Information Security Policy

Objective and scope

The Information Security Policy establishes an organizational culture focused on protecting information, so that all of Swapo's activities follow good security practices and the requirements of the LGPD (Brazil's General Data Protection Law).

The policy seeks to ensure the confidentiality, integrity and availability of the information under Swapo's responsibility, including data of clients, business partners and suppliers.

It applies to all users of Swapo's assets and information: employees, service providers and other authorized persons or organizations, regardless of the relationship. Every internal project, regardless of complexity, must consider the policy's guidelines and the risks involved.

Principles and guidelines

The policy adopts as its pillars the confidentiality, integrity and availability of information belonging to Swapo or under its responsibility, with the aim of mitigating risks and the likelihood of harm. It also establishes:

• ethical and transparent use of information and technology tools, in respect of the principles of confidentiality and purpose;
• segregation of duties, with documented and defined authorization levels;
• security measures proportional to the risks of processing personal data;
• consideration of security guidelines in every internal project;
• continuous updating of security techniques, with preventive and proactive improvement proposals.

Information classification

The policy requires that information be classified according to its importance, with controls and handling defined for each level. The information owner is responsible for classifying it. The classification must provide for:

• information levels, such as confidential, restricted, internal and public;
• protection controls associated with each level;
• classification period;
• degree of risk in case of exposure;
• person responsible for access to the information.

The policy also provides for clean desk and clean screen practices to avoid exposure of information.

Access control and communications

Access control manages and restricts people's access to Swapo's physical and logical environments. The policy provides for:

• individual, personal and exclusive identification of each user, with access profiles defined by position and area and a justification for each profile assigned;
• segregation of duties and documented approval authority levels;
• multi-factor authentication on critical systems and administrative accounts;
• access logs and audit trails on all critical systems;
• restriction on the use of external devices that are not approved;
• physical access control to the premises, with registration of visitors, providers and suppliers, and monitoring and intrusion detection.

For communications and the transfer of information, the policy provides for confidentiality and integrity controls, use of encryption, network restriction and segregation, logging, monitoring and detection mechanisms, and information traceability controls.

Risk and incident management

The Information Technology (IT) area is responsible for managing risks and incidents related to assets. The goal is to prevent unavailability of activities and, in case of interruption, to restore normal operation as quickly as possible, reducing losses.

Swapo must maintain a risk identification structure and an internal control environment that reduces the likelihood of events that materialize those risks.

Anyone who identifies an incident must report it immediately to the IT area. The IT area must promptly inform the data protection officer, Legal and Compliance, who assess the legal risks and the necessary measures.

The policy provides for a Business Continuity Plan with risk and incident management actions, including procedures for information leakage or loss and server intrusion, recovery time and recovery point objectives, and the list of authorities that must be notified in a timely manner.

It also provides for a technical vulnerability management procedure, with an inventory of the assets that handle information, control and restriction of software installation, defined technical owners and adequate backups.

Third parties, cloud and international transfer

The IT area must monitor the hiring and maintenance of third parties and third-party software that may pose a risk of leakage or irregular processing of personal data.

Contracting services that use servers in other countries may imply an international data transfer. For this reason, each case must be assessed in advance by the IT area, by reading the terms of use and the contracts regarding the technical aspects and data storage.

International transfer of personal data may only occur to countries with a level of protection equal to or higher than that required by the LGPD, or through technical and legal safeguards defined in dedicated instruments. The policy requires a standard contractual clause, adequate technical mechanisms and the recipient's commitment to the LGPD obligations.

Personal data protection

The policy integrates personal data protection into information security. It provides for:

• privacy by default: assessment of collection and retention practices to avoid excessive data processing;
• privacy by design: privacy and data protection controls when implementing new technologies;
• assessment of data protection in systems whenever data management and protection practices change;
• support from the IT area to the data protection officer in implementing mechanisms that guarantee data subjects' rights;
• analysis of personal data breaches and leaks, with collection of technical evidence and referral to Legal when necessary.

Culture and training

The Executive Board of Officers must establish rules, procedures and training and awareness activities that encourage compliance with the policy.

The IT area must provide specific training to avoid human error, with guidance on spam, phishing, password sharing and other practices that may create vulnerabilities.

Managers must set an exemplary standard and disseminate the guidelines to their teams, making clear, from hiring, which assets and security activities are each user's responsibility.

Users must read, understand and fully follow the policy and related rules. The policy provides for a commitment statement to the security rules, to be signed by users.

Responsibilities, sanctions and review

• Executive Board of Officers: establish rules, procedures and awareness actions and help disseminate and review the documents.
• Information Technology area: provide a secure environment and infrastructure, identify and publicize alerts about new threats, define asset inventory guidelines, follow internal projects, maintain and help update the policies and report information security matters to the data protection officer.
• Managers and other areas: disseminate and comply with the policy and apply segregation of duties.
• Users: know and follow the policy and related rules.

Non-compliance with the policy may lead to administrative or contractual sanctions, according to the disciplinary procedures in force.

The policy is dated September 21, 2026. The Executive Board of Officers takes part in its review, and the IT area helps update it.

Legal basis

• Law No. 13,709/2018 (General Data Protection Law).
• BCB Resolution No. 85/2021, the rule applicable to the disclosure of the summary of the general lines of the cyber security policy (not cited in the filed document).

About this version

Public version of the document “Information Security Policy”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center