Information Security Policy (external version)

Version 1.1 · November 2026

Purpose

To protect the confidentiality, integrity and availability of the information of Muculo Retail clients, partners and staff.

Principles

• Least privilege: people access only the information they need for their work.
• Defence in depth: complementary technical, organisational and physical controls.
• Continuous improvement: we regularly review risks, controls and incidents.

Main measures

Muculo Retail undertakes to apply the following measures, proportionate to its size and to the risk of the data it handles.

• Strong passwords and, wherever possible, a second authentication factor.
• Encryption of data in transit and protected devices.
• Regular, tested backups.
• Regular system and application updates.
• Security and data protection training for staff.
• Suppliers assessed and bound by confidentiality and security clauses.

Incident management

Security incidents are logged, analysed and handled without delay. Where personal data is involved, they are notified to authorities and data subjects as required by applicable law.

How to report

If you find a vulnerability or an incident affecting Muculo Retail, report it to [email protected] with the subject "Security". We review all good-faith reports.