Correo Group, integrated by Correos and its subsidiaries Correos Express, Correos Express Portugal and Correos Telecom, operates in the physical and digital communications sector and in the parcel services market. It is leading the non-urgent transport segment and is a reference for the e-commerce sector.

Correos is part of the SEPI Group, a holding company which covers 15 companies in which it has a direct majority participation, with a workforce of more than 78,000 employees. It is also a shareholder in the RTVE Corporation, has a public foundation, and has direct minority holdings in nine companies and indirect holdings in over one hundred companies.

The aim of the Correos Group’s Security Policy is to establish the general aims and principles that should govern actions in the area of security in terms of the effective protection of the Group’s people, assets and facilities.

This Policy confirms the commitment to understand security as one of the key pillars on which the global Correos organisation is built, for the purpose of contributing the following aims:

· To protect the people and assets that make up the Organisation by having a Security Management System in place to mitigate the risks arising from internal and/or external threats.

· To generate appropriate security measures to favour the achievement of the Group’s goals and the continuity of operations.

· Comply with the applicable regulations and cooperate with the competent authorities in the relevant area.

· Disseminate this Policy and the regulatory framework that develops it, promoting training and awareness in this area among all the Organisation’s personnel, so that Security forms part of the company’s processes.

The Correos Group is made up by a series of companies engaged in the physical and digital communications sector and the parcel delivery market, in which customers increasingly demand services of greater added value that can only be achieved through excellence and sustainability.

Based on the principles of legal compliance, honesty, integrity and transparency that are enshrined in the General Code of Conduct and the various corporate policies, and within the framework of the United Nations Sustainable Development Goals (SDG) Alignment Model and the company’s Sustainability Master Plan, we have made the following commitments:

• To customers through efficiency and innovation in our processes and products. Constantly striving for excellence in our service and developing new solutions that are tailored to an increasingly more digital society.
• To the people who work for the Group by safeguarding their health and safety in the workplace, through lifelong learning and through their professional and personal development.
• To environmental sustainability by encouraging people to look after the environment through certain specific targets in terms of air quality, climate change and the circular economy, and ensuring that those targets are in line with the United Nations Sustainable Development Goals.
• To society by promoting social and cultural development in the communities where we operate, thereby making a contribution to their well-being and progress.

The Correos Group corporate Risk Control And Management Policy, approved by the Governing Board in 2022, sets the principles ad guidelines to ensure the identification, analysis, management and control of risks, systemically and uniformly, thus contributing to:

• achieving strategic corporate goals, maximizing economic value generated;
• providing an adequate level of assurance for all stakeholders;
• compliance with applicable regulations;
• enabling the operations to be carried out with the anticipated safety and quality, ensuring the continuity of public service.

This Policy defines the guidelines to be followed to identify and maintain risks within tolerance thresholds and to provide the elements to decide on the level of acceptable risk at any given time, taking into account the cross-cutting nature of the risks. To this end, its implementation is based on four principles of action: focus on risk management through an effective internal control environment, strengthening corporate governance, comprehensive risk management strategy and culture, and internal transparency.

The Information Security policy encompasses the following strategic objectives:

• Maintain levels of security, in terms of Confidentiality, Integrity, Availability, Traceability and Authenticity, to align with the needs of the Business and to instil confidence in our customers.
• Implement technical and organisational measures that provide an appropriate level of security, covering the systems and processes that process information.
• Ensure that all activities are conducted in accordance with the prevailing legal framework and any contractual obligations agreed with customers.
• Promote a culture of cybersecurity among all Organisation staff.
• Information Security Management System be maintained based on international standards. This system must be capable of identifying, quantifying, prioritising and addressing risks associated with assets, processes and services.
• Implement the requisite technological contingency mechanisms to ensure the continuity of services and information systems, thereby enabling their recovery within an acceptable timeframe