UAB “Pervesk“ Information Security Policy

1. I. This UAB Pervesk Information Security Policy (hereinafter - the Policy) defines the scope of information security of UAB Pervesk (hereinafter - the Company) and the information security objectives of the Company.

2. II. The scope of the Company's information security management system includes:

   1. Provision of electronic payment services to business and private customers;
   2. Provision of collection services;
   3. Issuance of means of payment;
   4. Issuance of payment cards;
   5. Providing a white label business management platform;
   6. Know Your Customer and money laundering prevention services;
   7. Services that are purchased from third parties, and;
   8. The Company's head office and its branch.

3. III. The Company undertakes:

   1. Ensure the confidentiality, integrity and availability of the services provided and all information managed by the Company; to manage the risk properly and have the confidence of stakeholders; to maintain, manage and continuously improve the information security management system in accordance with the requirements of the standard ISO / IEC 27001 (ISO / IEC 27001: 2013) (hereinafter - the Standard).

4. IV. The Information Security objectives are:

   1. Continuously improve the effectiveness of the information security management system in implementing Information Security Policy and its objectives;
   2. Allocate the resources necessary for the proper functioning of the information security management system;
   3. Ensure effective risk management and the use of appropriate risk management measures to manage the risk to an acceptable level through the annual risk assessment and the implementation of the risk management plan;
   4. Meet the needs of stakeholders, implement contractual obligations and applicable information security requirements;
   5. Ensure the competence and awareness raising of employees in the field of information security;
   6. Ensure the basic security principles of the provided services and all information managed by the Company;
   7. In the event of a breach of security of the information system, assess the damage caused, limit its consequences and take the necessary measures to eliminate it, ensure measures for business continuity;
   8. Regularly update the objectives of the information security management system;
   9. Regularly update the technical means used to ensure information security;
   10. Carry out regular audits of the Company's information security management system and eliminate discrepancies found during the audit.

5. V. Final Provisions

   1. This Policy is approved by the decision of the Board of the Company.
   2. The Board appoints an information security officer to ensure that the information security management system complies with the requirements of the Standard, to inform the Board about the effectiveness of the information security management system and to acquaint the Company's employees with the Information Security Policy.
   3. The Policy shall be made available to stakeholders in a form that is accessible and comprehensible to them.
   4. The Policy is reviewed periodically, at least once a year, and revised as necessary.