Security and corporate management policy

Purpose and scope The purpose of this Security and Corporate Management Policy is to establish the principles, criteria and guidelines governing the protection of information, systems and services within the scope of Grupo ASEGI. This policy applies to all the entities that form part of Grupo ASEGI, as well as to all its staff, collaborators and third parties who, directly or indirectly, access the organisation’s information, systems or services, regardless of their location, function or contractual relationship. 2. General principles Grupo ASEGI carries out its activity under a management model based on the following principles: · Protection of information, guaranteeing its confidentiality, integrity, availability and traceability. · Responsible risk management, identifying, assessing and mitigating the risks that may affect the activity. · Regulatory compliance, ensuring conformity with the legislation in force and with the applicable regulatory obligations. · Continuous improvement, through the periodic review of processes, controls and security measures. · Shared responsibility, involving all levels of the organisation in the protection of information. 3. Organisational model Grupo ASEGI has an organisational structure that establishes a common framework for action in matters of management and security, defining strategic guidelines, internal policies and standards applicable to all its entities. This model makes it possible to guarantee consistency in decision-making, uniformity in the application of measures and the alignment of all activities with the corporate objectives of Grupo ASEGI, while at the same time maintaining the flexibility needed to adapt to the particularities of each operational area. 4. Commitment of Management The Management of Grupo ASEGI expresses its commitment to the protection of information and the continuity of its services, driving the implementation of appropriate organisational, technical and legal measures. It likewise undertakes to provide Grupo ASEGI with the necessary resources, to promote a culture of security and to oversee compliance with this policy at all levels. 5. Security and risk management Grupo ASEGI adopts a structured approach to security management, which includes: · Identification and classification of information assets. · Risk analysis and treatment. · Implementation of appropriate security controls. · Continuous monitoring of systems and services. · Incident management and the establishment of corrective measures. This approach makes it possible to anticipate threats, reduce the impact of possible incidents and guarantee the resilience of Grupo ASEGI. 6. People and awareness The human factor is a key element in security. For this reason, Grupo ASEGI promotes: · Training and awareness programmes adapted to the different profiles. · Good practice in the use of systems and information. · Individual responsibility in the protection of assets. All Grupo ASEGI staff are responsible for complying with the established rules and procedures. 7. Relationship with third parties Grupo ASEGI establishes security criteria in the selection and management of suppliers and collaborators, ensuring that they meet the necessary requirements regarding the protection of information. Contractual and control measures are adopted to guarantee that the services provided by third parties maintain the levels of security required by Grupo ASEGI. 8. Legal and regulatory compliance Grupo ASEGI carries out its activity in compliance with the applicable legislation in force, including that relating to: · Protection of personal data · Information security · Digital and technological services · Sectoral legal and regulatory obligations Grupo ASEGI carries out continuous monitoring to guarantee its conformity with regulatory changes. 9. Review and improvement This policy is reviewed periodically to ensure that it remains appropriate to the evolution of Grupo ASEGI, of the technological environment and of the associated risks. Updates will be approved by the Management of Grupo ASEGI and communicated to all interested parties. 10. Validity This policy comes into force upon its approval by the Management of Grupo ASEGI and shall be binding on all entities, employees and collaborators.