Information Security Policy

History and Organizational Structure

In June 2016, Francesco Schettini (CEO) and Sara Tello (People & Operations Manager) co-founded Orienteed with a clear vision: to bring to A Coruña the international working methodologies they had acquired through their experience in the global technology sector.

The first office they opened was located in a small apartment in the center of A Coruña. After moving through a couple of additional locations, we settled in our current address: Calle Torreiro No. 13, 7th Floor F — Postal Code 15003, A Coruña. However, the natural evolution of our working model has led most of our team to operate remotely or in a hybrid format, making the computer our primary communication channel.

Today, we have a branch in Palestine and maintain strategic alliances with some of the best international technology companies. This growth is a testament to our commitment, dedication, and specialization.

Our organizational chart reflects our structure and the different departments that make up Orienteed. You can get to know the members of each department and understand how our functions interrelate to achieve our shared objectives. This organizational structure is key to keeping us coordinated and efficient, especially in a hybrid and remote working environment.

The Management of ORIENTEED, S.Lapproaches the Information Security Management System as a way of organizing the company's operations based on information security criteria in accordance with the requirements of the ISO-IEC 27001:2023 standard, in order to ensure the continuity of information systems, minimize the risk of damage, and ensure compliance with the established objective — which is none other than the necessary framework of action to protect information resources against threats, whether internal or external, deliberate or accidental, with the aim of ensuring compliance with the confidentiality, integrity, and availability of information. Likewise, all necessary measures will be implemented to comply with applicable security regulations relating to policies, the security of buildings and facilities, and the conduct of employees and third parties associated with ORIENTEED, S.L. in their use of information systems. To this end, ORIENTEED, S.L., has:

• Adequate human resources.
• Necessary technical resources.
• Secure facilities.
• Proven experience in the management of outsourcing solutions.
• Technical and control tools.

Our vision is that the best results are achieved by joining forces with our clients, working closely with their teams, and establishing solutions that align with their business objectives — always seeking the best solutions to improve productivity and reduce costs. Achieving, maintaining, and improving the level of security desired by the company can only be accomplished through the commitment and participation of all staff, and by harnessing their creative potential and skills.

The Management of ORIENTEED, S.L., establishes the following as foundational objectives, starting points, and support for the company's information security objectives and principles:

• Information security is achieved by planning, executing, reviewing, and improving the Management System to prevent potential errors.
• Planning for risk treatment to ensure the availability, integrity, and confidentiality of information linked to the provision of services.
• The integration of information security risks into the planning of new processes and the modification of existing ones.
• Both the Management and the staff of ORIENTEED, S.L. commit to complying with the applicable legal and regulatory requirements, including: the protection of personal data and individual privacy, and the protection of intellectual property rights.
• Only through the continuous improvement of processes, methods, services, etc., can greater internal efficiency, a better response to client company expectations, and therefore an improvement in their satisfaction be guaranteed.
• The staff of ORIENTEED, S.L. regardless of their functions and responsibilities, must analyze the data available to them regarding the activities they carry out, in search of opportunities for improvement.
• For this reason, continuous improvement must be a permanent objective for everyone, and must apply to all activities carried out at ORIENTEED, S.L.

The participation and collaboration of all parties involved is required, and therefore this Policy is distributed to all company staff for their awareness and understanding, as well as to the relevant interested parties for the organization.

For the effective application of these principles, the support of both the management team and the workforce is absolutely essential.

Management
A Coruña, May 16, 2026.