information Security Policy is formally approved by the Management Bodies of the Companies that make up the GVC GAESCO Group; it shall be pointed out in the corresponding minutes and shall be in force until itis replacement by a new version. Likewise, the Policy hereof shall be reviewed annually and whenever significant changes happen that require to adapt it to the new technical and/or organizational circumstances, preventing so from becoming out of date.

For these purposes, their adequacy, timeliness, and accuracy shall be regularly reviewed. Any resulting modifications that may arise shall be proposed by the ISMS manager for validation.

s)    Effective date

The Information Security Policy will come into force on the date of its publication on the company’s Intranet and distribution to all element affected by such Policy.