Data Protection Policy in the Digital Environment

Procedure for Digital Data Protection

1. Purpose and Scope

The purpose of this Procedure is to ensure reliable protection of the Company’s confidential, valuable and sensitive information held in digital form. The Procedure is intended to minimise the risks of data leakage, unauthorised access, malicious attacks and other threats that may arise when processing, storing and transferring data relating to the Company’s customers, products and operations.

2. Responsibility

The person responsible for the implementation of this Procedure is the person responsible for the KC function.

3. Inventory of Information Technology Assets

Under this Procedure, an Information Technology Asset Register has been established. It includes hardware, such as desktop computers, laptops, tablets, mobile phones, routers and cameras, as well as software used to process information.
The Register covers all devices and software containing the Company’s confidential data. Each asset is inventoried, including its name, model, serial number and other identifying information.
This information is updated regularly to reflect the current status of assets. The inventory also includes assets located outside office premises, including mobile devices. Equipment and assets outside the premises are also subject to inventory and protection measures.

4. Preventive Maintenance Programme for Information Technology Assets

To ensure the reliability and long-term operational capability of information technology assets working with data, a preventive maintenance programme has been developed and implemented. The programme is based on maintenance intervals recommended by equipment and software suppliers.
The programme includes both hardware and software maintenance to ensure optimal performance and security.
Records of maintenance performed are documented in detail and entered in the IT Asset Register in accordance with established requirements. This enables regular maintenance to be planned and followed, while preserving the history of technical activities for each asset.

4.1. Software Update and Security Patch Management

The Company shall establish a process for the timely installation of updates, security fixes and other patches released by developers and suppliers for the information systems, software and digital services it uses.
Updates and fixes apply to all relevant systems connected with transport operations and data processing, including order-processing systems, TMS and other transport-management systems, databases, corporate email, EDI/API connections, internet platforms, remote-access tools, access-control systems and other digital solutions in use.
Critical security fixes shall be installed as a priority, taking into account vulnerability assessment and the potential impact on system availability. Where immediate installation is not possible, temporary compensating measures shall be identified and documented.
The installation of significant updates and fixes shall be confirmed by records in the IT Asset Register, the maintenance log, a supplier report or another documented form that allows verification of the date and result of the work performed.

4.2. Backup and Recovery of Critical Data

Critical data and information systems shall be covered by a documented backup and recovery plan enabling the restoration of required data and functionality following a cyber incident, equipment failure, data corruption, malicious attack or other loss of availability.
The plan shall define, at a minimum, the list of critical data and systems, backup frequency, the location and method of backup storage, responsible persons, the recovery procedure, system-recovery priorities and actions in the event that primary resources are unavailable.
Backups shall be protected from unauthorised access and, where possible, logically or physically separated from the primary working data. Access to backups shall be granted only to authorised persons.
The effectiveness of the recovery procedure shall be periodically tested through test data restoration or another documented method. Test results shall be recorded and, where deficiencies are identified, shall serve as the basis for corrective actions.

4.3. Requirements for External IT Service Providers and Digital Platforms

Where the storage, processing or transfer of data, or the operation of an information system, is outsourced to an external provider, cloud service or other contractor, information security requirements shall be considered during selection and in contractual arrangements.
The contract, annex, service-level agreement or other document shall, where applicable, include requirements for the protection of confidential information, access segregation, notification of incidents and vulnerabilities, backup and recovery, update management, data integrity and compliance with mandatory legal requirements and customer contracts.
Appropriate measures to protect data transmission and processing shall be applied to external digital platforms, EDI connections and other data-exchange channels. Their presence shall be considered during the annual cyber-risk assessment.

5. Information System Audit and Compliance with Criteria

To ensure reliability and compliance with established security standards, the Company’s information system shall be reviewed by an independent auditor at least once a year.
The audit includes an assessment of compliance with defined security criteria established within the Company and aligned with the principles of ISO 27001.

5.1. Audit Independence and Documentation of Results

The information system review shall be conducted within the previous twelve months and supported by a documented report, conclusion, act or other evidence of an independent review.
The audit may be conducted by an external organisation or an internal specialist independent from the development, administration and technical support of the information system being reviewed. A review performed by an IT employee directly responsible for the development, operation or maintenance of the system being reviewed shall not be considered independent.
Audit criteria shall be determined before the review begins and may include the Company’s internal requirements, customer contractual requirements, provisions of this Procedure, applicable legal requirements, and applicable provisions of ISO/IEC 27001 and other recognised information-security standards.
Non-conformities and observations identified during the audit shall be included in a corrective action plan with responsible persons and deadlines. Completion of significant corrective actions shall be subject to documented monitoring.

5.2. Annual Penetration Testing

For a Company with 10 or more employees, penetration testing shall be conducted at least once every twelve months to identify vulnerabilities in digital systems used in transport operations and in the processing of transport-related data. For a Company with fewer employees, such testing shall be conducted by management decision, based on risk-assessment results or at the request of a customer.
The scope, depth, complexity and methodology of testing shall be determined based on the structure of the information environment and the level of risk. The scope shall include applicable external and internal digital components, including order-processing systems, TMS, databases, web applications, EDI/API interfaces, remote-access tools and other systems critical to transport operations.
Testing shall be performed by an external qualified specialist or organisation possessing the necessary competence and independence from the development and operation of the systems being tested.
A report shall be prepared based on the testing results, including identified vulnerabilities, their criticality assessment and recommendations. For significant vulnerabilities, a corrective action plan shall be prepared with responsible persons and remediation deadlines. Where necessary, a follow-up verification of vulnerability remediation shall be carried out.
Testing shall be agreed in advance with the responsible person in order to prevent unacceptable impact on operational systems and preserve the confidentiality of information.

6. Communication, Dialogue and Response to Threats and Incidents

To ensure effective communication and information exchange on security matters among employees and contractors, a system has been developed to provide information on current security threats and changes in threat levels: orange, where there is a suspected threat, and red, where the existence of a threat has been confirmed.
The system provides information to both employees and management to ensure an appropriate response to changing circumstances. A system for information exchange with local and national law-enforcement authorities is also in place, enabling a prompt response to possible threats.
Communications, dialogue and information exchange with interested parties, including employees, contractors, customers, authorities and others, are carried out while observing measures to protect confidential information and ensuring a balanced approach to security and transparency.
Where incidents occur, the situation is assessed immediately to minimise potential consequences. A culture of learning from digital data-protection incidents is established within the Company and, where necessary, among contractor companies, enabling improvement of practices and prevention of similar future incidents.

6.1. Procedure for Responding to Information Security Threats and Cyber Incidents

The Company shall maintain a documented procedure for responding to information-security threats and cyber incidents. Such events include, in particular, suspected or actual unauthorised access, malware infection, phishing and compromised credentials, data leakage or loss, disruption of critical system functionality, a cyberattack, discovery of a critical vulnerability, or the loss or theft of a device containing business data.
An employee who identifies signs of a threat or incident shall immediately report it to the person responsible for the KC function and shall not take actions that may destroy significant incident information, unless such actions are necessary to prevent immediate damage.
Depending on the nature of the event, the response includes registration and initial assessment, severity classification, containment and limitation of spread, protection of accounts and data, preservation of available evidence, elimination of the cause, recovery of systems and data, verification of normal operation, and notification of management, customers, contractors, suppliers, the insurance organisation or competent authorities where such notification is required.
For each significant incident, a report and action plan shall be prepared containing a description of the event, affected systems and data, immediate measures taken, causes, corrective and preventive actions, responsible persons, deadlines and a record of implementation verification.
If the event constitutes a non-conformity under the NC Policy, it shall also be recorded in the Non-Conformity Reporting Log. Based on the investigation results, the risk assessment, applied protective measures, contractual requirements for suppliers, backup recovery plan and training programmes shall be reviewed where necessary.

7. Risk Management

A periodic risk assessment shall be conducted at least once every twelve months. The assessment covers data relating to the Company’s customers, products and operations and includes the identification of potential threats and vulnerabilities in the data-storage and processing system.
The Company uses data-protection measures, order-processing tools and customer order data on its corporate website. The electronic data interchange system is configured for secure transmission of business documents between computers in a standard electronic format. Order-processing tools are configured with data protection in mind to prevent unauthorised access and information leakage.
Data-protection risks include, at a minimum:
Hacker attacks, including attempts at unauthorised access to systems.
The spread of malicious software.
Insufficient protection of business information on laptops, tablets, mobile phones and other mobile devices.
To reduce the risk of hacker attacks, the Company uses authentication measures and controls access to sensitive data. To prevent the spread of malicious software, antivirus software is updated regularly, network activity is monitored, and employees receive training on recognising malicious attachments and on security rules for working with mobile devices.
Risk management in the implementation of digital data protection is carried out in accordance with the Procedure for Identification, Assessment and Prioritisation of Risks and the Risk Map specified in Appendix No. 1 to this Procedure.
Each “Response Scenario upon the Occurrence of a Risk Event” in Table No. 2 of the Risk Map requires the mandatory implementation of the following standard requirements:
Report the non-conformity to the immediate manager.
Notify the consignor or customer of the non-conformity.
Record the non-conformity in the Non-Conformity Reporting Log.
Investigate the incident using industry guidance, standards and rules.
Based on the results of the incident investigation, provide the necessary specialised training to responsible persons and verify their knowledge.

7.1. Requirements for Annual Documented Cyber-Risk Assessment

Cyber-risk assessment shall be conducted and documented at least once every twelve months, as well as unscheduled after a significant cyber incident, the implementation of a critical information system or a material change in the digital processes in use.
The assessment shall, where applicable, cover hacker attacks and unauthorised access, malicious and ransomware software, phishing and compromised accounts, mobile-device protection, vulnerabilities in EDI/API connections and digital order-processing platforms, risks associated with external IT providers, the timeliness of updates and patches, backup and recovery, access to critical systems and databases, and other risks that may affect the confidentiality, integrity or availability of data.
The assessment shall verify the presence and adequacy of protection measures for data transmission and processing, including EDI connections, order-processing systems, corporate online services and other digital information-exchange channels in use.
For each significant risk, existing control measures, the residual risk level and, where necessary, additional measures with responsible persons and implementation deadlines shall be determined. The results shall be documented in the Risk Map or another document consistent with the Procedure for Identification, Assessment and Prioritisation of Risks.

7.2. Multi-Factor Authentication and Access Management for Critical Systems

Access to sensitive and critical information systems, including transport-management systems, databases, administrative accounts, cloud services, remote-access tools and other systems containing confidential information, shall be provided through multi-factor authentication, or MFA, where technically available.
MFA shall combine a personal identifier and password with an additional verification factor, such as a one-time code, authenticator application, hardware key or another independent means of confirmation.
If an individual system does not support MFA, this fact shall be documented, the risk assessed, and compensating measures applied, such as restricted network access, enhanced access-rights control, VPN, device restrictions or other technical and organisational measures.
Access rights shall be granted on the need-to-perform-job-duties principle, reviewed periodically and promptly terminated when responsibilities change or employment or contractual relations end.

8. Employee Training

Employee training: regular employee training shall be provided on protection rules and actions to take in the event of data leakage, unauthorised access, malicious attacks and other threats that may arise when processing, storing and transferring data relating to the Company’s customers, products and operations. The person responsible for the KC function is responsible for the appropriate training of Company employees.
Responsible persons of contractor transport companies shall be trained in this Procedure and in instructions for digital data protection. The person responsible for the OD function is responsible for the appropriate training of responsible persons of contractor transport companies.

9. Review and Update of the Procedure

This Procedure shall be reviewed regularly and updated as necessary, taking into account possible changes and updates to digital data-protection requirements, as well as any new requirements or legislation relating to this area.

10. Applicable Industry Guidance, Standards and Rules

2013, CEFIC, Responsible Care, “Responsible Care Security Code Guidance and Best Practice for the Implementation of the Code”.