Document Control

This table records all versions, authors, approving authorities, and a description of changes for audit and governance purposes. Any amendment to this document shall be recorded below and communicated to all applicable personnel prior to the new version's effective date.

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

Table of Contents

1. Introduction & Purpose

1.1 Mission Statement

1.2 Scope

1.3 Policy Objectives

1.4 Definitions of Key Terms

2. Information Security Policy

2.1 Security Governance

2.2 Access Control Policy

2.3 Data Protection Policy

2.4 Network & Endpoint Security

2.5 Acceptable Use Policy

2.6 Incident Response Policy

2.7 Vendor & Third-Party Management Policy

2.8 Physical & Environmental Security

2.9 Business Continuity & Disaster Recovery

3. Privacy Policy

3.1 Privacy Commitment

3.2 Data Collection & Lawful Basis

3.3 How We Use Personal Data

3.4 Data Sharing & Disclosure

3.5 Data Retention Policy

3.6 Individual Rights & Requests

3.7 Cookies & Tracking Technologies

3.8 Children's Privacy

3.9 Privacy by Design

4. Confidentiality Policy

5. Training & Awareness

6. Compliance & Enforcement

7. Policy Exceptions

8. Policy Review & Updates

9. Contact Information

10. Acknowledgment & Signature

Appendices

Appendix A: Data Classification Matrix

Appendix B: Incident Response Contact Tree

Appendix C: Retention Schedule Summary

Appendix D: Glossary of Terms

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

1. Introduction & Purpose

1.1 Mission Statement

ITCONNECTUS INC ("the Company," "we," "us," or "our") is committed to establishing, implementing, maintaining, and continually improving a robust information security and privacy management framework. The Company recognizes that information is one of its most critical assets and that the protection of such information — whether belonging to the Company, its clients, its employees, or its partners — is essential to maintaining trust, enabling lawful operations, and sustaining competitive advantage.

The mission of ITCONNECTUS INC's information security program is to protect the confidentiality, integrity, and availability of all information assets against unauthorized access, disclosure, alteration, destruction, or loss. The Company shall achieve this mission by implementing proportionate technical, administrative, and physical controls, fostering a culture of security awareness, and ensuring compliance with all applicable laws and regulations governing data protection and information security.

This policy reflects the Company's executive-level commitment to security governance and serves as the authoritative foundation upon which all subordinate security policies, standards, procedures, and guidelines are built.

1.2 Scope

This Information Security & Privacy Policy applies to all individuals and entities who access, process, store, transmit, or otherwise handle ITCONNECTUS INC information assets or systems, including but not limited to:

• All full-time, part-time, and temporary employees of ITCONNECTUS INC;
• Independent contractors, consultants, and freelance professionals engaged by the Company;
• Third-party vendors, suppliers, service providers, and business partners with authorized access to Company systems or data;
• Interns, volunteers, and any other individuals operating under the Company's direction;
• All Company-owned, leased, or managed information systems, networks, devices, and infrastructure;
• All data and information assets owned by, licensed to, or entrusted to ITCONNECTUS INC, regardless of the medium in which they are stored or transmitted.

This policy applies to all processing activities performed on ITCONNECTUS INC systems, whether conducted on-premises, remotely, or through cloud-based platforms, and whether using Company-owned or personally owned devices where authorized under the Bring Your Own Device (BYOD) provisions set forth herein.

1.3 Policy Objectives

The primary objectives of this Information Security & Privacy Policy are as follows:

1. To establish a clear and enforceable framework for the governance, protection, and responsible use of all information assets of ITCONNECTUS INC;
2. To define roles, responsibilities, and accountabilities for information security at all levels of the organization;
3. To protect the personal data of clients, employees, and other individuals in accordance with applicable privacy laws and regulations;
4. To minimize the risk of security incidents, data breaches, and unauthorized disclosures through preventive, detective, and corrective controls;
5. To ensure business continuity and rapid recovery from security incidents or system failures;
6. To promote a culture of security awareness, accountability, and ethical information handling among all personnel;
7. To maintain compliance with applicable legal, regulatory, and contractual obligations, including but not limited to GDPR, CCPA, SOC 2, and ISO 27001;
8. To support the Company's reputation and stakeholder trust through demonstrated commitment to responsible data stewardship.

1.4 Definitions of Key Terms

For the purposes of this policy, the following terms shall have the meanings ascribed to them below. Capitalized terms used but not defined herein shall have the meanings assigned to them in applicable law or in supplemental Company policies.

"Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, telephone numbers, identification numbers, location data, online identifiers, or any combination of factors specific to that individual's physical, physiological, genetic, mental, economic, cultural, or social identity.

"Sensitive Data" means a subset of Personal Data that warrants heightened protection due to the particular risks its unauthorized disclosure presents, including but not limited to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sex life or sexual orientation, as well as financial account numbers, government-issued identification numbers, and legal records.

"Information Assets" means all data, information, software applications, databases, hardware, networks, documentation, and intellectual property owned by, licensed to, or entrusted to ITCONNECTUS INC, in any format or medium.

"System" means any computing device, server, network component, cloud platform, application, or digital infrastructure used to create, store, process, transmit, or manage information assets on behalf of or in connection with ITCONNECTUS INC.

"User" means any individual granted authorized access to Company information assets or systems, whether an employee, contractor, vendor, or other authorized party.

"Incident" means any actual, suspected, or imminent event that threatens or compromises the confidentiality, integrity, or availability of ITCONNECTUS INC information assets, systems, or operations, including but not limited to data breaches, malware infections, unauthorized access, service disruptions, and policy violations.

"Data Breach" means a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise processed by ITCONNECTUS INC.

"Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.

"Controller" means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of Personal Data. ITCONNECTUS INC acts as a Controller in relation to data it collects directly from individuals.

"Processor" means a natural or legal person, public authority, agency, or other body that processes Personal Data on behalf of a Controller.

"Data Subject" means an identified or identifiable natural person whose Personal Data is processed by or on behalf of ITCONNECTUS INC.

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

2. Information Security Policy

ITCONNECTUS INC's Information Security Policy establishes the Company's comprehensive approach to safeguarding all information assets from threats, whether internal or external, deliberate or accidental. The provisions of this section are mandatory and binding upon all persons within the scope defined in Section 1.2. Compliance with these provisions is a condition of employment, engagement, or authorized access and shall be subject to the enforcement mechanisms described in Section 6.

2.1 Security Governance

2.1.1 Roles and Responsibilities

Effective information security requires clearly defined accountability at every level of the organization. The following roles bear specific responsibilities under this policy:

The Chief Information Security Officer (CISO) bears ultimate accountability for the Company's information security program. The CISO is responsible for developing, implementing, and maintaining the information security strategy; overseeing the Security Steering Committee; approving security policies and standards; managing security risk at the executive level; reporting on security posture to the Board of Directors and executive leadership; and ensuring regulatory compliance across all security domains.

The IT Security Team is responsible for the day-to-day implementation, operation, and monitoring of security controls across the Company's infrastructure. This team shall conduct vulnerability assessments, manage security tooling, respond to incidents, implement access controls, and maintain security baselines for all systems.

Department Heads and Managers are responsible for ensuring that all personnel within their respective departments are aware of, trained on, and compliant with this policy. Department Heads shall promptly report any suspected or confirmed security incidents to the IT Security Team, enforce security procedures within their areas of operation, and participate in security governance activities as required.

All Employees, Contractors, and Authorized Users are individually responsible for protecting the information assets to which they have access. Each User must comply fully with this policy, complete all mandatory security training, report suspected incidents without delay, and refrain from any action that could compromise the security or privacy of Company information.

2.1.2 Security Steering Committee

ITCONNECTUS INC shall maintain a Security Steering Committee ("the Committee") composed of the CISO, Chief Executive Officer, Chief Technology Officer, Chief Legal Officer, Chief Human Resources Officer, and relevant Department Heads. The Committee shall convene no less than quarterly to review the Company's security posture, evaluate emerging risks, approve material changes to security policy, prioritize security investments, and oversee compliance with applicable laws and standards. Extraordinary meetings of the Committee may be convened at any time in response to a significant security incident or material regulatory change.

2.1.3 Policy Review Cycle

This policy shall be subject to a formal review at a minimum annually, with the first scheduled review occurring on or before April 15, 2028. In addition to the annual review, a review shall be triggered by any of the following events: a significant security incident, a material change in applicable law or regulation, a merger, acquisition, or restructuring, the introduction of new technologies or processing activities that materially alter the Company's risk profile, or direction from the Security Steering Committee. All revisions shall be documented in the Document Control table and communicated to all applicable personnel prior to the revised version's effective date.

2.2 Access Control Policy

2.2.1 Principle of Least Privilege

ITCONNECTUS INC shall apply the principle of least privilege in all access control decisions. Access to information assets and systems shall be granted based solely on a demonstrated business need, and each User shall be provided with the minimum level of access rights necessary to perform their authorized job functions. Excessive, dormant, or unnecessary access rights shall be identified and revoked through periodic access reviews. No User shall be granted access to information beyond the scope of their role without explicit written authorization from an appropriate authority.

2.2.2 Role-Based Access Control (RBAC)

Access to Company systems and information assets shall be managed through a Role-Based Access Control framework. Access profiles shall be defined based on job roles and business functions, and access entitlements shall be assigned to roles rather than individuals. When a User is assigned to a role, they shall inherit the access entitlements associated with that role. Role definitions shall be reviewed no less than annually and updated promptly when organizational changes, personnel changes, or system changes alter the scope of a role's responsibilities.

2.2.3 Multi-Factor Authentication (MFA) Requirements

Multi-Factor Authentication is mandatory for all User accounts accessing ITCONNECTUS INC systems. MFA shall be required at minimum for all remote access sessions, all access to cloud-hosted platforms, all administrative and privileged accounts, and all access to systems classified as Confidential or Restricted. MFA must combine at minimum two of the following factors: something the User knows (e.g., a password or PIN), something the User has (e.g., a hardware token, authenticator application, or smart card), or something the User is (e.g., biometric verification). The use of SMS-based one-time passwords is discouraged where more secure MFA methods are available, and shall not be the sole MFA method for privileged accounts.

2.2.4 Password Policy

All Users accessing ITCONNECTUS INC systems must comply with the following password standards. Passwords shall be a minimum of fourteen (14) characters in length and shall contain a combination of uppercase letters, lowercase letters, numbers, and at least one special character. Passwords must not contain the User's name, username, or easily guessable personal information. Passwords for standard User accounts shall be rotated no less than every ninety (90) days, and passwords for privileged accounts shall be rotated no less than every sixty (60) days. Users shall not reuse any of their last twenty-four (24) passwords. Passwords must not be written down, stored in plaintext, or shared with any other person under any circumstances. The Company shall provide an approved enterprise password management solution to facilitate secure password storage and generation.

2.2.5 Access Provisioning and De-provisioning

Access to Company systems shall be provisioned only upon receipt of a formally approved access request, authorized by the relevant Department Head and processed by the IT Security Team. New employee access shall be provisioned on or after the employee's first day, based on their assigned role. When a User's employment, engagement, or authorized access is terminated, whether voluntarily or involuntarily, all access rights shall be revoked immediately upon the effective date of termination, and no later than within four (4) hours of notification to the IT Security Team. All access rights shall be reviewed at minimum semi-annually to identify and remove stale, excessive, or unauthorized access.

2.2.6 Remote Access and VPN Requirements

All remote access to ITCONNECTUS INC's internal networks and systems must be conducted exclusively through the Company's approved Virtual Private Network (VPN) solution or equivalent secure remote access technology. Direct remote access without VPN tunneling is prohibited. Remote access sessions shall time out after a period of inactivity not exceeding thirty (30) minutes. Users accessing Company systems remotely must use Company-approved devices or devices that meet the security standards defined in the BYOD policy. The IT Security Team shall maintain audit logs of all remote access sessions for a minimum of two (2) years.

2.2.7 Privileged Access Management (PAM)

Privileged accounts — including administrator accounts, root accounts, service accounts, and any accounts with elevated system-level permissions — shall be subject to enhanced controls under the Company's Privileged Access Management program. Privileged access shall be granted only to personnel with a documented need, shall be time-limited where operationally feasible, and shall require MFA at all times. All privileged access sessions shall be logged, monitored, and subject to periodic review by the CISO. Shared privileged accounts are prohibited except where operationally unavoidable, and in such cases shall be subject to enhanced monitoring and a formal justification documented by the CISO. Privileged accounts shall not be used for routine, non-administrative activities.

2.3 Data Protection Policy

2.3.1 Data Classification Framework

ITCONNECTUS INC shall classify all information assets into one of four (4) categories, based on the sensitivity of the information and the potential impact of unauthorized disclosure. All personnel are responsible for correctly classifying information they create or handle in accordance with the following framework:

• Public: Information that is approved for general public release and whose disclosure carries no risk of harm to the Company or any individual. Examples include press releases, publicly available marketing materials, and published product documentation.
• Internal: Information intended for use within the Company that is not approved for public release. Unauthorized disclosure may cause minor operational disruption. Examples include internal announcements, general operational procedures, and non-sensitive business communications.
• Confidential: Sensitive business information whose unauthorized disclosure could cause material harm to the Company, its clients, or its employees. Examples include client contracts, employee records, business plans, source code, and financial forecasts.
• Restricted: The highest classification, reserved for information whose unauthorized disclosure could cause severe harm, including legal liability, regulatory sanctions, reputational damage, or significant financial loss. Examples include Personal Data of clients or employees, cryptographic keys, credentials, payment card data, and merger/acquisition information.

A complete Data Classification Matrix, including handling requirements, approved storage locations, and sharing controls for each classification level, is provided in Appendix A.

2.3.2 Encryption Requirements

Encryption is a mandatory control for the protection of Confidential and Restricted information at ITCONNECTUS INC. All Confidential and Restricted data stored on Company systems, portable media, or cloud platforms must be encrypted at rest using AES-256 or an equivalent approved encryption standard. All Confidential and Restricted data transmitted over any network — internal or external — must be protected in transit using TLS 1.2 or higher, or an equivalent approved protocol. The use of older or deprecated encryption protocols, including SSL, TLS 1.0, and TLS 1.1, is strictly prohibited. Encryption key management shall be governed by the Company's cryptographic key management standard, and keys shall be stored separately from the data they protect.

2.3.3 Data Handling Procedures

All Users must handle information assets in a manner appropriate to their classification level. Public information may be freely shared subject to applicable intellectual property and licensing requirements. Internal information must not be shared outside the organization without authorization from the relevant Department Head. Confidential information must be shared on a strict need-to-know basis, stored in approved secure locations, and transmitted only through encrypted channels. Restricted information must be subject to the most stringent controls, including access restricted to specifically authorized individuals, transmission only through approved encrypted channels with additional access controls, and storage only in designated secure repositories approved by the IT Security Team.

2.3.4 Backup and Recovery Requirements

ITCONNECTUS INC shall maintain regular, automated backups of all critical business data and systems. Full system backups shall be performed no less than weekly, and incremental backups shall be performed daily. Backup copies must be encrypted and stored in a geographically separate location from the primary systems they protect. Backup media must be tested for recoverability no less than monthly for critical systems and quarterly for non-critical systems. Backup logs shall be maintained and reviewed by the IT Security Team on a monthly basis. Backup access shall be restricted to authorized IT personnel.

2.3.5 Data Loss Prevention (DLP) Controls

ITCONNECTUS INC shall implement and maintain a Data Loss Prevention program to detect, monitor, and prevent the unauthorized transfer or disclosure of sensitive information. DLP controls shall be deployed at the network perimeter, on endpoint devices, and within cloud-based platforms as technically feasible. DLP policies shall be configured to detect and block the transmission of Confidential and Restricted data through unauthorized channels, including personal email, unapproved cloud storage services, and removable media. DLP alerts shall be monitored by the IT Security Team, and confirmed DLP policy violations shall be treated as potential security incidents and investigated accordingly.

2.4 Network & Endpoint Security

2.4.1 Firewall and Perimeter Security

ITCONNECTUS INC shall deploy and maintain enterprise-grade firewall and perimeter security controls at all network boundaries. Firewall rule sets shall adhere to the principle of default-deny, permitting only explicitly authorized traffic. Firewall configurations shall be reviewed quarterly and audited annually. Network segmentation shall be implemented to isolate critical systems, including production environments, payment processing systems, and systems storing Restricted data, from general corporate networks. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) shall be deployed and maintained to detect and respond to anomalous network activity in real time.

2.4.2 Endpoint Protection

All endpoints — including workstations, laptops, mobile devices, and servers — used to access ITCONNECTUS INC systems shall be protected by approved enterprise endpoint security solutions. This includes, at minimum, anti-malware and antivirus software with real-time scanning enabled, Endpoint Detection and Response (EDR) tooling capable of detecting, investigating, and containing advanced threats, and host-based firewall controls. All endpoint devices must receive operating system and application security patches within fourteen (14) calendar days of a vendor patch release for critical vulnerabilities, and within thirty (30) calendar days for high or medium severity vulnerabilities.

2.4.3 Wireless Network Security

All corporate wireless networks shall use WPA3 or WPA2-Enterprise authentication, as technically available, with strong pre-shared keys or certificate-based authentication. Guest wireless networks shall be isolated from the corporate network and shall not permit access to internal Company systems. The use of personal or public wireless networks for accessing Confidential or Restricted Company information without an active VPN connection is prohibited. Rogue access point detection shall be implemented and monitored as part of the Company's network monitoring program.

2.4.4 Vulnerability Management and Penetration Testing

ITCONNECTUS INC shall maintain a formal vulnerability management program. Automated vulnerability scanning of all in-scope systems shall be performed no less than monthly. Identified vulnerabilities shall be classified by severity and remediated within the following timeframes: Critical vulnerabilities within seven (7) calendar days; High severity within fourteen (14) calendar days; Medium severity within thirty (30) calendar days; and Low severity within ninety (90) calendar days. In addition to automated scanning, the Company shall engage a qualified independent third party to conduct penetration testing of its external-facing systems and applications no less than annually. Findings from penetration tests shall be tracked to remediation with oversight by the CISO.

2.5 Acceptable Use Policy

2.5.1 Authorized Use of Company Systems

ITCONNECTUS INC provides information systems, devices, and network resources to Users for the purpose of conducting legitimate and authorized Company business. All Users are granted a limited, revocable license to use Company systems solely in connection with their authorized job functions. Use of Company systems for purposes that are illegal, unethical, harmful to the Company's interests, or inconsistent with this policy is prohibited. Incidental personal use of Company systems is permitted on a limited basis provided that such use does not interfere with job performance, does not involve the storage or transmission of sensitive Company data, and complies with all applicable provisions of this policy.

2.5.2 Prohibited Activities

The following activities are expressly prohibited on ITCONNECTUS INC systems, networks, and devices, regardless of whether conducted during working hours:

• Unauthorized access to, or attempted access to, any system, account, network, or data to which the User has not been granted explicit authorization;
• Installing, downloading, or executing software applications that have not been approved by the IT Security Team, including but not limited to peer-to-peer file sharing applications, remote access tools not sanctioned by the Company, or software obtained from unverified sources;
• Sharing, disclosing, or transferring login credentials, passwords, or authentication tokens to any other person, regardless of their role or claimed authority;
• Using Company systems, networks, or resources for personal financial gain, operating a personal business, or any activity competitive with the Company's interests;
• Bypassing, disabling, or attempting to circumvent any security control, including firewalls, endpoint protection tools, content filters, or logging mechanisms;
• Transmitting, storing, or accessing content that is obscene, harassing, discriminatory, defamatory, or in violation of applicable law;
• Engaging in unauthorized data exfiltration, whether through email, removable media, cloud storage, or any other channel;
• Using Company network resources for cryptocurrency mining, large-scale personal file storage, or any other resource-intensive non-business activity.

2.5.3 Personal Device Usage (BYOD Policy)

ITCONNECTUS INC recognizes the operational benefits of permitting Users to access certain Company resources from personally owned devices ("BYOD"). Any User who wishes to use a personally owned device for business purposes must register the device with the IT Security Team, ensure the device meets the minimum security requirements specified in the Company's BYOD Standard, and agree to allow the Company to enforce security policies on the device through a mobile device management solution. Personally owned devices used for business purposes must have screen lock and device encryption enabled, must not be jailbroken or rooted, and must have up-to-date operating system patches and antivirus protection. The Company reserves the right to remotely wipe Company data from a registered personal device in the event of loss, theft, or termination of access.

2.5.4 Internet and Email Usage Guidelines

Internet access provided through Company networks is a business tool and shall be used primarily for business purposes. Users must exercise professional judgment in their use of internet resources and shall not access websites that are known to be malicious, illegal, or inappropriate in a professional context. All email communications sent from Company email accounts must be professional, accurate, and compliant with all applicable policies. Users must not use personal email accounts to transmit Confidential or Restricted Company information. Users are cautioned to be vigilant against phishing, business email compromise, and other social engineering attacks and must report suspected phishing emails to the IT Security Team immediately rather than engaging with them.

2.5.5 Social Media Policy

Users must not disclose Confidential or Restricted Company information, client information, employee information, or any non-public business information on social media platforms, whether using personal or Company accounts. Users must make clear in any public social media communication related to their work that the views expressed are their own and do not represent the official position of ITCONNECTUS INC, unless the User is authorized to communicate on the Company's behalf. The unauthorized impersonation of ITCONNECTUS INC or its representatives on social media is strictly prohibited. Questions regarding the permissibility of specific social media communications should be directed to the Legal or Communications department.

2.5.6 Monitoring and Enforcement Notice

2.6 Incident Response Policy

2.6.1 Incident Classification

Security incidents shall be classified by priority upon initial identification to facilitate appropriate response resource allocation. The following priority classification scheme shall apply:

2.6.2 Incident Response Team (IRT)

ITCONNECTUS INC shall maintain a designated Incident Response Team ("IRT") responsible for coordinating the Company's response to all security incidents. The IRT shall consist of the CISO (IRT Lead), IT Security Team members, Legal Counsel, a Communications/PR representative, the relevant Department Head, and Human Resources (where personnel-related incidents are involved). Incident Response contact details are provided in Appendix B. The IRT shall be available on-call to respond to P1 and P2 incidents at all hours, including outside of normal business hours.

2.6.3 Six-Phase Incident Response Process

ITCONNECTUS INC shall respond to all security incidents using the following structured six-phase process:

9. Preparation: The Company shall maintain incident response plans, tools, and trained personnel in a state of readiness prior to any incident. This includes maintaining current contact lists, pre-approved communication templates, and access to forensic tools and isolated recovery environments.
10. Identification: Upon detection of a potential incident — whether through automated monitoring, User report, or third-party notification — the IT Security Team shall promptly assess and confirm whether a genuine security incident has occurred, document initial findings, assign a priority classification, and activate the IRT if warranted.
11. Containment: The IRT shall take immediate steps to limit the scope and impact of the incident. Short-term containment actions, such as isolating affected systems, revoking compromised credentials, or blocking malicious traffic, shall be implemented as rapidly as possible. Long-term containment measures shall be planned to allow safe continued operation during the investigation.
12. Eradication: Following containment, the IRT shall identify and eliminate the root cause of the incident, including removing malware, closing exploited vulnerabilities, and correcting any misconfiguration or unauthorized changes that enabled the incident.
13. Recovery: Affected systems shall be restored to normal operation in a controlled and verified manner, with confirmation that the threat has been fully eradicated. Systems shall be monitored closely following restoration for signs of recurring compromise.
14. Lessons Learned: Within thirty (30) calendar days of incident closure, the IRT shall conduct a formal post-incident review to document a comprehensive incident timeline, evaluate the effectiveness of the response, identify gaps in controls or procedures, and define corrective actions with assigned owners and deadlines. All lessons-learned reports shall be reviewed by the CISO and presented to the Security Steering Committee.

2.6.4 Notification Timelines

In the event of a confirmed or suspected security incident, the following notification timelines shall apply. Internal escalation to the CISO and relevant IRT members shall occur within one (1) hour of initial identification of a P1 or P2 incident. Where a data breach involving Personal Data is confirmed or reasonably suspected, regulatory notification shall be made within seventy-two (72) hours to the applicable supervisory authority as required by GDPR Article 33 or other applicable law. Notification to affected individuals shall be made without undue delay where required by applicable law or where the Company determines that notification is in the best interest of affected persons. Notification to business-critical clients shall be made within twenty-four (24) hours of a confirmed incident affecting their data or services.

2.6.5 Incident Logging and Documentation

All security incidents, regardless of priority level, shall be formally documented in the Company's incident management system. Incident records shall include the date and time of detection, nature and scope of the incident, systems and data affected, actions taken at each phase of the response, personnel involved in the response, and final resolution and root cause determination. Incident records shall be retained for a minimum of two (2) years and shall be made available to auditors, regulators, and legal counsel as required.

2.7 Vendor & Third-Party Management Policy

2.7.1 Vendor Security Assessment

Prior to engaging any vendor, supplier, or third-party service provider who will have access to Company information assets or systems, ITCONNECTUS INC shall conduct a vendor security assessment commensurate with the risk level of the engagement. All prospective vendors must complete a security questionnaire and provide evidence of applicable security certifications (such as SOC 2 Type II, ISO 27001, or equivalent). Vendors who will access Restricted or Confidential data must demonstrate compliance with a recognized security framework and consent to the Company's right to audit prior to contract execution.

2.7.2 Contractual Security Requirements

All vendor contracts involving access to ITCONNECTUS INC information assets shall include, at minimum, the following contractual provisions: a Data Processing Agreement (DPA) governing the vendor's processing of Personal Data on the Company's behalf; a Non-Disclosure Agreement (NDA) covering all Confidential information shared during the engagement; security requirements aligned with this policy and applicable law; a Service Level Agreement (SLA) specifying availability, incident notification, and remediation timelines; and provisions granting the Company a right to audit the vendor's security controls during the term of the agreement.

2.7.3 Ongoing Vendor Risk Monitoring

Vendor risk shall not be treated as a one-time assessment but shall be subject to ongoing monitoring throughout the vendor relationship. Vendors shall be required to promptly notify ITCONNECTUS INC of any security incidents that may affect the Company's data or services. The IT Security Team shall conduct periodic reassessments of high-risk vendors at least annually. Vendor security questionnaires shall be refreshed no less than annually, and vendors shall be required to report material changes to their security posture, certifications, or subprocessor relationships without delay.

2.7.4 Sub-Processor Management

Where a vendor engages sub-processors to assist in the delivery of services to ITCONNECTUS INC, the vendor must disclose all such sub-processors in writing and must ensure that sub-processors are bound by data protection and security obligations at least equivalent to those in the vendor's contract with ITCONNECTUS INC. The Company reserves the right to object to the use of any sub-processor whose engagement presents an unacceptable risk to Company data.

2.7.5 Right to Audit

All vendor agreements involving access to Confidential or Restricted data shall include an express right for ITCONNECTUS INC, or its designated auditor, to conduct security audits of the vendor's relevant systems, controls, and practices upon reasonable prior written notice. In the event of a suspected or confirmed incident involving vendor systems, the Company may invoke audit rights without advance notice to the extent permitted by contract and applicable law.

2.7.6 Vendor Offboarding

Upon the expiration or termination of a vendor engagement, ITCONNECTUS INC shall ensure that all vendor access to Company systems and data is revoked promptly and no later than on the effective date of termination. The vendor shall be required to certify in writing the return or secure destruction of all Company data in its possession within a timeframe specified by the Company. Offboarding procedures shall be documented and verified by the IT Security Team.

2.8 Physical & Environmental Security

2.8.1 Physical Access Controls

Access to ITCONNECTUS INC data centers, server rooms, and secure areas housing critical information infrastructure shall be restricted to authorized personnel only. Physical access controls shall include, at minimum, electronic key card or badge-based access systems, security cameras at all entry and exit points, visitor sign-in logs maintained for all non-employee access, and lockable server racks within data center environments. Access rights to secure physical areas shall be reviewed quarterly and revoked immediately upon termination of employment or change of role. Unauthorized individuals shall not be permitted to enter secure areas under any circumstances, and authorized personnel must not permit unauthorized individuals to enter by tailgating or similar means.

2.8.2 Clean Desk Policy

All employees and contractors must adhere to a clean desk policy when working in Company facilities. At the end of each working day, or whenever leaving a workstation unattended for an extended period, Users must ensure that all physical documents containing Confidential or Restricted information are stored in locked cabinets or secure containers, computer screens are locked or logged out, and removable media is secured in an appropriate locked location. Physical documents containing Confidential or Restricted information that are no longer required must be disposed of using approved cross-cut shredding equipment or designated secure destruction services.

2.8.3 Visitor Management

All visitors to ITCONNECTUS INC facilities must be registered in advance where practicable, must sign in upon arrival and sign out upon departure, must be accompanied by an authorized employee escort at all times within secure areas, and must wear visible visitor identification badges throughout their visit. Visitor access logs shall be retained for a minimum of one (1) year.

2.8.4 Environmental Controls

Data centers and server rooms shall be equipped with appropriate environmental controls to protect hardware from physical damage, including fire suppression systems appropriate to electronic equipment, HVAC systems capable of maintaining temperature and humidity within vendor-specified ranges, Uninterruptible Power Supply (UPS) systems to protect against power outages and surges, and water leak detection systems where applicable. Environmental systems shall be monitored continuously, and alerts shall be configured to notify relevant IT personnel of any out-of-range conditions.

2.9 Business Continuity & Disaster Recovery

2.9.1 Business Continuity Planning Objectives

ITCONNECTUS INC shall maintain a documented Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) that together ensure the Company's ability to continue operating essential functions during and after a disruptive event. The BCP shall establish a Recovery Time Objective (RTO) — the maximum acceptable duration of system or service downtime — and a Recovery Point Objective (RPO) — the maximum acceptable data loss measured in time — for each critical system and business process. RTO and RPO targets shall be defined in consultation with business owners and shall be reviewed annually.

2.9.2 Critical System Identification

The IT Security Team, in collaboration with Department Heads, shall maintain a current inventory of business-critical systems, identifying their dependencies, data classification levels, and assigned RTO/RPO targets. This inventory shall be reviewed and updated at least annually and following any material change to the Company's technology infrastructure. Critical systems shall be prioritized for protection, monitoring, and recovery resource allocation.

2.9.3 Backup Testing Schedule

Backup recoverability shall be tested on a regular schedule. For business-critical systems, backup restoration tests shall be conducted monthly. For non-critical systems, restoration tests shall be conducted quarterly. Test results, including confirmation of successful data recovery and the time required to restore, shall be documented and reviewed by the IT Security Team. Failed backup tests shall be escalated to the CISO and remediated within a defined timeframe.

2.9.4 Disaster Recovery Plan Testing

The Company's Disaster Recovery Plan shall be tested at least annually through two complementary methods. A tabletop exercise, in which IRT and business continuity stakeholders walk through a simulated disaster scenario without activating production recovery systems, shall be conducted at minimum once per year. A live failover exercise, in which production systems are actually failed over to the DR environment to validate technical recovery capability, shall be conducted at minimum once per year. Findings from both types of exercises shall be documented and used to improve the DRP. All material gaps identified shall be remediated within ninety (90) days of the exercise.

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

3. Privacy Policy

This Privacy Policy governs the collection, use, storage, sharing, retention, and disposal of Personal Data by ITCONNECTUS INC in connection with its business operations, products, and services. This policy applies to Personal Data processed by ITCONNECTUS INC in its capacity as a Data Controller and, where relevant, supplements the requirements applicable to its capacity as a Data Processor on behalf of clients.

3.1 Privacy Commitment

ITCONNECTUS INC is committed to protecting the privacy and Personal Data of every individual whose data it processes, including clients, employees, contractors, website visitors, and business contacts. The Company recognizes that privacy is a fundamental right and that responsible data stewardship is integral to the trust upon which all of its business relationships depend. The Company shall process Personal Data only for specified, explicit, and legitimate purposes, and shall not process Personal Data in a manner incompatible with those purposes.

ITCONNECTUS INC's privacy program is designed to comply with the applicable data protection laws and frameworks to which the Company is subject, including but not limited to: the European Union General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679); the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA); the Virginia Consumer Data Protection Act (VCDPA); the Colorado Privacy Act (CPA); applicable US federal and state privacy laws as they apply to the Company's operations; and any other applicable international, national, or regional data protection laws.

3.2 Data Collection & Lawful Basis

3.2.1 Categories of Personal Data Collected

ITCONNECTUS INC may collect and process the following categories of Personal Data in connection with its business operations:

• Identity Data: Full name, date of birth, government-issued identification numbers, and similar identifiers;
• Contact Data: Email address, postal address, telephone number, and other contact details;
• Financial Data: Bank account details, payment card information (processed in compliance with PCI DSS), billing address, and transaction history;
• Technical Data: IP addresses, device identifiers, browser type and version, operating system, and other technical information collected through the Company's websites and applications;
• Usage Data: Information about how individuals interact with the Company's services, including access logs, feature usage, preferences, and behavioral data;
• Communications Data: Records of correspondence with the Company via email, telephone, chat, or other channels;
• Employment Data (employees and contractors): Employment history, compensation information, performance records, and benefits data;
• Marketing and Preferences Data: Communication preferences, consent records, and marketing interaction history.

3.2.2 Lawful Bases for Processing

ITCONNECTUS INC shall process Personal Data only where it has identified a valid lawful basis for doing so. The Company relies on the following lawful bases, as applicable:

• Consent: Where the Data Subject has given freely obtained, specific, informed, and unambiguous consent to the processing of their Personal Data for one or more specified purposes. Consent may be withdrawn at any time without detriment;
• Contract: Where processing is necessary for the performance of a contract to which the Data Subject is party, or to take steps at the Data Subject's request prior to entering into a contract;
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which ITCONNECTUS INC is subject;
• Legitimate Interests: Where processing is necessary for the purposes of the legitimate interests pursued by ITCONNECTUS INC or a third party, provided that such interests are not overridden by the interests, rights, or freedoms of the Data Subject. The Company shall document its legitimate interests assessments and make them available upon request.

3.2.3 Special Categories of Sensitive Data

ITCONNECTUS INC shall exercise heightened care in the processing of special categories of Sensitive Data as defined under applicable law, including data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, and similar categories. Such data shall be processed only where strictly necessary, where an appropriate additional lawful basis exists (such as explicit consent or a substantial public interest legal basis), and where enhanced technical and organizational safeguards have been implemented. Processing of special categories of Sensitive Data must be approved by the CISO and the Data Protection Officer (DPO) prior to commencement.

3.3 How We Use Personal Data

ITCONNECTUS INC processes Personal Data for the following purposes, each of which is pursued only to the extent necessary for the stated objective:

Service Delivery and Account Management: Personal Data is processed to establish and manage client accounts, deliver contracted products and services, fulfill orders, provide technical support, and administer the contractual relationship with clients. The lawful basis for this processing is the performance of a contract.

Communications and Marketing: The Company may use contact information to send individuals service-related communications, product updates, and marketing materials where the individual has provided consent or where the Company has a legitimate interest in communicating with existing clients about related products and services. All marketing communications shall include a clear and easy opt-out mechanism. Opt-out requests shall be honored promptly and no later than within ten (10) business days.

Legal and Compliance Obligations: Personal Data may be processed where necessary to comply with applicable laws and regulations, respond to lawful requests from government authorities, maintain required records, and defend or pursue legal claims. The lawful basis for such processing is legal obligation or legitimate interests.

Analytics and Product Improvement: The Company may process Technical and Usage Data in aggregated or anonymized form to improve its products, services, and website functionality, and to understand user behavior and preferences. Where such processing involves identifiable Personal Data, it shall be based on consent or legitimate interests, and individuals shall retain the right to object.

Non-Sale of Personal Data: ITCONNECTUS INC does not sell, rent, or trade Personal Data to third parties for their independent commercial purposes. Any sharing of Personal Data with third parties is limited to the circumstances described in Section 3.4 below.

3.4 Data Sharing & Disclosure

3.4.1 Internal Sharing

Access to Personal Data within ITCONNECTUS INC is governed by the access control principles described in Section 2.2. Personal Data shall be shared internally only on a need-to-know basis, consistent with the purpose for which the data was collected. Internal sharing shall be documented and subject to the data classification and handling requirements of Section 2.3.

3.4.2 Third-Party Service Providers and Processors

ITCONNECTUS INC may engage third-party service providers to process Personal Data on its behalf, including cloud infrastructure providers, customer support platforms, payment processors, analytics providers, and marketing technology vendors. All such providers are engaged as Data Processors and are contractually required to process Personal Data only on the Company's documented instructions, implement appropriate security measures, and comply with applicable data protection law. A current list of material sub-processors is available upon request from the Data Protection Officer.

3.4.3 Legal Disclosures and Law Enforcement Requests

ITCONNECTUS INC may disclose Personal Data to government authorities, law enforcement agencies, or other parties where required or permitted to do so by applicable law, court order, or legal process. The Company shall not disclose Personal Data in response to informal requests without validating the legal authority of the requesting party, and shall notify affected individuals of such disclosures to the extent permitted by law. The Company shall resist overbroad or legally deficient disclosure demands and shall assert applicable legal objections where appropriate.

3.4.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or other business reorganization involving ITCONNECTUS INC, Personal Data held by the Company may be transferred to the acquiring entity as part of the transaction, subject to the protections required by applicable law. Affected individuals shall be notified of any such transfer and of any changes to the privacy practices applicable to their data as a result of the transaction.

3.4.5 International Data Transfers

Where ITCONNECTUS INC transfers Personal Data to recipients located outside the country or jurisdiction in which the data was collected, such transfers shall be made only in compliance with applicable data transfer requirements. Transfers of Personal Data from the European Economic Area (EEA) to third countries shall be subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other recognized transfer mechanisms. The Company shall maintain a record of all international data transfers and the applicable transfer safeguards.

3.5 Data Retention Policy

ITCONNECTUS INC shall not retain Personal Data for longer than is necessary for the purposes for which it was collected, unless a longer retention period is required by applicable law. The following retention schedule shall apply:

A complete retention schedule is provided in Appendix C. Upon expiration of the applicable retention period, Personal Data shall be securely deleted from all production and backup systems using methods appropriate to the storage medium (e.g., cryptographic erasure for encrypted storage, NIST 800-88-compliant methods for physical media). Physical documents containing Personal Data shall be destroyed using approved cross-cut shredding or certified secure destruction services.

Notwithstanding the foregoing, Personal Data shall be retained beyond the standard retention period where a litigation hold has been issued by Legal Counsel, where a regulatory investigation requires preservation of the data, or where any other lawful obligation requires extended retention. Litigation holds shall be managed by the Legal department and shall be lifted as soon as the underlying need has been resolved.

3.6 Individual Rights & Requests

ITCONNECTUS INC respects and upholds the data protection rights of all individuals whose Personal Data it processes, as provided under applicable law. The following rights are available to Data Subjects, subject to the limitations and exemptions set forth in applicable law:

Right of Access: Data Subjects have the right to request confirmation of whether ITCONNECTUS INC processes their Personal Data and, if so, to receive a copy of that data along with information about how it is processed.

Right to Rectification: Data Subjects have the right to request the correction of inaccurate or incomplete Personal Data held by the Company without undue delay.

Right to Erasure (Right to Be Forgotten): Data Subjects have the right to request the deletion of their Personal Data where the data is no longer necessary for the purposes for which it was collected, consent has been withdrawn and no other lawful basis applies, the data has been unlawfully processed, or erasure is required by applicable law. This right is subject to exemptions for processing necessary for legal compliance or the establishment, exercise, or defense of legal claims.

Right to Restriction of Processing: Data Subjects have the right to request that the Company restrict the processing of their Personal Data in certain circumstances, including where the accuracy of the data is contested or the processing is unlawful.

Right to Data Portability: Where Personal Data is processed on the basis of consent or contract and by automated means, Data Subjects have the right to receive their Personal Data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object: Data Subjects have the right to object to the processing of their Personal Data where the Company relies on legitimate interests as the lawful basis. The Company shall cease such processing unless it can demonstrate compelling legitimate grounds that override the Data Subject's interests, or where the processing is necessary for legal claims.

Rights Related to Automated Decision-Making: Data Subjects have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. Where ITCONNECTUS INC engages in such processing, it shall provide appropriate safeguards, including the right to obtain human review, express a point of view, and contest the decision.

3.6.1 Data Subject Request Procedure

To submit a Data Subject Request (DSR), individuals may contact the Company's Data Protection Officer at the contact details provided in Section 9. The Company shall respond to all DSRs within thirty (30) calendar days of receipt, or within the timeframe required by applicable law where shorter. Where the complexity or volume of requests requires additional time, the Company may extend this period by a further sixty (60) days with notice to the Data Subject. Requests submitted electronically shall be acknowledged within three (3) business days. The Company reserves the right to verify the identity of the requesting individual prior to fulfilling any DSR to prevent unauthorized disclosure of Personal Data. Identity verification shall be accomplished through reasonable means appropriate to the type of request and shall not impose an unreasonable burden on the requestor.

3.7 Cookies & Tracking Technologies

ITCONNECTUS INC uses cookies and similar tracking technologies on its websites and digital applications. Cookies are small text files placed on a user's device that enable certain website functions and help the Company understand user behavior. The Company uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the website and cannot be switched off. They are set in response to actions such as logging in or setting privacy preferences.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering user preferences and settings.
• Analytics Cookies: Allow the Company to measure and analyze how visitors interact with the website, in order to improve its performance and content.
• Marketing Cookies: Used to track visitors across websites to enable the display of relevant advertising and measure the effectiveness of marketing campaigns.

Upon first visiting ITCONNECTUS INC's website, users will be presented with a cookie consent notice through which they may accept or decline non-essential cookies. Users may update their cookie preferences at any time through the Company's cookie preference center, accessible via the website footer. Users may also manage or delete cookies through their browser settings; however, disabling certain cookies may affect website functionality.

3.8 Children's Privacy

ITCONNECTUS INC's products and services are not directed at children under the age of thirteen (13), or under the age of sixteen (16) where required by applicable law, and the Company does not knowingly collect Personal Data from children below the applicable age threshold. If the Company becomes aware that it has inadvertently collected Personal Data from a child without parental consent, it shall take immediate steps to delete such data from its systems. If a parent or guardian believes that their child has provided Personal Data to ITCONNECTUS INC, they are encouraged to contact the Data Protection Officer using the contact details in Section 9, and the Company shall promptly investigate and take appropriate remedial action.

3.9 Privacy by Design

ITCONNECTUS INC is committed to the principle of Privacy by Design, which requires that privacy and data protection be considered and built into products, systems, and processes from their inception, rather than treated as an afterthought. All new projects, systems, or processing activities that may involve Personal Data shall be subject to a Privacy Impact Assessment (PIA) or Data Protection Impact Assessment (DPIA), as appropriate, prior to implementation. DPIAs are mandatory for processing activities that are likely to result in a high risk to the rights and freedoms of individuals, including large-scale processing of Sensitive Data, systematic monitoring of individuals, and use of new technologies. The Data Protection Officer shall be consulted on all PIAs and DPIAs and must approve any new high-risk processing activities before they commence.

The Company shall apply data minimization principles throughout its operations, collecting and processing only the minimum amount of Personal Data necessary for each specified purpose. Default privacy settings for Company products shall be configured to the most privacy-protective option available, and users shall be required to actively opt in to less restrictive settings. Privacy considerations shall be embedded in software development lifecycles, system architectures, and vendor selection processes.

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

4. Confidentiality Policy

4.1 Definition of Confidential Information

For purposes of this section, "Confidential Information" means all non-public information belonging to or entrusted to ITCONNECTUS INC, including but not limited to: business plans, strategies, and forecasts; client lists, contracts, and relationship details; financial data, projections, and reports; product designs, source code, algorithms, and technical documentation; personnel information and employee records; pricing, cost structures, and proprietary methodologies; merger, acquisition, and partnership discussions; and any information designated as "Confidential" or "Restricted" under the Data Classification Framework in Section 2.3. Confidential Information includes information disclosed orally as well as in written or electronic form.

4.2 Employee, Contractor, and Vendor Confidentiality Obligations

All employees, contractors, and vendors with access to Confidential Information are required to: maintain the strict confidentiality of all Confidential Information to which they are exposed; use Confidential Information only for the purposes authorized by ITCONNECTUS INC and within the scope of their engagement; refrain from disclosing Confidential Information to any unauthorized person, whether inside or outside the Company; and take all reasonable precautions to prevent unauthorized access to or disclosure of Confidential Information. These obligations are a material condition of employment, engagement, or access and must be acknowledged in writing as part of the onboarding process.

4.3 Non-Disclosure Obligations

Confidentiality obligations apply throughout the duration of an individual's employment or engagement with ITCONNECTUS INC and shall continue in full force and effect following the termination of such employment or engagement, for a period of five (5) years or for as long as the relevant information remains non-public, whichever is longer. Certain categories of Confidential Information — including trade secrets, personal data of clients or employees, and financial data protected by regulation — may be subject to confidentiality obligations of indefinite duration under applicable law. All employees and contractors shall be required to execute a Non-Disclosure Agreement (NDA) as a condition of engagement.

4.4 Permitted Disclosures

Notwithstanding the foregoing, disclosures of Confidential Information are permitted in the following limited circumstances: disclosures to ITCONNECTUS INC employees, contractors, or vendors who have a need to know the information in connection with their authorized role and who are bound by equivalent confidentiality obligations; disclosures required by applicable law, court order, or lawful regulatory demand, provided that the disclosing party provides ITCONNECTUS INC with prompt prior written notice to the extent permitted by law; and disclosures expressly authorized in writing by the CISO or Chief Legal Officer.

4.5 Consequences of Breach of Confidentiality

Any unauthorized disclosure or use of Confidential Information constitutes a material breach of this policy and may result in disciplinary action up to and including immediate termination of employment or engagement, civil legal action for damages and injunctive relief, criminal prosecution where applicable law provides for criminal liability, and referral to relevant regulatory authorities. ITCONNECTUS INC reserves all rights and remedies available at law or in equity in connection with any breach of confidentiality, and no delay in exercising such rights shall constitute a waiver thereof.

5. Training & Awareness

5.1 Mandatory Annual Security and Privacy Training

All employees, contractors, and other authorized Users are required to complete mandatory security and privacy awareness training at least once per calendar year. Training shall cover the key provisions of this policy, including data classification and handling requirements, password and access control requirements, incident reporting obligations, social engineering and phishing awareness, privacy rights and obligations, and acceptable use requirements. Completion of mandatory training shall be tracked by the Human Resources and IT Security Teams, and non-completion within the required timeframe shall be subject to escalation to the relevant Department Head.

5.2 Phishing Simulation Program

ITCONNECTUS INC shall conduct regular simulated phishing exercises to assess and improve employee awareness of and resilience to phishing and social engineering attacks. Simulations shall be conducted no less than quarterly across all employee populations. Users who respond to simulated phishing messages shall receive immediate just-in-time training and shall be monitored for improvement. Persistent failure to demonstrate appropriate phishing awareness may result in mandatory additional training and disciplinary action consistent with Section 6.

5.3 Role-Specific Training

In addition to general awareness training, role-specific security training shall be provided to personnel in higher-risk roles. Software developers shall receive training on secure software development practices, including OWASP Top 10, input validation, and code review. Human Resources personnel shall receive training on the handling of employee Personal Data, background check procedures, and confidentiality obligations. Finance personnel shall receive training on fraud prevention, financial data handling requirements, and payment security. IT and Security personnel shall receive advanced technical training commensurate with their responsibilities, including incident response, vulnerability management, and security tool operation.

5.4 New Hire Onboarding Security Training

All new employees and contractors shall complete a mandatory security and privacy onboarding module within the first five (5) business days of their engagement. Onboarding training shall cover the key provisions of this policy, the Company's security culture and expectations, acceptable use of systems and devices, how to report a security incident, and contact details for the IT Security Team and Data Protection Officer. New hires shall acknowledge in writing their receipt and understanding of this policy as part of the onboarding process.

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

6. Compliance & Enforcement

6.1 Applicable Laws, Regulations, and Standards

ITCONNECTUS INC's information security and privacy program is designed to meet or exceed the requirements of the following laws, regulations, and industry standards, as applicable to its operations:

• General Data Protection Regulation (GDPR) — applies to the processing of Personal Data of individuals in the European Economic Area;
• California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) — applies to Personal Data of California residents;
• Virginia Consumer Data Protection Act (VCDPA) and other US state privacy laws — as applicable based on the Company's data processing activities;
• SOC 2 Type II — Trust Services Criteria covering security, availability, processing integrity, confidentiality, and privacy;
• ISO/IEC 27001:2022 — International standard for information security management systems;
• Health Insurance Portability and Accountability Act (HIPAA) — where the Company processes Protected Health Information on behalf of covered entities;
• Payment Card Industry Data Security Standard (PCI DSS) — where the Company processes, stores, or transmits payment card data;
• Applicable federal, state, and local laws governing computer security, electronic communications, and data protection.

6.2 Internal Audit Schedule

ITCONNECTUS INC shall conduct internal security and privacy audits on a scheduled basis to assess compliance with this policy and applicable legal requirements. A comprehensive internal audit of the information security program shall be conducted at least annually. Privacy compliance audits shall be conducted at least annually and following any material change to the Company's data processing activities. Audit findings shall be reported to the CISO and the Security Steering Committee, with remediation plans assigned, tracked, and completed within defined timeframes. The Company shall also engage qualified external auditors to conduct independent assessments as required to maintain applicable certifications.

6.3 Policy Violation Consequences

Violations of this policy are treated as serious matters and shall be subject to proportionate disciplinary action, taking into account the nature and severity of the violation, the impact or potential impact on the Company and affected individuals, whether the violation was deliberate or negligent, and the individual's prior disciplinary history. The Company's disciplinary response may range from verbal or written warning for minor first-time violations, through formal written reprimand, mandatory remedial training, suspension, demotion, or reassignment for more serious or repeated violations, to termination of employment or engagement and civil or criminal legal action for the most serious violations, including deliberate misuse or theft of Confidential Information or Personal Data.

6.4 Whistleblower and Reporting Mechanisms

ITCONNECTUS INC encourages all employees, contractors, and other stakeholders to report suspected or actual violations of this policy or applicable law without fear of retaliation. Reports may be made to an individual's direct manager, the IT Security Team, the Data Protection Officer, the Legal department, or, for those who wish to remain anonymous, through the Company's dedicated anonymous reporting channel (details available on the Company's internal intranet). The Company strictly prohibits retaliation against any individual who reports a policy violation or security concern in good faith, and any such retaliation shall itself be subject to disciplinary action.

6.5 Regulatory Reporting Obligations

ITCONNECTUS INC shall comply with all regulatory reporting obligations arising from data breaches or security incidents, including timely notification to supervisory authorities as required by GDPR and other applicable law, notification to affected individuals where required by law or where notification is in their best interests, and filing of reports with industry regulators as applicable to the Company's sector. The DPO and Legal Counsel shall be consulted on all regulatory notification decisions, and the Company shall maintain records of all regulatory notifications made and responses received.

7. Policy Exceptions

7.1 Exception Request Process

Where strict compliance with a specific provision of this policy is not technically feasible or would impose a disproportionate operational burden in a specific context, an authorized individual may submit a formal policy exception request. Exception requests must be submitted in writing to the IT Security Team and must include: a clear description of the specific policy provision for which an exception is sought; the business justification for the exception; the proposed compensating controls that will mitigate the risk created by the exception; the duration for which the exception is sought; and the name of the requesting Department Head.

7.2 Approval Authority

All policy exception requests shall be reviewed by the IT Security Team and assessed for risk. Exceptions to access control, encryption, or incident response provisions shall require approval from the CISO. Exceptions with potential legal or regulatory compliance implications shall additionally require approval from the Chief Legal Officer. No exception shall be granted without documented approval from the appropriate authority. Unauthorized exceptions to policy provisions are themselves policy violations and shall be subject to the enforcement mechanisms of Section 6.

7.3 Exception Duration and Review

All approved exceptions shall be time-limited, with a maximum initial duration of two (2) year. Exceptions shall be reviewed at least annually and shall be renewed only where the underlying justification remains valid. Approved exceptions shall be logged in the Company's risk register and reviewed by the Security Steering Committee.

8. Policy Review & Updates

8.1 Annual Review Schedule

This policy shall be formally reviewed by the CISO and the Security Steering Committee at least once per year, with the next scheduled review occurring on or before April 15, 2028. The annual review shall assess the continued adequacy, suitability, and effectiveness of the policy in light of the Company's current operations, risk environment, and applicable legal requirements. The results of the annual review shall be documented, and any revisions shall be recorded in the Document Control table.

8.2 Trigger-Based Reviews

In addition to the annual review, an unscheduled review of this policy shall be initiated promptly upon the occurrence of any of the following trigger events: a significant security incident or data breach that reveals material gaps in the policy; a material change in applicable law or regulation affecting the Company's obligations; a merger, acquisition, divestiture, or significant organizational restructuring; the introduction of new technologies, products, or processing activities that materially alter the Company's risk profile; direction from the Security Steering Committee or Board of Directors; or a material finding from an internal or external audit.

8.3 Communication of Updates

All material revisions to this policy shall be communicated to all affected personnel prior to the revised version's effective date. Communication shall include a summary of key changes and the effective date of the revised policy. Updated policy documents shall be published on the Company's internal document management system and, where appropriate, on the Company's public website. All employees and contractors shall be required to acknowledge receipt and understanding of material policy updates within thirty (30) calendar days of publication, with acknowledgment tracked by Human Resources.

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

9. Contact Information

ITCONNECTUS INC has designated the following points of contact for matters arising under this policy. All inquiries will be acknowledged promptly and handled in accordance with the timelines described herein.

10. Acknowledgment & Signature

By signing below, the undersigned individual confirms that they have read, understood, and agree to comply with the ITCONNECTUS INC Information Security & Privacy Policy, Version 1.0, effective April 15, 2026. The undersigned acknowledges that compliance with this policy is a condition of their employment or engagement, that violations may result in disciplinary action up to and including termination, and that they have had the opportunity to ask questions regarding the policy's contents.

For HR Use Only — Verification:

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

Appendix A: Data Classification Matrix

This matrix summarizes the four-tier data classification framework of ITCONNECTUS INC, including examples of data in each category, required handling controls, approved storage locations, and sharing restrictions. All employees and contractors are required to familiarize themselves with and apply this framework in their daily work.

Appendix B: Incident Response Contact Tree

This contact tree provides the structured escalation path for security incidents. In the event of a security incident, the reporting individual shall contact their immediate manager and the IT Security Team simultaneously. The IT Security Team shall escalate as indicated based on incident priority. All contact details below are placeholders and must be updated with current information by the IT Security Team prior to this document's effective date.

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0

Appendix C: Retention Schedule Summary

This schedule summarizes the retention periods applicable to the primary categories of data processed by ITCONNECTUS INC. Retention periods commence from the date indicated in the "Retention Period Begins" column. Upon expiration of the applicable period, data shall be securely disposed of in accordance with Section 3.5 unless a retention exception applies. This schedule shall be reviewed annually by the DPO and Legal Counsel.

Appendix D: Glossary of Terms

The following glossary provides definitions for technical, legal, and operational terms used throughout this policy. Definitions herein are intended to supplement, and not replace, definitions provided within the body of this policy or in applicable law.

ITCONNECTUS INC

Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026

Document ID: ITC-POL-SEC-001 | Classification: Internal / Public

© 2026 ITCONNECTUS INC. All Rights Reserved.

This document contains proprietary and confidential information of ITCONNECTUS INC. Unauthorized reproduction, distribution, or use is strictly prohibited.

ITCONNECTUS INC | CONFIDENTIAL | Information Security & Privacy Policy | Version 1.0 | Effective April 15, 2026