Information Security Policy

01 Purpose and management commitment

Talent Lab, S.L. and Kenjo GmbH, hereinafter Kenjo, develop, operate and support a software-as-a-service platform for human resources management, aimed at small and medium-sized enterprises in Europe.

In carrying out this activity Kenjo processes personal data belonging to its customers' staff, including personnel files, payroll, absences and performance reviews, acting as processor on behalf of those customers. Customer trust depends directly on Kenjo's ability to protect that information, and that is the reason this Policy exists.

Kenjo's Management assumes leadership of information security and establishes this Policy as the reference framework for its Information Security Management System, in accordance with ISO/IEC 27001:2022. Management commits to providing the resources needed for the system to operate and to promoting its continual improvement.

02 Regulatory framework and references

This Policy is established in accordance with the requirements of ISO/IEC 27001:2022 concerning leadership and the information security policy.

Kenjo operates through two legal entities established in two countries, so the General Data Protection Regulation applies as the common framework, together with Spanish and German data protection legislation and any other requirements applicable in each jurisdiction. Kenjo also assumes the security commitments agreed contractually with its customers; where those commitments are more demanding than the regulatory requirements, they prevail.

03 Provisions

3.1 Scope

This Policy applies to all information within the scope of the Information Security Management System: the development, operation and support of the Kenjo platform, the customer-facing processes and the organization's two sites, located in Madrid and Berlin.

It binds all staff of both entities, as well as the external collaborators and suppliers who access Kenjo's information or systems. Acceptance of its principles is a condition of access.

3.2 What we protect

Kenjo protects the information it manages, and as a priority the information its customers entrust to it, based on three properties:

• Confidentiality: information is accessible only to those who are authorized and have a legitimate need. Kenjo's platform is designed so that no customer organization can access another's information.
• Integrity: information is accurate and complete, and every significant modification is logged so that it can be audited.
• Availability: information and the service are available to those who need them when they need them, with the ability to recover from incidents.

Protection extends to the personal data processed on customers' behalf, in respect of which Kenjo applies the technical and organizational measures required by data protection legislation, including encryption of information in transit and at rest.

3.3 How we manage risk

Kenjo periodically identifies and assesses the risks that may affect information security, considering both threats in its environment and its own technological dependencies, and decides how to treat them according to the resulting risk level.

Risks that are accepted are accepted expressly by the person with the responsibility and authority to do so. Risks to be treated generate actions with an assigned owner and a due date, and their completion is verified. This assessment is reviewed at least annually and upon any significant change in the activity, the technology or the regulatory environment.

3.4 Framework for objectives

This Policy provides the framework within which Kenjo sets its information security objectives. The objectives are measurable, have an assigned owner and are reviewed periodically, and are aimed at the following:

• Protecting entrusted information: protecting the confidentiality, integrity and availability of customer information.
• Sustaining continuity: keeping the service available and able to recover from incidents.
• Compliance: meeting the legal, regulatory and contractual requirements applicable in the two jurisdictions in which Kenjo operates.
• Responding: detecting, responding to and learning from security incidents.
• Building capability: keeping staff trained and aware of their security responsibilities.

3.5 Security organization

Management has established an Information Security Committee with authority over both legal entities, which governs the system, approves its documents and decides on the treatment of risks.

Operational responsibility for information security rests with the Information Security Officer, a function performed by the Chief Technology Officer. Kenjo has also formally designated an external data protection officer.

3.6 Obligations of people and third parties

Everyone who accesses Kenjo's information is responsible for protecting it. In particular, they must use the organization's resources appropriately, keep their credentials secure and never share them, handle information in accordance with its classification level, and immediately report any security incident or suspected incident.

Suppliers and external collaborators are subject to the security and confidentiality obligations Kenjo establishes contractually, proportionate to the access granted to them. Kenjo assesses the security of its suppliers before engaging them and periodically reviews those that are critical to the service.

3.7 Verification and continual improvement

Kenjo periodically verifies the effectiveness of its management system through internal audits, compliance reviews and technical security testing performed by independent third parties. Management reviews the system at least once a year.

Deviations identified are recorded, their causes are analysed and corrected, and it is then verified that they do not recur. Kenjo understands continual improvement not as a statement but as a cycle backed by evidence: detect, correct, verify.

04 Management principles and commitments

• The information our customers entrust to us is the asset we protect most, because their trust and our business depend on it.
• Security is designed in from the start, not added afterwards.
• Each person accesses only the information they need for their work.
• Reporting an incident promptly is an opportunity to contain it. Reporting one never carries adverse consequences for the person who does so.
• We comply with the legislation of the two jurisdictions in which we operate and with the commitments we make to our customers.
• Management provides the necessary resources and is accountable for the system's operation.

05 Roles and responsibilities

• Management: establishes and approves this Policy, provides resources, holds ultimate responsibility for the system and reviews its effectiveness.
• Information Security Committee: governs the system for both entities, approves its documents and decides on the treatment of risks.
• Information Security Officer: directs the operation of the system, coordinates risk and incident management and verifies compliance with this Policy.
• Data Protection Officer: advises on and oversees personal data protection matters.
• All staff: apply this Policy, protect the information they access and report the incidents they detect.
• Suppliers and collaborators: meet the security obligations set out in their contracts and report any incident affecting Kenjo's information or services.

06 Compliance

Compliance with this Policy is mandatory. Non-compliance is handled in accordance with the organization's internal rules and the employment legislation applicable at each site, and may give rise to disciplinary measures, without prejudice to any legal liability that may apply.

In the case of suppliers and external collaborators, failure to meet the agreed security obligations may result in suspension of the access granted and termination of the contractual relationship.

07 System documentation and contact channels

This Policy is the highest-level document of Kenjo's Information Security Management System. The procedures, records and rules that implement it are for internal use and are not published; their complete list is maintained in the system's document index, available to auditors and to interested parties able to demonstrate a legitimate interest.

Kenjo maintains the following channels for information security matters:

• Reporting vulnerabilities and incidents: anyone, inside or outside the organization, may report a vulnerability or a security incident through the security channel published on the corporate website. Kenjo welcomes responsible disclosure and takes no action against those who report in good faith.
• Data protection: enquiries about the processing of personal data and the exercise of data subject rights are handled through the data protection mailbox indicated in the privacy policy.
• Customers: customers may request, through their usual contact, the information on security measures and certifications they require for their supplier assessment processes.

08 Approval, communication and review

This Policy is approved by Kenjo's Management. Once approved it is communicated to all staff at both sites, with acknowledgement of receipt recorded, and made publicly available on the corporate website.

It is reviewed at least once a year and, in any event, upon significant changes in the organization's activity, its structure, the technology underpinning the service or the applicable legal requirements. The current version is the published one; any earlier copy is superseded by it.