1. Background

1.1 This information security annex (the “Information Security Annex”) describes Glesys’ technical and organizational measures for managing cybersecurity risks and supporting compliance in accordance with applicable cybersecurity legislation, in particular the NIS2-directive and national applicable legislation. The NIS2-directive, national applicable legislation, including to Glesys applicable sector-specific regulations, are collectively referred to as the “Cyber Security Rules”.

1.2 Glesys’ Integrated Management System (IMS) integrates ISO 9001, ISO 14001, and ISO/IEC 27001:2022 across its operations. The IMS scope excludes Customer Data hosted on Glesys infrastructure. Customers retain ownership and responsibility for the security and management of Customer Data as set out in the Agreement.

1.3 This Information Security Annex forms an integral part of the Agreement and is subject to its terms, including but not limited to provisions on limitation of liability and return or deletion of data upon termination of the Agreement. Terms used herein shall have the meaning set out in the Cyber Security Rules, unless otherwise indicated. Capitalized terms not defined herein shall have the meaning set out in the Agreement.