YOUNET DIGITAL LIFE S.A. INTEGRATED INFORMATION SECURITY & BUSINESS CONTINUITY POLICY

1. Purpose and scope

YOUNET DIGITAL LIFE S.A.  provides digital services and solutions, including website and application development, digital content creation and management, and support for digital projects in the private and public sectors. Information security and business continuity are fundamental to the reliability of our services and to the trust placed in us by clients, partners and other stakeholders.

This Integrated Policy sets out the core principles applied by Younet to protect information and information assets and to maintain or timely restore critical operations in the event of disruption, technical failure, cyber incident or other adverse event. It applies, as appropriate, to personnel, partners, information systems, cloud services, facilities, projects and information handled by the company, in accordance with each party’s role and authorization.

2. Information security principles

Younet applies a risk-based approach and seeks to preserve the confidentiality, integrity and availability of information. Accordingly, the company is committed to:

• protecting information belonging to clients, employees, partners and the company against unauthorized access, disclosure, alteration, loss or destruction;
• applying access controls based on the principle of least privilege and systematically managing user accounts, credentials and access rights;
• implementing appropriate technical and organizational measures for the security of networks, endpoints, applications, data and cloud services;
• integrating security requirements into the design, development, testing, change and maintenance of digital solutions in line with security-by-design principles;
• maintaining backups and recovery mechanisms appropriate to the criticality of data and services;
• identifying, assessing and treating information security risks and reviewing the effectiveness of related controls;
• managing security incidents promptly, limiting their impact, preserving appropriate evidence where required, and supporting necessary notifications to relevant parties;
• assessing, proportionately to risk, suppliers and external partners that have access to information, systems or critical services.

3. Protection of personal and confidential information

Personal data and confidential information are processed only for lawful and defined purposes, with appropriate safeguards and in accordance with applicable legal, regulatory and contractual obligations. Access is limited to persons who require it to perform their duties, and information is retained only for as long as necessary for the processing purpose or relevant obligations.

4. Business continuity and resilience

Younet plans for business continuity so that it can respond effectively to disruptions and restore critical services within acceptable timeframes. This approach includes identifying critical activities and dependencies, assessing potential impacts, setting recovery priorities, and maintaining appropriate continuity and recovery arrangements.

Continuity measures consider, where relevant, loss of access to facilities, power or telecommunications outages, hardware or software failures, unavailability of critical cloud or third-party services, cyberattacks, loss or corruption of data, and unavailability of key personnel. Relevant procedures and arrangements are periodically tested and reviewed to ensure that they remain practical and effective.

5. Incident management and recovery

Employees and partners are expected to report without undue delay any suspected or confirmed event that may affect information, systems or service availability. Younet assesses severity, activates appropriate response and recovery actions, coordinates internal and external communications, and implements corrective actions based on lessons learned.

6. Secure development and operation of digital services

For web and software development services, Younet applies appropriate controls throughout the development lifecycle to reduce technical vulnerabilities and configuration errors. Changes to production environments are controlled and implemented in a manner designed to reduce the risk of unauthorized modification, data loss or service disruption. Technical monitoring, patch and vulnerability management, and backup arrangements are adapted to the criticality of each system or project.

7. People and security awareness

Security is a shared responsibility. Younet provides personnel and partners with role-appropriate information and awareness on secure system use, credential protection, phishing and social engineering, handling of confidential information, secure remote working and timely incident reporting.

8. Compliance and continual improvement

Younet monitors relevant legal, regulatory, contractual and business requirements and pursues continual improvement of its information security and business continuity measures. This Policy provides the framework for establishing, monitoring and reviewing information security and business continuity objectives aligned with business priorities and the prevailing level of risk. The effectiveness of implemented measures is evaluated through reviews, tests, incident monitoring and corrective actions. Management supports the implementation of this Policy and, in proportion to needs and risks, provides the resources required to protect information and strengthen service resilience.

9. Policy review

This Policy is reviewed periodically and, at a minimum, whenever significant changes occur in services, technology, business requirements, the regulatory environment or the company’s risk profile. The current version is made available through the corporate website.

10. Contact

For questions regarding this Policy or to report matters related to information security and the availability of digital services, please contact YOUNET DIGITAL LIFE S.A. at info@younet.digital.