Information Security Policy

Orient Logic regards information security as an integral part of trustworthy service and responsible business conduct. Our goal is to protect the company’s information and the information entrusted to us, to reduce security risks and to support the resilience of our operations.

This public document sets out the key principles and commitments of the company’s information security policy and is intended for clients, partners, suppliers and other interested parties. It is based on the company’s Information Security Policy (IS-PL/02-25), approved on 11 April 2025, and applies within the defined scope of the information security management system.

• Confidentiality — information is accessible only to duly authorised persons and processes.

• Integrity — information is protected against unauthorised modification, and its accuracy and completeness are preserved.

• Availability — authorised users have access to information and the related services in line with business needs and agreed requirements.

The company’s management is committed to maintaining and continually improving an information security management system based on ISO/IEC 27001:2022, to providing the necessary resources and to assigning the appropriate responsibilities.

We are committed to meeting the applicable legal, regulatory and contractual requirements related to information security. We align our security objectives with the company’s business, its assessed risks and the relevant requirements of interested parties, plan the actions needed to achieve them and evaluate the results.

We identify and assess information security risks and implement organisational, people, physical and technological controls proportionate to their significance. Protective measures are chosen with regard to the value and sensitivity of the information and the potential impact on our business.

Our approach covers the inventory and classification of information assets, authorisation-based access, secure processing, storage and transfer of information, secure management of systems, and vulnerability handling. We pay particular attention to the protection of personal and confidential data.

Information security management is coordinated by the Information Security Manager. Managers and employees are responsible for meeting the security requirements relevant to their work. We provide appropriate education and training to raise awareness and competence.

In our relationships with suppliers, contractors and other partners, we take information protection risks into account and define the corresponding security requirements and responsibilities.

We ensure that reports of security events, suspected breaches and weaknesses are received, assessed and responded to appropriately. We use the results of incident analysis to reduce their impact and to improve our protective measures.

We take information security requirements into account when planning business continuity and recovery. The relevant plans are tested and updated to reduce the impact of significant disruptions.

For information security matters or to report a suspected incident, please contact us through the contact channels listed on the company’s official website. An initial report should not contain passwords, access keys or other secret data.

We evaluate the effectiveness of the management system and its controls through monitoring, internal and external audits, management reviews and feedback. We plan appropriate actions for any gaps identified and track their completion.

The policy is reviewed at planned intervals and whenever significant changes occur. The public version is updated to reflect relevant changes to the internal policy. Detailed internal procedures and technical control settings are not part of this public document.