We have established internal organizational structures responsible for supervising the effective implementation of the Information Security Policy and continuous improvement of security processes. Our Management Board has appointed a representative of the Management Board for ISMS responsible for improving and implementing information security and business continuity principles in line with the information security objectives set by the Management Board.

As part of the campaigns we carry out, we are trained in the principles of information security. We undertake to keep confidential all information, legally protected data, including those constituting a company secret.

We keep a register of information assets. We have developed and implemented internal security standards requiring the use of safeguards appropriate to the degree of criticality and sensitivity of information assets and identified threats.

We apply a policy of controlling access to information. The assignment of rights to information and their modifications are carried out on the basis of the principles of minimum rights and knowledge necessary on the basis of documented access requests. Accounts and permissions are reviewed on a regular basis. Information rights are granted only for a strictly defined purpose.

We use cryptographic security of IT systems, workstations, mobile devices, external media, e-mail, IT networks adequate to the sensitivity of the Information Processed and the form of Information Processing.

We ensure a high level of physical and environmental security in order to ensure the security of information against access to information assets of unauthorized persons and to prevent their damage or unauthorized modification of information.

We take care of the application of security and operating principles of IT systems based on the best practices in the field of information security.

The designated security standards of the Company define the rules, among others, in the scope of:

In order to ensure the security of information transmitted in IT networks and to protect network services, we have defined internal rules for the configuration and security of LAN and WAN networks included in the corporate network, as well as the rules for access to the corporate network and the use of the Internet.

We carry out processes related to the acquisition, development and maintenance of IT systems in a supervised manner, guaranteeing the maintenance of an adequate level of information security. It consists of, among others:

The rules for establishing cooperation between the Company and suppliers have been defined within the framework of internal purchasing processes. The level of quality and safety of the provided services is constantly monitored and evaluated. Information security is selected individually during the selection of the supplier, in order to protect the risks associated with the access of an external entity to the Company's information. When defining security requirements, we take into account, among others, requirements resulting from contracts signed with Customers and legal requirements.

The Company operates an incident management process based on best practices in this regard. We analyze each incident in detail in terms of its causes and as part of its handling we carry out corrective and improvement actions with the aim of minimizing the likelihood of occurrence or consequences of past incidents.

The Company operates a Business Continuity Management System, regulated by the “Business Continuity Policy”, the “Business Continuity Management” regulations and subordinate documentation. The way of functioning in a crisis situation and the principles of returning to normal mode of operation describe the functioning business continuity plans and contingency plans. The requirements for information security and continuity of information security management in crisis situations are taken into account during the construction of business continuity plans.

We have implemented a process of ensuring compliance and managing the risk of non-compliance, within which we manage legal, regulatory and contractual obligations related to, among others, information security.

The process of ensuring compliance and managing the risk of non-compliance are set out in the “Compliance Policy” and the “Non-Compliance Risk Management” regulations.