Integrated Policy for Quality, Environment, Occupational Health and Safety, Social Responsibility, Diversity and Inclusion, Gender Equality, Information Security and Business Continuity

Agile Lab's strategic mission is to guide companies towards the use of cutting-edge software that leverages artificial intelligence and real-time data ingestion.

The organisation's activities include:

• Research, study, design, development and sale of IT, telematics, data processing and computing systems.
• Design and development of technological and operational platforms for managing and storing data of all kinds, including personal data.
• Development, commercial management and consulting for “virtual spaces”, such as websites, social networking platforms and forums.
• Application services (software development, software maintenance, application management, specialist support, configuration and customisation of commercial solutions) and comparable services.

Agile Lab has established a Management System aligned with the international standards ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 (applying the ISO/IEC 27017 and 27018 guidelines), ISO 22301 and ISO 27701, integrated with social responsibility under SA8000, gender equality under UNI/PdR 125 and Diversity and Inclusion under ISO 30415. The system supports internal efficiency, environmental protection, occupational health and safety, an appropriate level of security, employee satisfaction, information security and personal data protection, while improving the ability to meet customer needs.

Agile Lab has resolved to adopt an Integrated Policy to provide consistent direction for its strategic choices and resulting activities.

The Company aims to strengthen its market position by achieving important objectives, from enhancing its reputation and understanding of the market to recognising that an Integrated Management System increases its ability to achieve full customer satisfaction by offering customised products and services, driving innovation in its market and generating stable, sustained growth in a secure manner while ensuring business continuity.

In defining its policy, Agile Lab has considered:

• Fully meeting customers' expectations, both those explicitly set out in documents and those implicit in the need for support in achieving results;
• Respect for diversity and equal treatment throughout the organisation;
• Compliance with mandatory requirements and those voluntarily adopted by the Company, as well as international standards, universally accepted principles and the fundamental conventions of the ILO;
• Continual improvement of its processes through activities that assess their effectiveness, efficiency and practical suitability for the operating context;
• Analysis of risks and opportunities;
• The personal needs and expectations of shareholders, directors and, above all, workers;
• The contributions expected from suppliers.

The Company's primary commitment is to provide services that meet market expectations, delivering innovative, continuously updated solutions that fulfil customer requirements.

Agile Lab is committed to maintaining high service standards and ensuring that its services meet applicable requirements.

The Company also undertakes to maintain transparency. To this end, it operates a website through which interested parties can view the features of its services. The publicly accessible Handbook is another important source of information on how the organisation operates, relevant both to personnel involved in its activities and to external interested parties.

We believe that the IT sector plays an important role in finding sustainable solutions to today's climate challenges.

We will work with stakeholders to address climate change through awareness-raising initiatives.

By quantifying and reporting greenhouse gas emissions and removals at organisational level in accordance with ISO 14064-1, we commit to monitoring our carbon footprint as a basis for identifying improvement actions consistent with our corporate principles.

The ability to deliver efficient and effective products and services, maintaining the required quality in relation to market prices, is essential to the Company.

Agile Lab monitors customer satisfaction to assess process effectiveness and initiate corrective action whenever necessary.

Accordingly, the Company is committed to selecting suppliers with particular attention to ensuring high-quality service.

Agile Lab undertakes to analyse the risks and opportunities it faces, as well as its market and competitors, so as to manage potential interference and issues as effectively as possible before they materialise.

Through its IT resources, Agile Lab can deliver high-quality products and services.

Environment

Agile Lab recognises environmental protection as an integral part of its strategy and, in accordance with ISO 14001, manages the environmental aspects of its activities, products and services from a life-cycle perspective. To this end, it undertakes to:

• protect the environment and prevent pollution, with particular attention to the efficient use of resources, energy consumption and proper waste management, including waste electrical and electronic equipment (WEEE);

• contribute to climate change mitigation by monitoring its carbon footprint in accordance with ISO 14064-1 and pursuing reductions in greenhouse gas emissions, prioritising the most relevant areas, such as mobility and the purchase of goods and services;

• incorporate environmental criteria, where relevant and within its control or influence, into purchasing decisions, supplier management and the use of IT equipment and digital services, including their end-of-life management;

• fulfil applicable environmental compliance obligations;

• pursue continual improvement of the environmental management system to enhance environmental performance.

The Environmental Policy provides the framework for setting environmental objectives.

Top Management ensures that significant environmental aspects and compliance obligations are considered when establishing measurable objectives, monitoring performance and allocating the necessary resources.

Occupational Health and Safety

Agile Lab regards workers' health and safety as a primary value and, in accordance with ISO 45001 and Italian Legislative Decree 81/2008, undertakes to:

• provide safe and healthy working conditions to prevent work-related injury and ill health at all locations and under all working arrangements, including coworking spaces and remote working, consistently with the nature of occupational health and safety risks and opportunities;

• eliminate hazards and reduce occupational health and safety risks;

• assess and prevent, in accordance with the risks actually identified, those associated with display screen equipment, workstation ergonomics, work organisation and psychosocial factors, including in remote working arrangements;

• fulfil legal and other applicable requirements;

• ensure consultation and participation of workers and, where present, their representatives;

• encourage timely reporting of hazards, near misses and potentially harmful situations without retaliation, and remove barriers to worker consultation and participation;

• pursue continual improvement of the occupational health and safety management system.

The Occupational Health and Safety Policy provides the framework for setting related objectives.

Top Management supports implementation of the policy through clearly defined responsibilities, adequate resources, relevant information and training, and regularly monitored objectives and indicators.

Information Security

Top Management is responsible for safeguarding and protecting against all threats, whether internal or external, intentional or accidental:

• the information required for Agile Lab's business;
• customer information managed throughout the life cycle of products and services supplied to customers, in accordance with Regulation (EU) 2016/679 and related legislation, as well as ISO 27701 and ISO 27001.

Agile Lab's Integrated Management System establishes organisational, technical and procedural measures to ensure the following basic security requirements:

• Confidentiality: information must be accessible only to persons with appropriate privileges;
• Integrity: information may be modified only by persons holding the appropriate privileges;
• Availability: information must be accessible and usable when required by processes and authorised users. Availability objectives also include resilience objectives.

This policy sets out the information and personal data security principles guiding the conduct of those to whom it applies within the Information Security Management System (ISMS), as well as the implementation of processes, procedures, instructions, practices and other ISMS controls.

The following principles underpin the definition and implementation of the Integrated Management System to ensure information security:

1. All information essential to service delivery (including technical and commercial documents, source code, configuration information, service-related emails, customer-supplied information and personnel data) must be protected.

2. All information requiring protection must be managed throughout its life cycle in accordance with its assigned classification level and the relevant procedures.

3. Information security is fundamental to Agile Lab's success and the achievement of its business objectives.

4. Maintaining ISO 27001 and ISO 27701 certifications provides tangible evidence, visible and assessable by third parties, of Agile Lab's commitment to information security and personal data protection.

5. Everyone who comes into contact with information requiring protection plays a direct role in its security. Such persons are therefore expressly responsible for complying with the principles of this policy and all related applicable security policies.

6. Information security is designed and implemented as an integral part of ordinary business processes and conduct, without undermining their suitability for the organisation's purposes and objectives.

7. Security objectives are achieved through a risk-based approach involving a risk management process that takes account of the organisation's context, the ISMS scope and organisational objectives.

8. The organisation adopts a structured information security incident management process to contain impacts, identify causes and facilitate their elimination. Everyone covered by the ISMS must report anomalous or suspicious circumstances concerning information.

9. Cloud service security: the organisation implements specific measures to ensure secure cloud services in line with ISO/IEC 27017, protecting data against unauthorised access.

10. Personal data protection: compliance with ISO/IEC 27018 is ensured to protect personal data in cloud services and prevent privacy breaches.

Agile Lab has appointed competent personnel to:

• Issue all necessary rules, including document classification rules, to enable the organisation to carry out its activities securely;
• Adopt criteria and methodologies for risk analysis and management;
• Recommend organisational, procedural and technological security measures to protect the security and business continuity of operations;
• Periodically assess the exposure of the Company's services to major threats;
• Investigate security incidents and implement appropriate countermeasures;
• Promote a culture of information security and personal data protection.

All external parties dealing with Agile Lab must ensure compliance with the security requirements set out in this policy, including by signing a confidentiality agreement when appointed, unless such obligations are already expressly included in the contract.

Agile Lab's information and data security objectives are defined in line with strategic and business objectives, contractual commitments and applicable legislation. Their achievement is planned, implemented, monitored and controlled using a specific risk management methodology.

Business Continuity

The objectives of this Business Continuity Policy, shared across all Agile Lab locations, are:

• Ensure business continuity and minimise business impacts in the event of a crisis, enabling a rapid return to normal operations;
• Protect Agile Lab's interests and increase customer and partner confidence by ensuring service continuity, meeting applicable legal and contractual obligations and maintaining service reliability;
• Maintain an effective, operational and certified Business Continuity Management System that demonstrates its effectiveness in practice and complies with ISO 22301.

The aim is to minimise the activities required to verify compliance with customer requirements.

The following principles underpin the definition and implementation of the Information Security Management System in support of Business Continuity:

1. The Business Continuity Management System is established and maintained through a defined process, subject to regular review to ensure compliance with legal obligations, standards and recognised best practices;

2. Business services and the resources involved in their delivery (people, organisational locations and ICT systems) are identified, assessed for criticality and documented against contractual, business and internal requirements;

3. Business Impact Analyses (BIA) and risk assessments are carried out at regular intervals through a defined process for the services within the scope of the management system;

4. The Business Continuity Management System is driven by business needs. Business Units play a central role in its strategic and operational definition;

5. All personnel must be informed of the Company's business continuity policies, have access to them and contribute responsibly to their implementation and improvement;

6. Business continuity and disaster recovery plans are defined, documented and tested regularly to ensure the adequacy and continuous updating of technical and organisational solutions, as well as training plans for all personnel and entities involved;

7. Business continuity is integrated into change management and the development of new services, ensuring continual improvement and increasing the organisation's resilience to adverse events;

8. Third parties and subcontractors with a critical role in service delivery must be aware of and comply with the adopted business continuity policies;

We undertake to adapt and continually improve our Management System and to raise awareness and train our stakeholders in its proper implementation.

On the basis of data provided by the Quality Manager, General Management annually reviews and updates its policy and the related objectives and indicators to ensure their continued effectiveness.

Any amendments to this policy are subject to Management approval before issue and communication.

Diversity & Inclusion and Gender Equality

Agile Lab promotes an inclusive, equitable workplace that respects diversity and values individual characteristics as drivers of growth and innovation.

In accordance with UNI/PdR 125:2022 and ISO 30415:2021, the organisation has adopted a Gender Equality and Diversity & Inclusion (D&I) Policy and undertakes to:

1. Promote gender equality through management systems that measure, monitor and improve gender equality performance, incorporating specific key performance indicators (KPIs) into organisational processes.

2. Value diversity in all its forms (gender, age, sexual orientation, culture, religion, abilities and socioeconomic background) and promote an inclusive corporate culture that recognises diversity as a source of innovation and development.

3. Ensure equal opportunities for access, development and career progression, basing employee assessment solely on merit, skills and results, without discrimination of any kind.

4. Support work-life balance through organisational flexibility, family welfare measures and protection of parenthood, recognising the importance of balancing professional and personal life.

5. Train and raise awareness among all personnel on diversity, inclusion and gender equality through continuous training programmes designed to prevent stereotypes, prejudice, discrimination, harassment and bullying. In roundtables, conferences, workshops, seminars, scientific events and outreach initiatives organised, promoted or sponsored by the Company, Agile Lab undertakes to ensure balanced gender representation among speakers, moderators and panel participants, subject to the professional skills required and the availability of the individuals identified.

6. Ensure a safe environment and effective mechanisms for anonymously reporting incidents contrary to the principles of inclusion and equality.

7. Govern the D&I system through a Gender Equality Committee responsible for promoting, implementing and monitoring the relevant policies, with periodic reports to General Management.

8. Communicate and report progress through official documents and reports accessible to interested parties, fostering transparency and accountability.

Agile Lab recognises that promoting an inclusive and equitable culture makes a significant contribution to organisational well-being, customer satisfaction and the Company's long-term competitiveness. Diversity is regarded as a strategic resource for continual improvement and sustainable organisational development.

Where reports of gender discrimination, violence or workplace harassment do not receive an adequate response or handling within the organisation, the persons concerned may contact the competent Equality Adviser (Consigliera di Parità).

Equality Advisers, appointed at provincial and regional level, support workers and may also take legal action in cases of discrimination pursuant to Article 36 of Italian Legislative Decree 198/2006.

Local contact details are available at: https://www.lavoro.gov.it/ministro-e-ministero/Organi-garanzia-e-osservatori/ConsiglieraNazionale/Consigliera-nazionale-di-parita/Pagine/default

Social Responsibility

The purpose of this policy is to comply with all SA8000 requirements for the protection of workers, expressly prohibiting child labour, forced labour, human trafficking and all forms of discrimination; promoting freedom of association and collective bargaining; complying with disciplinary procedures under the applicable National Collective Bargaining Agreement; and ensuring remuneration and working hours comply with applicable legislation.

Agile Lab's Management undertakes to pursue these objectives using the tools provided by the Integrated Management System, specifically to:

1. Identify and review contextual factors and the needs of interested parties, identifying and assessing system risks and opportunities;

2. Ensure that the Integrated Policy is communicated, understood and implemented at all organisational levels by everyone working on behalf of Agile Lab and made available to all interested parties;

3. Use technologies aimed at continually improving product quality, environmental protection and safety, and adopt the best technologies available on the market to improve operational performance;

4. Communicate the Integrated Management System policy and objectives to stakeholders;

5. Communicate corporate performance to all stakeholders through the planned publication of a Sustainability Report, encouraging their involvement;

6. Train and raise awareness among all personnel, particularly those responsible for implementing the Integrated Management System, so that the guiding principles of this policy and specific objectives for quality, environment, safety and social responsibility are understood and adopted at every level;

7. Periodically assess, through internal audits, the conformity of the Integrated Management System with reference standards, the Company's policy and planned arrangements, in particular verifying achievement of objectives through periodic management reviews;

8. Continually improve the Integrated Management System on the basis of management review results;

9. Engage all workers in corporate life by introducing procedures and tools to promote dialogue and improve the workplace climate;

10. Continually improve channels for communication, information and stakeholder engagement;

11. Encourage supplier involvement and implement awareness-raising and monitoring systems to verify compliance with occupational health and safety and social responsibility requirements.

Any complaint concerning Agile Lab's application of the SA8000 standard may be sent to segnalazioniSA8000@agilelab.it or submitted at: https://www.agilelab.it/sa8000-breach-reporting-system.

The contact details for SAI, SAAS and TÜV regarding SA8000 certification are:

SAI

New York, USA; Phone: 212-684-1414; Fax: 212-683-8867; Email: info@sa-intl.org

SAAS

Social Accountability Accreditation Services; Phone: 212-391-2106; Fax: 212- 684-1515; Email: saas@saasaccreditation.org

TÜV Italia SRL

Phone: +39 02 24130 1; Fax: +39 02 24130 399; Email: tuv.ms@tuvsud.com