Security Policy

1. Purpose

Bdeo, aware that the security of information relating to our clients is a critical resource, has established an Information Security Management System in accordance with the requirements of the National Security Framework (ENS) and standards ISO/IEC 27001, 27017 and 27018, in order to ensure the continuity of information systems, minimise the risks of harm, ensure that established objectives are met, and maintain the security and privacy of personal data in the cloud.

The objective of the integrated Policy is to establish the framework of action necessary to protect information resources against threats — internal or external, deliberate or accidental — in order to ensure compliance with the confidentiality, integrity and availability of information.

This document forms part of the ISMS subject to the following security certifications:

Standard 27017 — Security of cloud services.
Standard 27018 — Protection of personal data in the cloud.
Standard 27001 — Information security management systems.
National Security Framework (ENS).

2. Responsibilities

The effectiveness and application of the Integrated Management System is the direct responsibility of the Information Security Committee, which is responsible for the approval, dissemination and compliance of this Security Policy.

Every person whose activity may be directly or indirectly affected by the requirements of the Information Security Management System is obliged to strictly comply with the Security Policy.

3. Development

Bdeo will implement all measures necessary to comply with applicable regulations on security in general and on IT security — covering IT policy, the security of buildings and facilities, and the conduct of employees and third parties associated with Bdeo in the use of IT systems. The measures necessary to ensure information security through the application of standards, procedures and controls must ensure the confidentiality, integrity and availability of information, essential for:

Contributing through information security management to fulfilling the mission and objectives established by Bdeo.
Defining information security responsibilities and generating the corresponding organisational structure.
Complying with current legislation on information systems.
Ensuring the confidentiality of data managed by Bdeo.
Ensuring the information security requirements applicable to the design and implementation of cloud services.
Reducing the risks of authorised privileged information.
Ensuring the isolation of clients of multi-tenancy and cloud services (including virtualisation).
Ensuring the protection and confidentiality of client assets.
Applying access control procedures.
Properly managing cloud-based information throughout the entire client account lifecycle.
Communicating security breaches to the parties involved and establishing information exchange guidelines to assist investigations and forensic analysis.
Ensuring the availability of information systems, both in the services offered to clients and in internal management.
Ensuring the capacity to respond to emergency situations, restoring the operation of critical services in the shortest possible time.
Avoiding undue alterations to information.
Promoting awareness and training in information security.
Establishing objectives and targets focused on evaluating performance in information security and on continual improvement in our activities, as regulated in the Management System that operationalises this policy.

3.1 Scope of application

This Policy applies to all information systems and all personal data processing activities for which Bdeo is responsible or a processor. The obligation to be aware of and comply with this Policy extends to all Bdeo employees, as well as collaborators and any person who has access to the organisation's information and/or systems and all its infrastructure.

3.2 Bdeo's objectives and mission

Bdeo is a privately held limited liability company whose mission is to optimize the processes of insurance companies and fleet management firms in order to improve their results and offer an experience tailored to today's user.

Bdeo seeks to promote the use of new technologies in the provision of its services, always remaining mindful of the commitment to build the necessary trust between citizens and Bdeo.

3.3 Principles and guidelines

In order to achieve compliance with Royal Decree 311/2022 of 3 May, which regulates the National Security Framework (ENS) — setting out basic principles and minimum requirements — and with standards ISO/IEC 27001, 27017 and 27018, Bdeo has implemented various security measures proportionate to the nature of the information and services to be protected, taking into account the category of the systems involved.

3.3.1 Security as a comprehensive, least-privilege process

Security is understood as a comprehensive process made up of all the technical, human, material, legal and organisational elements related to the system. The application of the National Security Framework at Bdeo will be guided by this principle, which excludes any isolated action or ad hoc treatment.

The utmost attention will be paid to raising awareness among the people involved in the process and their line managers, in order to ensure that ignorance, lack of organisation and coordination, or inadequate instructions do not become sources of security risk.

Information systems must be designed and configured granting the minimum privileges necessary for their correct operation, which entails incorporating the following aspects:

The system will provide only the functionality strictly necessary for the organisation to fulfil its competential or contractual objectives.
Operational, administrative and activity-logging functions will be kept to the minimum necessary, and it will be ensured that they are only carried out by authorised persons, from likewise authorised locations or devices; where applicable, restrictions on hours and authorised access points may be required.
In a production system, functions that are unnecessary or inappropriate to the purpose sought will be eliminated or deactivated through configuration control. Normal use of the system must be simple and secure, such that insecure use requires a conscious act on the part of the user.
Security configuration guides for the various technologies will be applied, adapted to the system's categorisation, in order to eliminate or deactivate functions that are unnecessary or inappropriate.

3.3.2 Continuous monitoring, periodic reassessment, integrity, system updating and continuous improvement of the security process

Bdeo's continuous monitoring will enable the detection of anomalous activities or behaviour and a timely response.
Permanent assessment of the security status of assets will enable measurement of their evolution, detecting vulnerabilities and identifying configuration weaknesses.
Security measures will be periodically evaluated and updated, adapting their effectiveness to the evolution of risks and protection systems, and may lead to a full reconsideration of the security approach if necessary.
The inclusion of any physical or logical element in the updated asset catalogue of the system, or any modification to it, will require prior formal authorisation.
Permanent evaluation and monitoring will enable the security status of systems to be adjusted in response to configuration weaknesses, identified vulnerabilities and applicable updates, as well as the early detection of any incident occurring within them.
The comprehensive security process implemented must be continuously updated and improved. To this end, nationally and internationally recognised criteria and methods for the management of information technology security will be applied.

3.3.3 Personnel management and professionalism

All personnel — internal or external — associated with Bdeo's information systems within the scope of the ISMS will be trained and informed of their duties, obligations and responsibilities in the area of security. Their conduct will be supervised to verify that established procedures are being followed.

The meaning and scope of secure use of the system will be set out and reflected in security regulations approved by management or the relevant governing body. Likewise, the training and experience requirements for personnel in the performance of their roles will be determined.

The security of information systems will be attended to and reviewed and audited by qualified, dedicated and trained personnel at all stages of the lifecycle: planning, design, acquisition, construction, deployment, operation, maintenance, incident management and decommissioning.

In an objective and non-discriminatory manner, organisations that provide services to us will be required to have qualified professionals with appropriate levels of management maturity and service quality.

3.3.4 Risk-based security management, risk analysis and risk management

Risk analysis and management will be an essential part of the security process and will be a continuous and permanently updated activity.

Risk management will enable the maintenance of a controlled environment, minimising risks to acceptable levels. Reduction to these levels will be achieved through the appropriate application of security measures, in a balanced and proportionate manner to the nature of the information processed, the services to be provided, and the risks to which they are exposed.

This management will be carried out through the analysis and treatment of risks to which the system is exposed. Without prejudice to the provisions of Annex II, an internationally recognised methodology will be used. The measures adopted to mitigate or eliminate risks must be justified and, in any event, proportionate to those risks.

3.3.5 Security incidents — prevention, detection, response and recovery

Bdeo has security incident management procedures in place in accordance with applicable requirements, as well as detection mechanisms, classification criteria, analysis and resolution procedures, and communication channels for the parties involved.

System security encompasses actions relating to prevention, detection and response, with the aim of minimising vulnerabilities and ensuring that threats to the system do not materialise, or that if they do, they do not seriously affect the information it handles or the services it provides.

Prevention measures may include components aimed at deterrence or at reducing the attack surface; they must eliminate or reduce the possibility of threats materialising.

Detection measures will be aimed at identifying the presence of a cyber incident.

Response measures will be managed in a timely manner and will be focused on restoring the information and services that may have been affected by a security incident.

The information system will guarantee the preservation of data and information in electronic format.

Likewise, the system will keep services available throughout the entire lifecycle of digital information, through a design and set of procedures that form the basis for the preservation of the digital heritage.

3.3.6 Lines of defence and protection against other interconnected information systems

Bdeo has implemented an information system protection strategy consisting of multiple layers of security — comprising organisational, physical and logical measures — such that when one layer has been compromised, an adequate response to incidents that could not be prevented can be developed, reducing the probability of the system being compromised as a whole and minimising its overall impact.

The perimeter of the information system will be protected — particularly when Bdeo's systems connect to public networks as defined in current telecommunications legislation — reinforcing the tasks of prevention, detection and response to security incidents.

In all cases, the risks arising from the interconnection of the system with other systems will be analysed and the connection point will be controlled.

3.3.7 Differentiation of responsibilities, organisation and implementation of the security process

Bdeo has organised its security by engaging all members of the organisation through the designation of different security roles with clearly differentiated responsibilities, as set out in the corresponding section of this document.

3.3.8 Authorisation and access control

Bdeo has implemented access control mechanisms for the information system, limiting access to duly authorised users, processes, devices and other information systems, and exclusively to permitted functions.

3.3.9 Facilities protection

Bdeo has implemented physical access control mechanisms, preventing unauthorised physical access as well as damage to information and resources, through security perimeters, physical controls and general area protections.

3.3.10 Acquisition of security products and procurement of security services

For the acquisition of security products or procurement of security services, Bdeo will give appropriate consideration — in proportion to the system's category and determined security level — to those products and services whose security functionality related to the purpose of their acquisition has been certified.

For the procurement of security services, the provisions on professionalism set out above will be observed.

3.3.11 Protection of stored and in-transit information and business continuity

Bdeo will pay particular attention to information stored or in transit through portable or mobile devices, peripheral devices, information media and communications over open networks, which must be specifically analysed to achieve adequate protection.

Procedures will be applied to guarantee the recovery and long-term preservation of electronic documents produced by the information systems within the applicable scope, where this is required.

All information on non-electronic media that has been the direct cause or consequence of electronic information within the scope must be protected to the same degree of security as the electronic information. To this end, the measures appropriate to the nature of the medium will be applied, in accordance with applicable regulations.

Systems will have backup copies and the necessary mechanisms will be established to guarantee the continuity of operations in the event of loss of the usual means.

3.3.12 Activity logging and malicious code detection

Bdeo, with the aim of fulfilling the purpose of this policy, and with full guarantees of the rights to honour, personal and family privacy and personal image of those affected, and in accordance with regulations on the protection of personal data, civil service or employment law, and other applicable provisions, will record user activities, retaining only the information strictly necessary to monitor, analyse, investigate and document improper or unauthorised activities, making it possible to identify the person acting at any given time.

In order to preserve the security of information systems, ensuring strict observance of applicable principles of conduct, and in accordance with the provisions of the General Data Protection Regulation and the principles of purpose limitation, data minimisation and retention period limitation set out therein, Bdeo may — to the extent strictly necessary and proportionate — analyse incoming or outgoing communications, and solely for information security purposes, so as to prevent unauthorised access to networks and information systems, halt denial-of-service attacks, prevent the malicious distribution of harmful code and other damage to said networks and information systems.

In order to enable correction or, where applicable, attribution of responsibility, each user accessing the information system must be uniquely identified, so that it is known at all times who receives access rights, of what kind, and who has carried out a particular activity.

3.4 Organisation and responsibilities

3.4.1 Management Committee

The Management Committee plays a fundamental role as the body responsible for setting security objectives in line with the context, vision and mission of Bdeo.

3.4.1.1 Functions

The functions of the Management Committee are as follows:

Approve the Corporate Security Policy, which must be signed by Senior Management.
Approve the Security Regulations.
Ensure compliance with applicable legal and sector-specific regulations.
Ensure the alignment of security activities with the organisation's objectives.
Designate the Information and Service Managers.

3.4.2 Information Security and Data Protection Committee (CSIPD)

For the appropriate management of information security and its systems, Bdeo has established the Information Security and Data Protection Committee (CSIPD) as the executive decision-making body on Information Security and Data Protection actions required within the scope of Bdeo. Among the most important decisions of this Committee is the review and proposal for approval of the Information Security Policy, the Data Protection Policy, the Information Classification criteria, and the Risk Treatment Plan drawn up to mitigate those risks.

The Information Security and Data Protection Committee is responsible for developing the regulatory framework established by this Policy, through the definition of a set of rules and processes for the management of Information Security.

Likewise, this Committee, under the supervision of the Managing Director, defines the functions and responsibilities in the area of information security within its scope of action, and is responsible for designating the persons who carry them out.

Any exceptions applicable to compliance with this policy will be identified, recorded, analysed and assessed by the CSIPD, which will determine the most appropriate actions in each case, in accordance with the principles of proportionality and the related risk.

3.4.2.1 Functions

The functions of the Information Security Committee are as follows:

Attend to requests relating to Information Security from Bdeo and from the various security roles and/or areas, regularly reporting on the state of Information Security.
Provide advice on Information Security matters.
Resolve responsibility conflicts that may arise between different administrative units.
Promote the continual improvement of the Information Security management system. To this end, the Committee will:

Coordinate the efforts of different areas in the field of Information Security, ensuring that these are consistent, aligned with the agreed strategy, and avoiding duplications.
Propose Information Security improvement plans with their corresponding budget allocations, prioritising security actions when resources are limited.
Ensure that Information Security is taken into account in all projects from their initial specification through to their commissioning. In particular, the Committee must ensure the creation and use of shared services that reduce duplications and support the consistent operation of all ICT systems.
Monitor the main residual risks assumed by Bdeo and recommend possible courses of action with respect to them.
Monitor the management of security incidents and recommend possible courses of action with respect to them.
Draft and regularly review the Information Security Policy for approval by the Management Committee.
Draft the Information Security Regulations for approval in coordination with the Management Committee.
Verify information security procedures and other documentation for approval.
Promote training programmes aimed at educating and raising awareness among personnel in the field of Information Security and in particular with regard to the protection of personal data.
Promote and approve the training and qualification requirements for administrators, operators and users from an Information Security perspective.
Promote the conduct of periodic ENS and data protection audits to verify compliance with Bdeo's obligations in the field of Information Security.

Additionally, other functions may be delegated to another body of the entity with competence in the matter. Functions assigned to the Committee by another body may not be sub-delegated, although they may be revoked at any time.

3.4.2.2 Composition

The CSIPD is constituted by persons proposed by the Management Committee and will represent the various interests of Bdeo with respect to business and technology, selecting individuals with a good knowledge of the Organisation's culture, mission and vision. Appointments are permanent until the express resignation of members or the termination of their relationship with the Company.

Chairperson: CEO
Information Manager(s): COO
Service Manager(s): COO
Security Manager: Platform Lead
System Manager: VP of Technology

Additionally, depending on the topics to be discussed, the CSIPD may invite specialist advisory members to participate without voting rights, with the aim of enriching the Committee's decisions through technical, functional or regulatory contributions.

These advisory members may include, among others:

The Data Protection Officer (DPO), for matters relating to personal data protection, impact assessments, audits or regulatory compliance.
The Human Resources Manager, for matters involving people management, employment privacy or organisational culture.
Other expert profiles, internal or external, whose involvement is deemed necessary for the proper treatment of a specific item on the agenda.

The Information and Service Managers will be convened depending on the matters to be addressed. The CSIPD may assume the functions and obligations of the Information and Service Managers in those cross-cutting actions where requested and/or deemed necessary.

Furthermore, and on an optional basis, specialised working groups — whether internal, external or mixed — may be incorporated into the Committee's activities.

Vacancies arising in the CSIPD will be filled on the proposal of the Management Committee, the Information Security Manager or any of its members, and will be designated by the CSIPD itself.

CSIPD members will be renewed every four years or upon a vacancy arising.

3.4.3 Information Manager

The Information Manager defines the security requirements for the information being operated and assesses the impact of incidents that may affect its security and continuity. They bear ultimate responsibility for the use made of the information under their charge and, therefore, for its protection.

3.4.3.1 Functions

The following functions are attributed to the Information Manager:

Establish and approve the security requirements applicable to information within the framework established in Annex I of Royal Decree 311/2022 of 3 May, the CCN-STIC guides of the CCN, and the standards ISO/IEC 27001, 27017 and 27018, following a proposal from the Security Manager and/or CSIPD.
Accept the residual risk levels affecting the Information.

3.4.4 Service Manager

The Service Manager defines the security requirements for the service under their charge and assesses the impact of incidents that may affect its security and continuity. They bear ultimate responsibility for the use made of the services under their charge and, therefore, for their protection.

3.4.4.1 Functions

The following functions are attributed to the Service Manager:

Establish and approve the security requirements applicable to the service within the framework established in Annex I of Royal Decree 311/2022 of 3 May, the CCN-STIC guides of the CCN, and standards ISO/IEC 27001, 27017 and 27018, following a proposal from the Security Manager and/or CSIPD.
Accept the residual risk levels affecting the Service.

3.4.5 Information Security Manager

The Information Security Manager will ensure that the policies, decisions and projects established within the scope of the Information Security and Data Protection Committee are carried out correctly and efficiently. They are also the body responsible for taking the initiative to establish the technical and organisational mechanisms necessary to detect, prevent and avoid risks affecting Bdeo's information security. These mechanisms will be established within their scope of action, in accordance with the expectations and needs expressed by the various business areas of the Company.

3.4.5.1 Functions

The Security Manager will perform the following functions:

Maintain and verify the appropriate level of security of the Information handled and the electronic services provided by the information systems.
Develop training and awareness plans in the field of information security.
Designate those responsible for conducting the risk analysis and the statement of applicability.
Identify the security measures that need to be implemented.
Determine the necessary configurations and prepare system documentation.
Provide advice for the determination of the system's category, in collaboration with the System Manager and/or CSIPD.
Participate in the development and implementation of security improvement plans and, where applicable, continuity plans, and proceed to their validation.
Ensure that specific security measures are properly integrated within the general security framework.
Collaborate, where required, in the development and implementation of security improvement plans and, where applicable, continuity plans.
Ensure that established security controls are strictly complied with.
Supervise hardware and software installations, their modifications and improvements, to ensure that security is not compromised and that at all times they comply with the relevant authorisations.
Monitor the security status provided by security event management tools and technical audit mechanisms.
Manage external or internal system reviews.
Manage certification processes.

3.4.6 System Manager

The System Manager defines the security requirements for the information systems under their responsibility and assesses the impact of incidents that may affect their security. They bear ultimate responsibility for the use made of the information systems under their charge and, therefore, for their protection.

3.4.6.1 Functions

The System Manager will perform the following functions:

Halt or suspend access to information or service provision if they become aware that these present serious security deficiencies.
Develop, operate and maintain the information system throughout its entire lifecycle.
Develop the necessary operational procedures.
Define the topology and management of the Information System, establishing the criteria for use and the services available within it.
Provide the Security Manager and/or CSIPD with advice for the determination of the System's Category.
Carry out the functions of the system security administrator.
The management, configuration and updating, where applicable, of the hardware and software underpinning the security mechanisms and services.
The management of authorisations granted to system users, in particular the privileges granted, including monitoring of the activity carried out in the system and its correspondence with what has been authorised.
Approve changes to the current configuration of the Information System.
Ensure that approved procedures for handling the Information System are applied.

3.4.7 DPO

The DPO will have the following functions:

Supervision of compliance with data protection regulations and the applicable regulatory framework.
Effective implementation of regulatory and compliance policies.
Follow-up on data protection audits, risk analyses and implemented controls.
Advisory support in conducting Data Protection Impact Assessments (DPIAs).
Supervision and updating of the Record of Processing Activities.
Advisory support and resolution of queries related to data protection.
Review and drafting of contractual clauses on data protection matters.
Liaison with the Spanish Data Protection Agency (AEPD), where necessary.
Promotion of data protection training and awareness among Bdeo employees.

3.4.8 Designation procedure

The Information and Service Manager will be designated by the Management Committee. The Security Manager and the System Manager will be designated by the CSIPD on the basis of the characteristics, type and context of the services and information supported by the information systems, always taking into account the requirements set out in Article 13 of Royal Decree 311/2022 and in standards ISO/IEC 27001, 27017 and 27018.

The CSIPD will also be responsible for duly communicating the appointment to the person or collegiate body designated, and acceptance of the appointment will be implicit. The designation is considered accepted unless an explicit communication of non-acceptance is received by any of the CSIPD members making the appointment.

Security roles will be reviewed every four years. In the event of a vacancy, it must be filled within one month, following the same procedure.

The designation process for the Security Committee (CSIPD) is formalised through the approval and digital signature of the corresponding designation document (Annex V MG01), which will be updated as the Committee designates successive responsible persons.

3.4.9 Conflict resolution

If a conflict arises between the Responsible Managers, it will be resolved by the CSIPD or by the body to which it has delegated this function.

3.4.10 Other responsibilities

Solution Architect: responsible for conducting security risk analyses, managing and controlling user access to systems, and supporting the security managers in multiple technical processes related to the protection of information and technological infrastructure.
QA Lead: responsible for validating that changes and new functionalities incorporated into Bdeo's products meet the established minimum security criteria, ensuring that software quality includes adequate protection against risks and vulnerabilities.
Operations Specialist: provides operational support to the security managers. Key functions include coordinating security training and awareness activities for employees, supporting the updating and dissemination of security policies, collaborating in security management with external suppliers, and managing the security of workstations in coordination with the IT company.

3.4.11 Responsibilities of employees and collaborators

All Bdeo employees and collaborators share responsibility for the protection of business assets and processes, and must use them in a professional and responsible manner in terms of confidentiality, integrity, availability, authenticity and traceability.

All employees and collaborators must be aware of, accept and comply with the Policy and the internal regulations derived from it. They are obliged to maintain professional secrecy and the confidentiality of information handled in their work environment, and must communicate — urgently and in accordance with established procedures — any possible security incidents or problems detected.

3.5 Information security documentary structure

The regulatory framework is mandatory and is structured around three levels:

Security Policy: Constituted by the present document.
Security Regulations: Defines the standards and considerations to be taken into account in the field of information security. Develops "What must be done".
Security Procedures: Develop how what is stipulated in the regulations is carried out. Develops "How it must be done".

In addition to the documents cited above, security documentation may include other documents such as recommendations, best practices, reports, records, electronic evidence, etc. All procedures and regulations are recorded in the list of documents and records (RE01 PE01).

3.6 Risk management, including risks arising from the processing of personal data

Risk management must be carried out on a continuous basis with respect to the information system, in accordance with the principles of risk-based security management and periodic reassessment, and will be the basis for determining the security measures that must be adopted.

The risk analysis will be carried out regularly, at least once a year, as well as in the following circumstances:

When the information handled changes.
When the services provided change.
When a security incident occurs that causes serious harm.
When vulnerabilities are reported that could cause serious harm.

The same risk management process will serve to determine the appropriate security measures for the protection of personal data contained in Bdeo's information assets.

In any event, all of Bdeo's information systems will comply with the security requirements defined by the data controller for the personal data processed by those systems, in accordance with the requirements of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016; Organic Law 3/2018 of 5 December; Organic Law 7/2021 of 26 May; and the guidelines and standards issued by the Data Protection Officer. The risk analysis is carried out using a semi-formal methodology based on MAGERIT, as defined in the Assessment and Treatment of Risks Procedure (PRD043).

3.7 Dissemination and application of the Information Security Policy

This Information Security Policy will be approved by Bdeo's Board of Directors and disseminated to interested parties, both internal and external.

This Corporate Information Security Policy applies, on a mandatory basis, to all information, all employees, directors and board members, all information systems managed by Bdeo and all Company processes — including all its business lines — as well as to all entities involved with it in the use of its information and systems. It therefore also applies to all persons with access to these, even where their relationship is not of an employment nature.

When third-party services are used or information is transferred to third parties, they will be made aware of this Security Policy and the security regulations applicable to such services or information. That third party will be subject to the obligations set out in those regulations and may develop their own operational procedures to satisfy them.

Where services are provided or information is managed on behalf of other entities, those entities will be made aware of this Information Security Policy, channels will be established for reporting and coordination between the respective security bodies or managers, and operational procedures will be established for responding to security incidents.

Where any aspect of this Policy cannot be satisfied by third parties as required in the preceding paragraphs, a report from the Information Security Department will be required specifying the risks being incurred and the manner in which they are to be treated. The report will be required to include a favourable conclusion before proceeding with the management of the affected information.

For all purposes, this security policy is signed by the organisation's security officers as well as by management.

Revision date: 06/16/2026