Governance Information security, data protection and confidentiality As a responsible company, we take the confidentiality of information, the protection of personal data and the protection of operational and business secrets very seriously. Information security is therefore extremely important to us. We have an Information Security Management System (ISMS) in place that guarantees the confidentiality, availability and integrity of our company-relevant data and systems, ensures that the necessary information security measures are implemented throughout the company and enables us to make ongoing improvements to our information security processes. Our ISMS is based on the requirements of ISO / IEC 27001. All data generated in the course of our business activities is processed with utmost care, and we implement strict security mechanisms in line with data protection legislation. Our data security processes are monitored via our data security platform, which is responsible for protecting data across the company and the first port of call in the event of a data security breach or similar. In addition to prioritising information security and data protection, we also believe that it is vitally important to protect operational and business confidentiality. We have a number of technical, legal and organisational mechanisms in place to protect the confidential information of both of the Blum Group and of its brands as well as our interests and reputation more generally. For instance, we place restrictions on the content and the type and volume of information that we share internally, with third parties and with the public. We also make our employees aware that operational and business confidential information must be treated with the utmost care and only shared with third parties once a confidentiality agreement has been signed. Where operational and business confidential information needs to be shared internally or externally – whether digitally, in person on paper – this is done on a strictly "need-to-know" basis in line with our central precept for the handling of sensitive information. Security and data protection incidents are reported immediately, reviewed and handled in accordance with defined processes. We initiate measures immediately to mitigate the damage, carry out root cause analyses and take preventive steps to avoid future incidents. In order to permanently raise awareness in relation to the protection of sensitive information, we conduct regular training and implement measures to educate all employees. In doing so, we ensure that information security as well as data and confidentiality protection are firmly anchored in all areas of our company. 79
RkJQdWJsaXNoZXIy