🟢 Information Security Policy 20.11.2024

1. Purpose

The purpose of this information security policy is to establish the framework for information security work in Woba. Furthermore, the policy aims to create a common understanding of what information security entails, including defining objectives and responsibilities for information security work in Woba.

2. Definitions

Information security is understood as the protection of all assets involved in or contributing to the processing of data, both electronically and physically. Protection encompasses all relevant measures; including measures related to organizational processes, individual behavior, physical environments, and technology. Data refers to all information related to Woba's business operations; including the development, delivery, and servicing of solutions/products to customers and potential customers, as well as information related to employees, etc. in Woba.

3. Scope

The policy applies to all of Woba's business operations, including all employees, etc., and all use of systems, etc., used by Woba.

4. Objectives

Woba considers information security work a quality element that supports the credibility of the product offered by Woba. This is reflected in Woba's efforts to ensure a high level of security that continuously reflects its contextual development. Woba strives to achieve the following certifications/declarations:

ISAE-3000

Woba strives to promote a good information security culture based on a mindset that a high level of information security is a crucial competitive parameter in a digitalized world.

Woba wishes to communicate this message to both employees and customers, which should be expressed through a strong awareness campaign and through general communication. Information security work in Woba must be based on applicable legislation and recognized standards in information security. This must be reflected in the level of information security in Woba, which must comply with the requirements that can be derived therefrom. The level of security in Woba must at all times reflect the fact that Woba complies with the agreements that Woba has entered into with its customers regarding the security of the processing of their data. The level of security in Woba must be determined on the basis of risk assessments that take into account the current threat landscape. The level of security in Woba must also ensure a high degree of confidentiality, integrity, and availability:

● Confidentiality: Data may only be accessible in relevant systems and to those persons who, based on a necessity assessment, have been granted access. The data must be handled confidentially within these frameworks.

● Integrity: Systems, including IT systems used as part of business operations, must be reliable and function correctly. It must also be ensured that the data basis is both reliable and trustworthy.

● Availability: Woba systems must be available 24/7 to the extent that this is possible, taking into account the maintenance of the systems in question, etc. The systems must be subject to the necessary security measures to ensure availability (as well as confidentiality and integrity). An IT contingency plan must also be maintained to ensure that normal operation of business systems can be re-established within 24 hours if availability is temporarily lost.

5. Responsibility

Management in Woba has overall responsibility for ensuring that Woba complies with the objectives of this policy. The day-to-day management of information security work is carried out by the internal compliance team For each system used in Woba, one or more system administrators have been designated who are responsible for information security in relation to the individual system. Each employee is responsible for performing their work in accordance with this policy and for following the guidelines, etc., that arise from this policy. Each employee is also obliged to notify management of any breaches of information security or suspicion thereof.

6. Follow-up

This policy, as well as the guidelines, policies, and procedures that arise from it, is reviewed and approved once a year by the management of Woba in cooperation with the company's internal compliance team.

Any changes to this policy or the guidelines, policies, and procedures that arise from it must be made in compliance with the obligations that Woba has based on concluded contracts, data processor agreements, etc.

The level of security is continuously assessed by the company's internal compliance team in cooperation with the company's IT department to the extent necessary to comply with the objectives of this policy.

7. Violation

Violation of this information security policy or supporting guidelines, policies, or procedures may have employment law consequences.

8. Exceptions

This policy may be deviated from if management deems it necessary for business operations. Deviations from this policy must be specifically justified and documented. Management must strive to avoid deviations as much as possible.

9. Supporting Guidelines, Policies, and Procedures

Woba maintains a register of current guidelines, policies, and procedures that arise from this policy.

10. Documentation

Woba documents its work on information security and compliance with data protection regulations on the Woba site in Wired Relations.

11. Contact

Questions regarding Woba's work on information security and data protection can be directed to the company's internal compliance team.

Contact: Peter Engel Møller mail: pm@woba.io Phone +45 28408820