Integrated Policy for Quality, Social Responsibility, Diversity and Inclusion, Gender Equality, Information Security and Business Continuity

Agilelab's strategic mission is to guide companies toward the use of cutting-edge software that leverages artificial intelligence and real-time data processing.

The activities carried out by the organization consist of:

• Research, study, design, construction and marketing of information technology, telematics, processing and computation systems.
• Design and implementation of technological and operational platforms for managing and archiving all types of data, including personal data.
• Creation, commercial management, and consulting for "virtual spaces" such as websites, social network platforms, and forums.
• Application services (software development services, software maintenance, application management, specialist support and parameterization and customization of commercial solutions) and services similar to such services.

Agilelab has implemented its Management System compliant with the international standards ISO 9001, ISO/IEC 27001 (with the application of the ISO/IEC 27017 and 27108 guidelines), ISO 22301 and ISO 27701, integrated with social responsibility in compliance with SA8000, Gender Equality with PdR 125 and Diversity and Inclusion with ISO 30415. This integrated system allows us to guarantee internal efficiency, an adequate level of security and internal worker satisfaction, information security and personal data protection, with a better predisposition to meet customer needs.

Agilelab has decided to adopt an integrated policy, so as to unambiguously direct the choice of strategies and consequent activities.

The company intends to strengthen its market presence by achieving important objectives, ranging from strengthening its image to market knowledge, and the awareness that the introduction and use of an integrated management system within the company increases the possibility of achieving full customer satisfaction through the ability to offer customized products and services, capable of innovating the target market and generating stable and continuous growth in complete safety and always guaranteeing operational continuity.

In defining its policy, Agilelab considered:

• Full satisfaction of customer expectations explicitly defined in the documents and implicitly in the need to be accompanied to the result;
• Respect for diversity and equal treatment in every area of the organization;
• Compliance with mandatory requirements, as well as those established independently by the company, as well as international regulations, universally accepted principles and fundamental ILO standards;
• Continuous improvement of its processes, through activities based on verifying their effectiveness, as well as their efficiency and, therefore, their real applicability to the production context;
• Risk and opportunity analysis;
• Personal needs and expectations of members, directors, but, above all, workers;
• The contributions expected from suppliers.

The company's primary commitment is to provide a service in line with market expectations, providing innovative, constantly updated services that meet customer requirements.

Agilelab is committed to maintaining a high standard of its services and ensuring that they meet the requirements of the same.

Furthermore, it is committed to maintaining a policy of transparency. To this end, it has created a website that allows interested parties to view the features of its services. Significant information can also be found in the Handbook, available for public consultation, which contains all the information relating to the functioning of the company organization, relevant to the personnel involved in carrying out activities and to external stakeholders.

We believe the IT sector has an important role to play in finding sustainable solutions to today's climate challenges.

We will work with stakeholders to fight climate change through awareness-raising actions on the issue.

Through ISO 14064-1 certification, also known as Carbon Footprint, we are committed to monitoring the environmental impact of our business throughout its life cycle (LCA), enabling us to adopt the most sustainable approach possible, in accordance with our corporate principles and organizational structure.

The ability to provide efficient and effective products and services, while maintaining the necessary quality in relation to the price set by the market, is an essential requirement for the company.

Agilelab monitors customer satisfaction levels to verify the effectiveness of its processes and initiate corrective actions if necessary.

With this in mind, the company is committed to selecting its suppliers with particular attention to ensuring a high-quality service.

Agilelab is committed to analyzing the risks and opportunities to which it is exposed, as well as the market in which it operates and its competitors, in order to manage, in the most effective way possible, possible interferences and problems, before they materialize.

Agilelab, through its IT resources, is able to offer a high-level product and service.

Information security

Management guarantees the protection and safeguarding of all threats, internal or external, intentional or accidental:

• of the information necessary for the business of Agilelab;
• of its customers' information that is managed throughout the life cycle of the products and services provided to them in compliance with the provisions of EU Regulation 679/2016 and associated standards, as well as the ISO 27701 and ISO 27001 standards.

The Integrated Management System of Agilelab defines a set of organizational, technical and procedural measures to ensure compliance with the basic security requirements listed below:

• Confidentiality: the information must be known only to those with appropriate privileges;
• Integrity: the information must be modifiable only and exclusively by those who have the privileges;
• Availability: Information must be accessible and usable when required by processes and users with the appropriate privileges. Availability objectives include resilience objectives.

This policy defines the information and personal data security principles that guide the behavior of the subjects to whom it is addressed, within the scope of the ISMS, as well as the implementation of processes, procedures, instructions, the adoption of practices and other controls within the ISMS.

The following are the principles that determine and support the definition and implementation of the SGI to guarantee information security:

1. All information essential to the service (such as technical and commercial documents, source code, configuration information, service-related emails, customer-provided information, personnel data, etc.) must be protected.
2. All information to be protected must be managed according to the assigned classification level, in compliance with the relevant procedures, throughout its entire life cycle.
3. Information security is a key aspect in the success of Agilelab and to achieve business objectives.
4. Maintaining ISO 27001 and ISO 27701 certifications provides tangible, visible and third-party assessable evidence of the company's commitment to Agilelab to ensure information security and protect personal data.
5. All those who, in any capacity, come into contact with the information to be protected have a direct role in the success of that protection. It is, therefore, their direct and explicit responsibility to adhere to the principles contained in this policy and all applicable security policies related to it and to ensure compliance.
6. Information security is designed and implemented to be an integral part of ordinary business processes and behaviors, and defined in a way that does not compromise their suitability for the organization's goals and objectives.
7. The achievement of security objectives is governed through a risk-based approach, which involves the application of a risk management process that takes into account the context of the organization, the scope of the ISMS, and the organization's objectives.
8. The organization adopts a structured process for managing information security incidents aimed at limiting their impact, identifying their causes, and facilitating their removal. All parties affected by the ISMS are required to report any anomalous or suspicious circumstances regarding information.
9. Security in cloud services: The organization implements specific measures to ensure that cloud services are secure, in line with ISO/IEC 27017, protecting data from unauthorized access.
10. Personal data protection: Compliance with ISO/IEC 27018 is ensured to protect personal data in cloud services, preventing privacy breaches.

Agilelab has dedicated competent personnel to:

• Issue all necessary regulations, including the type of document classification, so that the company organization can conduct its activities safely;
• Adopt criteria and methodologies for risk analysis and management;
• Suggest organizational, procedural and technological security measures to protect the safety and operational continuity of activities;
• Periodically monitor the exposure of company services to major threats;
• Investigate security incidents and take appropriate countermeasures;
• Promote a culture of information security and personal data protection.

All external subjects who have relationships with Agilelab must ensure compliance with the security requirements set out in this policy, including by signing a "confidentiality agreement" when assigning the task, unless otherwise expressly stated in the contract.

The information and data security objectives of Agilelab are defined in relation to strategic and business objectives, in compliance with contractual commitments and applicable regulations. The achievement of these security objectives is planned, implemented, monitored, and controlled with the support of a specific risk management methodology.

Business Continuity

The objectives of this Business Continuity Policy can be identified in the following points, shared by all the offices of agilelab:

• Ensure business continuity and minimize impacts on the business in the event of a crisis, ensuring a rapid restoration of normal operations;
• Protect the interests of Agilelab and increase the trust of its customers and partners, ensuring continuity of service to comply with the constraints arising from current regulations and contractual obligations, as well as to ensure its reliability towards customers;
• Maintain an active, effective, certified Business Continuity Management System that is proven effective in its practical application, compliant with the ISO 22301 standard.

The goal is to minimize the effort required to verify compliance with customer requirements.

The following are the principles that determine and support the definition and implementation of the ISMS to ensure Business Continuity:

1. The Business Continuity Management System is defined and maintained according to an outlined process and reviewed on a regular basis to ensure compliance with legal obligations, standards and recognised best practices;
2. Business services and the factors involved in their delivery (Personnel, Organizational Locations and ICT Systems) are identified, assessed for criticality and documented based on contractual, business and internal requirements;
3. Business Impact Analysis (BIA) and risk analysis are performed on the services provided by the organization that fall within the scope of the management system, according to a defined process and on a regular basis;
4. The business continuity management system is directed and consistent with business needs. Business Units play a central role in defining the system's strategy and execution;
5. All personnel must be informed of the existence of the business continuity policies established within the company, have access to them and contribute responsibly to their application and improvement;
6. Business continuity plans and disaster recovery plans are defined, documented and tested on a regular basis to ensure the adequacy and continuous updating of the technical and organizational solutions adopted, as well as training plans for all personnel and entities involved;
7. Business continuity is integrated into change management and the development of new services, ensuring continuous improvement and increasing the organization's resilience to adverse events;
8. Third parties and subcontractors with a critical role in the provision of services must be aware of and comply with the adopted business continuity policies;

We are committed to continuously adapting and improving our Management System, as well as raising awareness and training our stakeholders regarding its correct application.

Based on the data provided by the Quality Manager, the General Management annually reviews and updates its policy, objectives, and related indicators to ensure they remain effective.

Diversity & Inclusion and Gender Equality

Agilelab promotes an inclusive, fair, and diversity-respecting work environment, valuing individual characteristics as a lever for growth and innovation.

In accordance with UNI/PdR 125:2022 and ISO 30415:2021, the organization has adopted a policy in favor of gender equality and diversity and inclusion (D&I), committing to:

1. Promote gender equality through the adoption of management systems that measure, monitor, and improve gender equality performance, integrating specific key performance indicators (KPIs) into organizational processes.
2. Value diversity in all its forms (gender, age, sexual orientation, culture, religion, ability, socio-economic background) and promote an inclusive corporate culture that recognizes its value as a source of innovation and development.
3. Ensure equal opportunities for access, growth, and career advancement, basing employee evaluations solely on merit, skills, and results, without discrimination of any kind.
4. Support work-life balance by promoting organizational flexibility, family welfare, and parenting initiatives, recognizing the importance of a work-life balance.
5. Train and raise awareness among all staff on issues of diversity, inclusion, and gender equality through ongoing training programs aimed at preventing stereotypes, prejudice, discrimination, harassment, or mobbing.
6. Ensure a safe environment and effective mechanisms for anonymously reporting any incidents that violate the principles of inclusion and equality.
7. Govern the D&I system through a Gender Equality Committee, responsible for promoting, implementing, and monitoring relevant policies, with periodic reports to the General Management.
8. Communicate and report on progress achieved through official documents and reports accessible to stakeholders, promoting transparency and accountability.

Agilelab recognizes that promoting an inclusive and equal culture significantly contributes to organizational well-being, customer satisfaction, and the company's long-term competitiveness. Diversity is considered a strategic resource for the organization's continuous improvement and sustainable development.

Any complaint regarding aspects pertaining to the application of the Gender Equality and D&I standards by Agile Lab (such as event of discrimination, mobbing, verbal/digital harassment, sexual harassment) can be forwarded directly to the following: link

If you report gender discrimination, violence, or harassment in the workplace that isn't addressed or adequately addressed within your organization, you can contact the local Equality Advisor.

The Equal Opportunities Advisors, appointed by the Provinces and Regions, work to support workers and can also take legal action in cases of discrimination, pursuant to Article 36 of Legislative Decree 198/2006.

Territorial references are available at the following link

Social responsibility

The objective of this policy is to comply with all the requirements of the SA8000 standard for worker protection, specifically by expressly prohibiting child labor, forced labor, human trafficking, and any form of discrimination, promoting the right to association and collective bargaining, respecting the disciplinary procedures set forth in the applicable national collective labor agreement, and ensuring remuneration and working hours that comply with current regulations.

The Management of Agilelab is committed to pursuing the objectives set out by adopting the tools provided for by the Integrated Management System and, specifically:

1. Conduct and review contextual factors and stakeholder needs to identify and assess system risks and opportunities;
2. Ensure that the Integrated Policy is disseminated, understood and implemented at all company levels, by all those who work on behalf of Agile Lab, as well as made available to all interested parties;
3. Use technologies aimed at continuously improving product quality, environmental protection and safety, as well as adopting the best techniques available on the market to improve the performance of the works;
4. Communicate the integrated management system policy and objectives to stakeholders;
5. Communicate company performance, through the planned issuance of the Sustainability Report, to all stakeholders, encouraging their involvement;
6. Train and raise awareness among all staff, and in particular those responsible for implementing the Integrated Management System, so that the guidelines of this policy and the specific objectives regarding quality, the environment, safety, and social responsibility are understood and implemented by all staff at all levels;
7. Periodically evaluate, through internal audits, the Integrated Management System's compliance with the relevant standards, its own policies, and its plans and programmes; in particular, verifying the achievement of the established objectives through periodic management reviews;
8. Continuously improve the Integrated Management System based on the results of the reviews;
9. Implement the involvement of all workers in company life by introducing procedures and tools to foster dialogue and improve the corporate climate;
10. Implement continuous improvement of communication, information and stakeholder engagement channels;
11. Promote supplier engagement and implement awareness-raising/monitoring systems to verify compliance with worker health and safety and social responsibility requirements.

Any complaints regarding aspects relating to Agile Lab's application of the SA8000 standard can be forwarded directly to the email address segnalazioniSA8000@agilelab.it and to the following link

For SAAS SAI and TUV references in relation to the SA8000 certification, the contact details are:

SAI

New York, USA Phone: 212-684-1414 Fax: 212-683-8867 Email:info@sa-intl.org

SAAS

Social Accountability Accreditation Services tel: (212) 391-2106 fax: (212) 684-1515 saas@saasaccreditation.org

TÜV Italia SRL

Tel: +39 02 24130 1 Fax: +39 02 24130 399 tuv.ms@tuvsud.com