General Information Security Policy

1. Preamble, Purpose and Corporate Scope

This policy establishes the strategic framework and the mandatory guidelines that govern information security management within ACL Tecnología SpA (hereinafter "ACL"), ensuring the confidentiality, integrity, availability and resilience of the organization's information assets. ACL has an Information Security Management System (ISMS) certified under the international standard ISO/IEC 27001:2022. This policy applies in full to all personnel, contractors, suppliers, agents (mandatarios) and authorized third parties who access, process, store, transmit or delete ACL information, regardless of the medium or format used. The detailed operational management of each information security domain is governed, on a complementary basis, by the specific policies and internal procedures of the Management System referenced in this policy.

2. Principles and Risk-Based Approach

ACL adopts a risk-based approach to information security management, through which threats that could affect the confidentiality, integrity or availability of its information assets are systematically identified, assessed and treated. ACL's Top Management expresses its explicit commitment to establishing, maintaining, communicating and continually improving the Information Security Management System, ensuring the resources required for its effective operation. This commitment translates into the clear definition of principles, roles and responsibilities, compliance with the applicable legal, regulatory and contractual requirements, and the promotion of a culture of continual improvement that allows security controls to adapt as risks and the business evolve.

3. Information Security Objectives

The framework for setting information security objectives is defined and reviewed annually by the Information Security Committee, as part of the Management Review process. At that review, the General Manager sets the strategic guidelines and each responsible management area aligns its own objectives with them, as established in the Management Review and Continual Improvement procedure. The current objectives, their performance indicators and their associated targets are formally recorded in the Management Review minutes for each period, which constitute the official and up-to-date reference for monitoring and audit purposes. Achievement of the objectives is monitored periodically by the Head of Quality, Security and Compliance and reported to the Information Security Committee.

4. Governance: Information Security Committee

ACL formally establishes an Information Security Committee as the governance body of the ISMS, composed of the General Manager, the Head of Quality, Security and Compliance and the Head of Support. The Committee is chaired by the Head of Quality, Security and Compliance and meets monthly, and may also be convened on an extraordinary basis in the event of significant incidents or relevant changes in the risk context. The Committee's functions are: to oversee the effectiveness of the ISMS; to review the status of information security risks, incidents and treatment plans; to validate compliance with the applicable regulatory, legal and contractual requirements; and to escalate to Top Management any matters that, due to their criticality, require its approval or the allocation of additional resources.

5. Roles and Responsibilities

The General Manager approves this policy and its updates, and is responsible for the formal acceptance of information security risks rated as non-tolerable. The Information Security Committee oversees the operation of the ISMS as described in the previous section. The Head of Quality, Security and Compliance is responsible for coordinating the implementation, operation and continual improvement of the ISMS, managing the information security risk and incident cycle, and keeping the Management System documentation up to date. The Head of Support is responsible for the technical operation of information security controls, technology continuity, and access and infrastructure management. All personnel, contractors, suppliers and third parties who access ACL information are responsible for knowing and complying with this policy and for promptly reporting any non-compliance, risk or incident related to it.

6. Regulatory Framework and Legal Compliance

ACL ensures that its information security management complies with the applicable legal, regulatory and contractual requirements. This policy is governed by the international standard ISO/IEC 27001:2022, which sets out the requirements for an Information Security Management System, and by ISO/IEC 42001:2023 with respect to the governance of the artificial intelligence systems used by the company. On the legal front, ACL complies with Ley N° 19.628 sobre Protección de la Vida Privada (Law on the Protection of Private Life), as amended by Ley N° 21.719; Ley N° 21.459 on cybercrime; Ley N° 21.663, which establishes the Framework for Cybersecurity and Critical Information Infrastructure; Ley N° 21.643 on workplace and sexual harassment; Ley N° 20.393 on the criminal liability of legal entities; and the Labor Code (Código del Trabajo). Where contractually applicable, ACL also complies with the PCI DSS v4.0.1 standard for the protection of cardholder data.

7. Governance of Artificial Intelligence Systems (ISO/IEC 42001:2023)

ACL makes an explicit commitment to the responsible development and use of the artificial intelligence systems that form part of its processes and services, in line with the principles of governance, risk management, transparency and non-discrimination set out in the international standard ISO/IEC 42001:2023. This commitment includes substantial human oversight and intervention (human-in-the-loop) in relevant decisions arising from the use of artificial intelligence systems, the integration of the risks associated with those systems into the company's overall information security risk management framework, and compliance with the legal, ethical and contractual requirements applicable to their development and operation. The scope, design and operating parameters of each artificial intelligence system in use are formally defined and regulated in the specific procedures for each business process.

8. Specific Policies of the Management System

This policy is complemented by a set of specific policies that develop each area of the Information Security Management System in detail, and compliance with them is equally mandatory for all ACL personnel, contractors, suppliers and third parties:

• PSI-02 Cloud Environments Policy
• PSI-03 Secure Development Policy
• PSI-04 Access Control Policy
• PSI-05 Cryptography and Malware Protection Policy
• PSI-06 Information Transfer Policy
• PSI-07 Remote Work Policy
• PSI-08 Supplier Relationship Policy
• PSI-09 Privacy and Personal Data Protection Policy
• PSI-10 Acceptable Use of Information Assets and AI Systems Policy
• PSI-11 Information Backup Policy
• PSI-12 Clear Desk and Clear Screen Policy
• PSI-13 End-User Devices Policy

9. Information Security Risk Management

ACL manages information security risks through a systematic annual process, led by the Information Security Committee, which includes identifying risks together with the heads of each area, assessing them according to their likelihood and impact on information assets, and defining treatment plans consistent with the level of risk tolerance. The methodology for asset valuation, the rating of inherent and residual risk, and the criteria for risk acceptance, mitigation, transfer or avoidance are formally set out in procedure PRSI0601 Information Security Risks.

10. Incident Management and Business Continuity

Any information security event or breach that compromises the confidentiality, availability or integrity of ACL's information assets immediately triggers the information security risk and incident management process, as set out in procedure PRSI1601 Information Security Risk and Incident Management. This process includes the classification of incidents by severity, the corresponding internal notification and escalation timeframes, and timely notification to the competent authority and to affected data subjects or clients when required by Ley N° 21.663—which requires significant incidents to be reported to the National CSIRT—or by Ley N° 19.628 as amended by Ley N° 21.719, which require personal data breaches to be notified within a maximum of 72 hours. In addition, ACL maintains a Business Continuity Plan, reviewed annually and subject to periodic tests and drills, in accordance with procedure PRSI1701 Business Continuity Procedure, in order to ensure the availability of its critical services in the face of events that could disrupt its operations.

11. Change Control and Periodic Review

This policy is formally reviewed at least once a year, or on an extraordinary basis in the event of significant technological changes, operational restructuring or applicable legislative amendments. Each updated version of the document will be officially published indicating its version number and effective date.