Contact

Personal Data Protection and Information Security Policy

Version 7.0 - Madrid, November 2025

Contact

Nfoque Servicios Centrales y Soporte Operativo, S.L

Author/s: Margarita Gluszek

Validated by: Security and Privacy Committee

Approved by: Governing Body

Project: Integrated Management System (IMS)

Classification: Public

Personal Data Protection and Information Security Policy – Version 7.0 – Classification: Public

This Policy establishes the guidelines and lines of action regarding Information Security that govern the manner in which NWorld manages and protects its information and services, as well as communication with its clients and other stakeholders.

1. Mission and Management Commitment

Information security is part of NWorld’s DNA, being its main service activity, and must therefore be integrated into all activities carried out both internally and, most especially, in those operations that form part of client services, taking into account that information is the company’s most critical asset.

NWorld’s principal objective is to protect information assets and services, ensuring the Confidentiality, Integrity, Availability, Authenticity and Traceability of information managed. This commitment is materialised through the implementation and maintenance of an Information Security Management System that complies with the requirements of the National Security Scheme (ENS) (Royal Decree 311/2022) and the standards ISO/IEC 27001, ISO/IEC 27017 (Security in Cloud Services) and ISO/IEC 27018 (Protection of PII in Public Cloud)

2. Applicable Regulatory and Legal Framework

The Organisation is committed to strict compliance with the following legal and regulatory framework, among others:

National Security Scheme (ENS): Royal Decree 311/2022, of 3rd May. The basic principles of Chapter II and minimum security requirements are adopted.

      • Personal Data Protection: Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD)
      • Legal Status and Administrative Procedure: Law 39/2015 and Law 40/2015, regarding the use of electronic means in relations with Public Administrations.
      • Electronic Trust Services: Regulation (EU) No. 910/2014 (eIDAS Regulation) and Law 6/2020.
      • Intellectual Property: Intellectual Property Law, ensuring lawful use of software and licensing.

3. Fundamental Principles

For the purpose of promoting and maintaining the properties described, NWorld conducts its activities and fosters its business through the following fundamental principles:

      • Commitment to compliance with the requirements of the legal and regulatory framework in which its activities will be developed, as well as the information security indications recommended by INCIBE and CCN.
      • Establish security roles or functions, defining for each one the duties and responsibilities of the position, as well as the procedure for its designation and renewal.
      • Prioritise risk management governance and information security as a fundamental element for service continuity, establishing the structure of the committee or committees for security management and coordination, detailing their scope of responsibility, the people involved and the relationship with other elements of the organisation.
      • Protect the information asset against threats in accordance with internal risk acceptance criteria, in line with the guidelines for structuring security documentation, its management and access.
      • Apply the concept of continuous improvement, involving the entire organisation, its partners and stakeholders, for the achievement of objectives.

4. Objectives

      • Treat personal data lawfully, fairly and transparently, pursuing purpose limitation, data minimisation, accuracy, integrity, confidentiality, storage period limitation, and proactive accountability.
      • Treat and safeguard information belonging to the company and to clients, preserving its confidentiality, integrity, availability, authenticity and traceability at all stages of its process.
      • Adapt its systems to changing environments, managing new risks, adjusting infrastructure capabilities, and fostering teamwork and cohesion within the organisation.

5. Commitment and Leadership

All individuals who make up NWorld understand and are responsible for complying with these principles, as well as with all approved information security systems that develop them.

NWorld’s Governing Body is committed to providing the necessary resources for the establishment, implementation, maintenance and improvement of the entity’s ISMS/ENS, as well as to demonstrating leadership and commitment with respect to this, through the establishment of the Information Security Committee, which shall have the responsibility for:

      • Ensure the establishment of this policy and information security objectives, compatible with NWorld’s strategy.
      • Ensure the integration and compliance of applicable ISMS/ENS requirements in the entity’s services and processes.
      • Ensure that necessary resources for the ISMS/ENS are available.
      • Communicate the importance of effective security management and compliance with ISMS/ENS requirements.
      • Ensure that the ISMS/ENS achieves the intended results.
      • Direct and support individuals to contribute to the effectiveness of the ISMS/ENS.
      • Promote continuous improvement.
      • Support other relevant roles of the Governing Body, leading their areas of responsibility in information security; the detail of functions is described in the minutes of establishment.

6. Information Security Functions and Responsibilities

The Information Security and Privacy Committee shall proceed to review and propose approval of this Policy to NWorld’s Governing Body and shall be the Information and Services Responsible Party.

Furthermore, the Information Security and Privacy Committee shall centralise coordination mechanisms and conflict resolution between the responsible parties indicated below, which shall be addressed through discussion during meetings of said committee members and which shall be moderated by the General Management:

      • The Information Security and Privacy Committee, on behalf of NWorld’s Governing Body, shall be the body responsible for approving the policy and shall be responsible for authorising any modifications to it, as well as all documented information of the entity’s ISMS/ENS.
      • The Information Security Manager shall be responsible for notifying this policy to the entity’s personnel and any changes that occur to it, as well as for coordinating actions for implementation, maintenance and improvement of the entity’s ISMS/ENS (including the signing of the Statement of Applicability that formalises the list of applicable security measures derived from Risk Analysis), and its audits, together with the System Administrator who shall be responsible for managing the technical security requirements of NWorld’s information systems.
      • The System Manager is the figure designated with the highest responsibility for the operation and security of NWorld’s information systems, acting as guarantor of technical compliance with the measures of the National Security Scheme (ENS). It ensures the correct implementation and maintenance of secure system configuration and the effective application of continuity and recovery controls, as defined in NWorld’s Continuity Plan. It is also responsible for authorising technical changes that may impact security, keeping documentation up to date and working closely with the Information Security Manager (ISM) in incident management.
      • The Responsible Party for each information and/or service affected by risk analysis and management shall be indicated in the Risk Map of NWorld’s ISMS/ENS which shall record the criteria that determine the level of security required, within the framework established in article 40 and the general criteria prescribed in Annex I of the ENS Royal Decree.
      • The Data Protection Officer shall be responsible for ensuring that personal data is treated and protected in accordance with the General Data Protection Regulation (EU 2016/679 GDPR), and shall therefore work in coordination with the Information Security Manager and the IT Manager.
      • All personnel of the organisation, both internal and external, shall be responsible for complying with this Personal Data Protection and Information Security Policy within their area of work, as well as for applying all documented information of the controls and security measures of NWorld’s ISMS/ENS in their work activities that affect their performance in information security.

7. Use and Classification of Information

The documented information of security controls shall be communicated to the personnel working in the entity (internal and external personnel) who shall have the obligation to apply it in the performance of their work activities.

The documented information shall be classified as: public, internal, restricted and confidential, giving appropriate use in accordance with such classification and according to the criteria established in the Information Classification and Labelling Procedure.

8. System Audits

Audits shall be carried out to review and verify NWorld’s ISMS/ENS compliance with the requirements of the ISO/IEC 27001 Standard for the ISMS and with Royal Decree 311/2022, which regulates the National Security Scheme, therefore the personnel affected by the scope of such audits must be collaborative for their effectiveness, as well as in the application of corrective actions derived from them for continuous improvement.

9. Review of Personal Data Protection and Information Security Policy

This Personal Data Protection and Information Security Policy shall be examined in system reviews by the Governing Body, through the Information Security and Privacy Committee, whenever significant changes occur, at least once a year.

10. Approval, Dissemination and Application of Personal Data Protection and Information Security Policy

This Personal Data Protection and Information Security Policy shall be approved by NWorld’s Governing Body by signature and disseminated to NWorld’s interested parties.

Likewise, NWorld’s Governing Body shall provide the necessary resources for the effective application of this policy, and for its proper development, both in implementation activities and in its subsequent maintenance and improvement of the entity’s entire ISMS/ENS.