Information security policy

Management policy and commitment to information security

Information security is extremely important to Promoservice Parma s.r.l. (hereinafter 'the Organisation'). It therefore undertakes to honour its commitments to protect clients' information security, as described below.

While information is essential to delivering higher-quality services, the most important asset is the careful security management of information systems and all information processed, making every effort to ensure availability, confidentiality and integrity. Protecting clients' information and using it only as they request is an absolute priority for everyone in the Organisation. This led to the project to achieve certification under ISO/IEC 27001:2022.

The Organisation, through ISO/IEC 27001:2022 certification covering the 'Information security management system for the IT infrastructure used to provide customer care and customer service'.

It therefore undertakes to:

• Protect all information provided by clients according to strict security and confidentiality standards.
• Limit the collection and use of personal information to the minimum necessary to provide clients with quality service, including advice on new services and, more generally, all activities offered.
• Allow access to personal information about its customers only to authorised employees or personnel who have received appropriate training in handling that information correctly. Employees who breach this confidentiality commitment will be subject to proportionate disciplinary action.
• Do not disclose personal information about service users or clients to any external organisation unless the user has consented through clear privacy notices or otherwise given express consent. This does not affect the Organisation's obligation to provide such information in compliance with laws, regulations or EU rules.
• Continuously monitor the confidentiality of information received from users. If, in the course of its activities, the Organisation puts a client in contact with other companies or bodies that send service offers to that user, the Organisation will ensure that those companies do not retain client information unless the clients have consented and have formally expressed a specific interest in its disclosure or communication.
• Maintain the strictest confidentiality over data, documents and information acquired during its activities and strictly observe the prohibition on disclosing information or, more generally, the contents of client statements to third parties. In particular, do not use, disclose or copy commercial or technical documents or other information for third parties, or transfer, deliver or deposit those documents with others without the client's written consent;
• Maintain the strictest confidentiality, including on the part of employees and collaborators, over data and information acquired while managing the client's information.
• Require organisations engaged to provide support services to adhere to its information security standards and allow their compliance to be monitored.
• Do not use or disclose, internally or externally, personal or sensitive information that identifies clients, or information entrusted to the Organisation in providing the requested service. If such information is essential to providing other services, the Organisation may use it only with clients' prior written consent, given when the information is provided or subsequently, and, where required by law, only with prior authorisation from the competent authorities in the territories where it operates.
• Make every effort to ensure that information held in client records is accurate, complete and up to date. The Organisation will inform clients how and where they can access information about them (except where prohibited by law) and how to report any errors, which the Organisation will correct promptly.
• Continuously monitor the work of authorised personnel to ensure compliance with information security requirements and manage activities in a way that respects the commitment to protect client confidentiality in every process in which it operates.
• Define the policies and procedures governing information security management in accordance with the scope and context of certification, communicate them to all relevant staff, and monitor their implementation and continuous updating.
• Promote continuous improvement in the management system's effectiveness through planned internal audits, ongoing monitoring of process indicators and objectives to be implemented in the improvement plan.
• Comply with applicable mandatory regulations.

Document classified as 'Public', approved by Senior Management on 27 February 2026.