AI Experience Hub SL (Orakia)

Information Security Policy

Document SEG.00 · Version 1.1 · 21 September 2026

We publish this policy for customers, suppliers, partners and other interested parties. If you have any questions about it, write to us at [email protected].

This is an English translation provided for convenience. The approved version is the Spanish original, which prevails in case of discrepancy.

1. Purpose

This policy is the framework document of the Information Security Management System (hereinafter, the ISMS) of AI Experience Hub SL. Through it, management formalises its commitment to protecting the organisation's information assets and sets the frame of reference for establishing, implementing, maintaining and continually improving that system.

In carrying out its activity, AI Experience Hub SL recognises that information security is a strategic pillar for sustaining the trust of its customers, its staff and other interested parties. This policy aims to ensure the confidentiality, integrity and availability of the information the organisation handles, whatever its medium, format or location, aligning its protection with business objectives and with the legal, regulatory and contractual obligations the organisation has assumed.

This policy is maintained as documented information of the ISMS, is communicated to the people who work for or on behalf of the organisation and is made available to relevant interested parties when appropriate. It is the top-level reference from which the other specific ISMS policies, standards and procedures are developed, and these must be consistent with it.

General references: UNE-EN ISO/IEC 27001 clauses 5.1, 5.2 and 5.3; GDPR art. 5.1.f, art. 24 and art. 32; LOPDGDD (Spanish Data Protection Act) art. 5.

2. Scope

This policy applies to the information assets, processing systems, applications, media, business processes, cloud services and working environments within the formally defined scope of the ISMS of AI Experience Hub SL. It covers both the resources used from its registered office at Paseo de la Castellana 82, 1º Dcha., 28046 Madrid (Spain) and those used from any other authorised location where staff carry out their professional activity, including remote, hybrid and mobile working.

This policy applies to:

Staff and authorised users: all staff and authorised users who access information, documentation, systems, applications, equipment or resources of AI Experience Hub SL, regardless of their geographical location, the type of contract that binds them and the length of the relationship.
External organisations: service providers that have taken on the following roles: processor, joint controller, sub-processor, data recipient and services without data processing.

Provisions on physical and environmental security are applied in proportion to the scope of the ISMS, the risk assessment and the Statement of Applicability in force. Where AI Experience Hub SL does not operate its own access-controlled premises or data centres under its direct control, protection is built on the authorised working environments, the devices and services used, and the guarantees required from hosting, infrastructure and other relevant third-party providers.

3. Management commitment

The management of AI Experience Hub SL takes ultimate responsibility for information security, leads by example and expressly commits to:

Approving, disseminating and keeping up to date this policy and the set of policies and procedures that develop the ISMS.
Providing the human, technical and financial resources needed to implement, operate, review and improve the system.
Integrating information security requirements into business processes and decision-making.
Defining security roles and responsibilities and communicating them to the people concerned.
Promoting awareness and continuous training of staff.
Periodically reviewing the performance of the ISMS and driving the improvement actions that are needed.

4. Information security objectives

This policy provides the framework for setting, reviewing and maintaining the information security objectives of AI Experience Hub SL. The specific, measurable objectives of the ISMS, together with their owners, indicators, resources and follow-up deadlines, are documented and reviewed through the system's planning and monitoring process. Within this framework, the following strategic objectives are set:

Confidentiality: Preserve the confidentiality of customer, staff and company data, ensuring that only authorised people access information according to their operational need and the classification level assigned.
Integrity: Maintain the integrity of the information processed, so that data remain accurate, complete and protected against unauthorised modification throughout their life cycle.
Availability: Ensure the availability of services and supporting systems, so that interested parties can access information when they need it and within the committed timeframes.
Risk management: Manage information security risks through a systematic approach to identification, assessment and treatment that anticipates threats and reduces their potential impact on business objectives.
Compliance: Comply with the legal, regulatory and contractual requirements that apply to the protection of information, with particular attention to European and Spanish personal data protection law.
Security culture: Foster a shared security culture through awareness and continuous training of all staff, reinforcing individual responsibility for protecting information assets.
Continual improvement: Continually improve the effectiveness of the ISMS, using the lessons learned from incidents, audits and management reviews to drive the evolution of the system.

5. Core information security principles

The organisation bases its ISMS on a set of principles that guide all decisions, policies and controls on information protection.

SEG.00.A Risk-based approach

AI Experience Hub SL follows a risk management process that assesses the likelihood and impact of threats to its information assets and prioritises treatments according to the criteria defined in its assessment methodology. New services, significant changes and third-party relationships that could materially affect information security are assessed and managed under the applicable risk, change and supplier procedures before they go into production or are formalised, where appropriate.

SEG.00.B Shared responsibility

Information security is not delegated to a single department: everyone who accesses the organisation's systems or data plays an active role in protecting them. Management leads by example and provides the means for that commitment to translate into concrete actions across all functions.

SEG.00.C Acceptable use of information and resources

The organisation promotes responsible, documented use of its information assets. Every resource (data, system, device or service) is used exclusively for authorised purposes, within the limits set by internal classification rules and the access restrictions in force.

SEG.00.D Least privilege and access control

Access rights are granted according to operational need and the principle of least privilege. Access must be reviewed at the frequency and under the procedure defined by the organisation, and new access, changes and removals must be handled in a controlled way, leaving the traceability needed to prove their authorisation and execution.

SEG.00.E Classification and proportionate protection of information

Information is classified according to its sensitivity, its criticality and the legal or contractual requirements that apply to it. The classification level determines the protection measures required for its processing, storage, communication, transport and destruction, as well as who is authorised to access it.

SEG.00.F Clear desk and clear screen

The organisation puts measures in place to protect information shown on screen or held on paper against unauthorised viewing or access. Corporate or expressly authorised devices must lock the session automatically after a period of inactivity and require authentication to regain access, in line with the security configurations and standards approved by the organisation. Workspaces, whether on site or remote, must be kept free of sensitive documents when they are not in use.

SEG.00.G Security in third-party relationships

The organisation assesses relevant suppliers and collaborators according to the nature of the service, access to information, criticality and associated risk. Where applicable, obligations on security, confidentiality, incident notification, subcontracting and return or deletion of information are set out in contracts, and compliance with them is monitored as defined by the organisation.

SEG.00.H Continual improvement

The organisation commits to regularly assessing the suitability and effectiveness of the ISMS through internal audits, management reviews, performance indicators and incident analysis, using the conclusions to drive the evolution of its controls and processes.

6. Organisation and responsibilities

The organisation assigns the following information security roles and responsibilities, without prejudice to those set out in other internal policies and procedures:

Management: Approves the policy, allocates resources, reviews the performance of the ISMS and takes ultimate responsibility for information security.
Management system owner: Coordinates the implementation and maintenance of the ISMS, manages the risk analysis, centralises the receipt and handling of security incidents and reports results and improvement proposals to management.
Area or department heads: Ensure this policy is applied in their area, authorise the access their team needs to do its work and communicate changes that affect information security.
Staff and authorised users: Know and follow this policy and the rules that develop it, protect the information they access and promptly report any security event or suspected incident.
External suppliers and collaborators: Must meet the security and confidentiality obligations they have accepted by contract and the applicable instructions the organisation gives them, and report without undue delay any incident that could affect the information or the services provided.

Data Protection Officer. The organisation has a Data Protection Officer who acts independently, informs and advises management and the areas concerned, monitors compliance with personal data protection law and is the point of contact for the supervisory authority and for data subjects. You can reach the Data Protection Officer at [email protected].

7. Information security risk management

The organisation maintains a documented risk management process that covers identifying information assets and the threats and vulnerabilities that affect them, assessing risk in terms of likelihood and impact, setting acceptable risk levels and selecting the applicable treatments.

The risk analysis is reviewed at the frequency defined in the ISMS and also when changes occur that could materially alter the organisation's risk profile, such as the adoption of relevant services or technologies, significant organisational or technical changes, new third-party relationships with access to information or a relevant security incident.

Where processing of personal data is likely to result in a high risk to the rights and freedoms of individuals, the organisation will first carry out the corresponding data protection impact assessment and will seek the advice of the Data Protection Officer where applicable.

General references: UNE-EN ISO/IEC 27001 clauses 6.1 and 8.2; GDPR art. 32 and art. 35; LOPDGDD art. 28.

8. Protection of assets off the premises

A significant share of the organisation's information assets is used outside a corporate physical perimeter, whether because of mobility, remote working or the nature of the work itself. The organisation recognises this as a risk factor and commits to protecting those assets with measures proportionate to their value and to the sensitivity of the information they hold.

SEG.00.I Responsible custody of assets

Corporate or expressly authorised devices (laptops, mobile devices and, where applicable, storage media) must remain under the control of the person to whom they are assigned or authorised, with custody measures appropriate to the risk.

Keep the device with you or locked away.
Use the safe at your accommodation when travelling.
Lock the device whenever you stop using it.

Don't

Leave devices unattended in vehicles or on public transport.
Leave them in common areas of shared spaces.
Lend them to people outside the organisation.

SEG.00.J Transport conditions

Assets are always transported in personal custody. When assets need to be sent to collaborators, suppliers or other locations, a tracked courier service that confirms delivery is used.

Carry the device as hand luggage.
Use a tracked courier with proof of delivery.
Apply protection measures suited to the transfer, including encryption where applicable.

Don't

Check in devices or media that hold sensitive information.
Send them by ordinary post.
Hand them to third parties without recording the handover.

SEG.00.K Reporting loss, theft or damage

Any incident affecting an asset away from the usual workplace (loss, theft, damage or possible compromise) must be reported to the management system owner without undue delay and as soon as possible. As a maximum internal deadline, it must be reported within twenty-four hours of becoming aware of it, without waiting to confirm its full extent.

Report it immediately, even if you are unsure of the extent.
Say what information the device held.
Help with containment measures, including changing credentials and, where technically possible, remote locking or wiping.

Don't

Wait until you find the device before reporting it.
Try to fix it yourself without reporting it.
Keep using credentials that may be compromised.

Note. After the report, the containment measures that are technically available and appropriate to the risk will be assessed and carried out. These may include revoking access and sessions, changing credentials and, where the technical setup allows, remotely locking or wiping the device. The event will be recorded in the internal information security incident log and, where it may affect personal data, the corresponding breach management procedure will be applied.

SEG.00.L Return of assets

When the employment or commercial relationship, the project or the operational need that justified the assignment ends, the user returns all corporate assets to the organisation, with a documented record of the return that ensures full traceability of the resource's life cycle.

Return assigned devices, media and accessories.
Record the return through the asset assignment and return mechanism or log in force.
Hand over any corporate information you hold.

Don't

Keep copies of corporate information.
Delete or alter data on the device before returning it.
Pass the device directly to another person without recording it.

9. Reporting of security events and incidents

AI Experience Hub SL fosters an environment in which anyone can report security events or suspected incidents promptly and without fear of reprisal. The organisation maintains accessible channels for reporting and records relevant events and incidents under the established internal procedure, so they can be classified, analysed and handled and, where appropriate, corrective actions and lessons learned can be adopted.

Where an incident affects or may affect personal data, the internal security breach management procedure is applied according to the role of AI Experience Hub SL in the processing. When acting as controller, it will assess whether to notify the breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and whether to communicate it to data subjects where there is a high risk to their rights and freedoms. When acting as processor, it will inform the controller without undue delay in line with the applicable contractual and legal obligations.

General references: UNE-EN ISO/IEC 27001 clause 8 and Annex A.5.24 to A.5.28; GDPR art. 33 and art. 34.

10. Compliance, approval and review

Compliance with this policy is mandatory for all people and organisations within its scope. Non-compliance may be assessed under the applicable employment law, the disciplinary rules in force and the internal policies of AI Experience Hub SL and, for external suppliers and collaborators, under the contractual terms agreed and the applicable civil and commercial law, without prejudice to any administrative, civil or criminal liability that may arise.

When in doubt about how to act, the relevant person in charge must be consulted before taking any action that could affect the security, confidentiality, integrity or availability of information.

This policy comes into force once approved by the management of AI Experience Hub SL and remains in force until replaced by a later version. It will be reviewed at least once a year and also when relevant organisational, technological, regulatory or contractual changes occur, when the risk profile changes materially or after a significant security incident.

Exceptions to this policy must be justified, proportionate to the risk, duly authorised and documented where appropriate. No exception may entail a breach of applicable legal, regulatory or contractual requirements.

Version: 1.1
Version date: 21 September 2026
Approved by: Management of AI Experience Hub SL
Review: Annually or when significant changes occur.

General references: UNE-EN ISO/IEC 27001 clauses 5.2, 7.5 and 9.3; GDPR art. 5.2, art. 24 and art. 32; LOPDGDD art. 5.