Information Security Policy

We implement security controls to safeguard the confidentiality, integrity, and availability of information. This means preventing unauthorized access, data loss, or service disruptions that could affect our business operations and client trust.

• Keep information security policies and procedures up to date and accessible.
• Promote ongoing training and awareness programs on information security.
• Record, investigate, and remediate security incidents effectively.
• Ensure business continuity through contingency and disaster recovery plans.
• Continuously review and improve our controls in line with technological and regulatory changes.

This policy is governed by the Information Security and Privacy Committee (ISPC), composed of the Data Protection Officer (DPO), the Governance, Risk, and Compliance (GRC) team, and representatives from IT and Information Security. The committee is responsible for supervising, reviewing, and ensuring the effective application of this policy throughout the organization.

All security incidents are handled in a structured manner, ensuring:

• Immediate remediation,
• Transparent documentation,
• Communication to impacted parties, when necessary.

We maintain contingency and disaster recovery plans that are regularly tested, ensuring our services remain operational even in unforeseen situations.

Violations of this policy may result in proportional measures, including:

• Warnings,
• Mandatory training,
• Temporary suspension,
• Contract termination or legal action, depending on severity and recurrence.

Situations not explicitly covered in this policy will be evaluated by the Information Security and Privacy Committee. The policy must be interpreted dynamically, adapting to new threats and technological developments.

Luby reserves the right to update this Policy as necessary to ensure compliance with applicable standards, laws, and industry requirements.

If you have questions or need clarification about this Policy, please contact our Data Protection Officer (DPO) at: rafael.marrocos@luby.com.br