Introduction
PROBELTE PHARMA, S.L. is aware of the importance of information security for the proper development of its activities and for maintaining the trust of customers, partners, and other stakeholders.

Information systems and information and communication technologies (ICT) are essential elements for the organization and, therefore, must be protected against internal or external threats, whether accidental or deliberate, that could compromise the confidentiality, integrity, availability, authenticity, and traceability of information.

Objective
The objective of this Information Security Policy is to establish the reference framework that ensures adequate protection of information and the services that manage it, guaranteeing their continuity and quality, as well as compliance with applicable legal and regulatory requirements.

Management Commitment
The Management of PROBELTE PHARMA expresses its firm commitment to information security as a strategic element for the organization and supports the development, implementation, and continuous improvement of an Information Security Management System (ISMS).

This commitment is reflected in:

• The integration of information security into all organizational processes.
• The allocation of appropriate responsibilities and resources.
• The promotion of awareness and training in information security.
• The continuous improvement of security levels.

Security Principles
Information security at PROBELTE PHARMA is based on the following principles:

• Risk management–based approach.
• Prevention, detection, and response to incidents.
• Continuous monitoring and improvement.
• Clear definition of responsibilities.
• Protection of information assets throughout their entire life cycle.

 

Personal Data Protection
PROBELTE PHARMA ensures that personal data are processed in accordance with current data protection regulations, in particular Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), applying the principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, and security.

Scope
This Policy applies to all information systems, processes, and individuals who, directly or indirectly, are involved in the processing of information managed by PROBELTE PHARMA.

Regulatory Framework
This Policy is aligned with the main applicable legal and regulatory frameworks, including:

• National Security Framework (Royal Decree 311/2022).
• General Data Protection Regulation (GDPR).
• Applicable Spanish legislation on security, data protection, and digital services.
• Specific pharmaceutical sector regulations applicable to the organization’s activities.

Policy Review
The Information Security Policy will be reviewed periodically to ensure its suitability to the organization’s context, technological evolution, and legal and regulatory requirements.

Approval
This Policy was approved by the Management of PROBELTE PHARMA on 14/04/2026 and is mandatory for the entire organization.