Information Security and Privacy Policy

01Introduction and commitment

The Management of MTechnology S.A.S., understanding the strategic importance of information as a vital asset for achieving our vision and serving as catalysts of digital transformation, firmly commits to the implementation, operation and continual improvement of an Information Security Management System (ISMS).

02Purpose

This policy sets out the high-level statement that guides the position and commitment of MTechnology S.A.S. regarding the comprehensive protection of its information assets. Its purpose is to define the general framework for managing security and privacy, ensuring that the controls needed to maintain trust and achieve our objectives are implemented.

03Security and privacy objectives

MTechnology S.A.S. recognizes that information is one of its most valuable and strategic assets, and that safeguarding and properly managing it is essential to ensure operational continuity, the trust of its stakeholders and regulatory compliance. The objectives are structured as pillars of the ISMS, aligned with the ISO/IEC 27001 standard and MinTIC Guide No. 2:

04Scope and applicability

This policy applies to all employees, contractors, suppliers and third parties who access the information assets of MTechnology S.A.S.

05Level of compliance

100% compliance is required. Non-compliance will carry the consequences defined in section 8 of this policy.

06Security principles and policies

MTechnology S.A.S. adopts the following principles as the pillars of its ISMS:

1. Clear responsibilities. Information security responsibilities will be defined, shared, published and accepted by each team member and by the relevant third parties.
2. Asset protection. All information generated, processed or safeguarded by business processes, and the associated information assets, will be protected.
3. Third-party management. Information will be protected against risks arising from access granted to third parties: suppliers, clients and freelancers.
4. Proper use and classification. Information will be protected to minimize financial, operational or legal impacts from improper use, applying controls based on its classification.
5. Personnel security. Information will be protected from threats originating from personnel, through awareness, agreements and controls.
6. Physical and environmental security. Processing facilities, including remote ones, and the technology infrastructure that supports critical processes will be protected.
7. Operational security. The operation of business processes will be controlled, ensuring the security of technology resources and networks.
8. Access control. Strict access control to information, systems and network resources will be implemented, based on the principle of least privilege.
9. Security across the life cycle. Security will be ensured as an integral part of the life cycle of our systems and developments.
10. Incident and vulnerability management. Events and weaknesses will be properly managed for an effective improvement of the security model.
11. Business continuity. The availability of critical processes and the continuity of operations will be ensured.
12. Legal and contractual compliance. Compliance with legal, regulatory and contractual obligations will be ensured.

07Development of specific policies

To put these principles into practice, MTechnology S.A.S. will develop and implement specific policies, procedures and work instructions covering, at a minimum, the areas recommended by MinTIC Guide No. 2: organization of security, asset management, access control, cryptography, physical security, operations, communications, acquisition and development, supplier relationships, incident management, continuity and compliance.

08Non-compliance

Failure to comply with this general policy, or with the specific policies and procedures derived from it, will result in the appropriate contractual, disciplinary or legal actions, in accordance with the internal rules of MTechnology S.A.S. and applicable Colombian law.

09Review and continual improvement

This policy will be reviewed annually, or upon significant changes, by General Management.

10Approval

11Contact for questions or security reports

If you detect a vulnerability or a security incident related to our systems, please report it through the following channels: