INTRODUCTORY PROVISIONS
This document presents a summary of the umbrella security policy and a summary of the security controls and procedures for ensuring information security. It is intended for the Company’s business partners.
The summary is available to the Company’s business partners only through the Company’s website. The Company reserves the right to change the content of this document in accordance with its business needs and with standards in the field of information security.
The summary is publicly available on the Company’s website, therefore the Company does not notify business partners of changes.
PURPOSE AND OBJECTIVES
The Company is aware that secure and reliable information and information assets are of key importance for the successful operation of the Company. For this purpose, the Company uses organisational regulations and work instructions to determine how information assets are to be protected.
The purpose of the security policy is to determine the importance of information for the Company’s operations and to protect it appropriately in terms of ensuring confidentiality, integrity and availability (CIA).
The objective of information protection is to prevent or minimise the consequences of security incidents and to ensure business continuity.
SCOPE OF THE SECURITY POLICY
Through the security policy, instructions and information protection procedures, the Company governs all business processes for the provision of the Company’s information services.
When drafting security policies, rules, instructions, statements and procedures, we take into account in particular:
- applicable national legislation and EU legislation
- the ISO/IEC 27001:2022 standard
- information security practices that are in accordance with the law.
The umbrella and area-specific policies, as part of the ISMS (Information Security Management System), include information protection procedures that are presented in the requirements and in the four areas of the ISO/IEC 27001:2022 information security standard, namely:
- Organisational controls
- People controls
- Physical controls
- Technological controls
CLASSIFICATION OF INFORMATION
The Company has classified information according to its importance and nature and has defined the method of handling for each level of information classification.
BUSINESS COOPERATION
The Company strictly ensures the protection of information and personal data by concluding Non-Disclosure Agreements (trade secrets) and Personal Data Protection Agreements with all parties (customers, suppliers, partners, associates).
Entering the Company’s premises
External persons who have arranged a meeting at our Company are received at the entrance to the premises and escorted to the meeting room, where all meetings with external persons take place.
After the meeting has ended, external persons are escorted to the exit.
Trade secrets
Data that constitutes a trade secret of the Company must also be protected by persons outside the Company if they knew, or given the nature of the data should have known, that the data is a trade secret. It is prohibited for persons outside the Company to attempt to obtain data that constitutes a trade secret of the Company in violation of the law and the will of the Company.
External persons who cooperate with the Company in any way and who, as a result of this cooperation, may become acquainted with data defined as a trade secret must commit to protecting the trade secret. For this purpose, every external contractor must sign a Trade Secret Protection Statement before being given access to data defined as a trade secret.
It is prohibited for persons outside the Company to attempt to obtain data that constitutes a trade secret of the Company in violation of the law and the will of the Company.
Protection of personal data
The Company implements data leakage prevention measures for systems, networks and all other devices that process, store or transmit sensitive data, in order to detect and prevent unauthorised disclosure and acquisition of information by individuals or systems.
These measures comprise a wide range of technical, organisational and legal measures designed to prevent unauthorised access, use, disclosure, alteration or destruction of data.
RISK MANAGEMENT
In order to avoid or reduce potential consequences, we have identified risks and determined potential threats that could lead to a loss of confidentiality, integrity and availability of an information asset.
The Company has established a system for identifying security controls with which we reduce vulnerabilities.
RESPONSIBILITIES AND AUTHORITIES
The Company’s management is responsible for the implementation of the information security management system and for monitoring and supervising the effectiveness of security measures and procedures. All employees are responsible for complying with and implementing individual security measures and procedures, while the Company’s management is responsible for the implementation of the security policy as a whole and for ensuring the necessary financial and human resources.
All employees are involved in the process of continuous improvement of the security of information and information assets. The task of the responsible person is to appropriately inform employees of the security requirements and controls and to train them for the safe use of information, information assets and information technology devices.
SECURITY INCIDENT MANAGEMENT
Through its incident management policy, the Company has established security mechanisms for eliminating or reducing the undesirable consequences of incidents in the course of its business. In the incident management policy, the Company has defined that incidents will be resolved according to the criticality of each incident and in accordance with the adopted information security and business continuity policies and legislation.
For the area of information protection, the Company has appointed an Information Security Management System (ISMS) administrator, to whom all employees and contractors are obliged to report detected security events and incidents.
In accordance with the adopted acts and their authorisations, the ISMS administrator must record all data on reported events and incidents, keep a register of incidents and, together with employees and contractors, carry out activities to eliminate or reduce the consequences of incidents.
COMMUNICATION
For the exchange of information we use various communication means, from e-mail, internet downloads and telephones to various data carriers.
When exchanging information, we ensure that information is protected against interception, copying, alteration, misrouting and destruction, and we protect it against malicious code.
To protect the confidentiality and integrity of confidential information, we use cryptographic techniques where necessary.
ACCESS CONTROL
Physical access to secured areas where data and documents as well as information and communication equipment are located is restricted by measures that ensure appropriate protection of the Company’s information and assets.
Third-party users must, upon termination of a contract or agreement, return all assets owned by us, which may include received software, hardware, documents and other assets.
Third-party users must return all access rights at the end of the cooperation. If a contractor or third-party user has used passwords for accounts that remain active, we change those passwords.
Access rights may be reduced or revoked even before the formal end of the cooperation.
BUSINESS CONTINUITY
For the appropriate management of business continuity, the Company has established business continuity strategies that define procedures in the event of incidents.
The Company ensures regular testing and review of the business continuity policy. Through business continuity testing, we ensure that all members of the crisis management team, and where necessary other personnel of our Company, are familiar with this policy and with their responsibilities in this regard.
MONITORING OF LEGISLATION
The Company regularly monitors sector-specific legislation as well as legislation governing the protection of personal data, trade secrets and information security. We regularly inform all employees of changes, and where necessary also partners.
PUBLICATION AND VALIDITY OF THE DOCUMENT
This document is published on the Company’s website and is valid from the date of publication.
Date of publication: 7 March 2025
Company Director