Ethics and Corporate Compliance Policy

CORPORATE ETHICS, ANTI-BRIBERY, AND ETHICS HOTLINE POLICY

At Infraestructuras de Medios Técnicos y Servicios (IMTS), technology and security are our areas of expertise, but integrity is the foundation upon which we build our business. As a firm specializing in Governance, Risk, and Compliance (GRC), Internal Audit, Security, and Investigations (OSINT), our clients place their trust in us to identify their vulnerabilities, audit their suppliers, and monitor their most critical systems.

That level of trust demands that we maintain an impeccable corporate ecosystem. Therefore, IMTS management makes a public commitment to conduct all our commercial and technical operations in accordance with the strictest ethical, moral, and legal standards, with zero tolerance for corruption, fraud, or conflicts of interest.

1. GUIDING ETHICAL PRINCIPLES

Our conduct, as well as that of any third party acting on our behalf, is guided by the following guiding principles:

1. Independence and Objectivity: This is the essence of our Audit and Virtual CSO services. No IMTS consultant or analyst will issue a professional opinion, technical audit, or OSINT report that is biased by commercial pressures, personal interests, or external interference. If a potential conflict of interest arises, it will be disclosed immediately, and we will recuse ourselves from the process.
2. Strict Legal Compliance: We scrupulously comply with applicable national and international laws, including anti-money laundering laws, data privacy regulations (GDPR, LOPDGDD), labor regulations, and intellectual property protection laws.
3. Zero Tolerance for Bribery and Corruption: It is strictly prohibited for any IMTS member to offer, promise, pay, solicit, or accept financial or other benefits (including gifts that go beyond mere corporate courtesy) to obtain favorable treatment in private business dealings or public tenders.
4. Fair Competition: We compete in the market based on the technical excellence of our team, the reliability of our reports, and the transparency of our quotes. We reject any collusive practices or anti-competitive agreements.
5. Dignity and Respect in the Workplace: We foster a work environment free from any type of discrimination, harassment, or degrading treatment. We value our team’s talent regardless of gender, race, sexual orientation, or beliefs.

2. RELATIONSHIPS WITH CLIENTS, SUPPLIERS, AND GOVERNMENT AGENCIES

Clients: We treat the information provided by our clients with absolute professional confidentiality. We do not use privileged information obtained during the performance of audits or compliance consulting engagements for our own benefit or that of third parties.

Suppliers and Technology Partners: We only partner with suppliers of hardware, software, or cloud infrastructure whose operational integrity and business ethics are aligned with this Policy. We avoid hidden commissions intended to skew our technical advice (Vendor Agnostic). When purchasing technology (sales and leasing) for a client, we always prioritize the client’s technical and financial interests.

Public Sector: In our interactions with government agencies and in bidding processes (for example, compliance with the ENS), we cooperate honestly, provide accurate technical information, and refuse any practice that could be interpreted as an improper attempt to influence officials or contracting entities.

3. ETHICS CHANNEL (COMMUNICATION AND INFORMATION CHANNEL)

In compliance with Directive (EU) 2019/1937 (Whistleblower Directive) and Law 2/2023, IMTS has established a Ethics Channel that is secure, confidential, and managed impartially.

This communication channel is available to our employees, customers, suppliers, or any legitimate third party so that they may report, in good faith and without fear of any form of retaliation, regarding:

• Well-founded suspicions of criminal activity (fraud, corruption, money laundering).
• Serious breaches of this Business Ethics Policy.
• Severe breaches of information security, data protection, or violations of our ENS/ISO 27001 Compliance Policy by our staff.

Ethics Channel Contact: Reports may be submitted with absolute confidentiality guaranteed to the regulatory email address: 📧 [compliance@imts.es / canaletico@imts.es] (Reports may be submitted anonymously if the whistleblower so desires, and will be handled while protecting the whistleblower’s identity at all times in accordance with the law).

4. ONGOING COMMITMENT AND SANCTIONING SYSTEM

IMTS management periodically reviews compliance with and the effectiveness of the controls established in this area. All IMTS personnel receive a copy of this Policy upon hiring and formally commit to complying with it. Willful non-compliance or gross negligence with respect to this Ethics Policy will result in disciplinary action which, depending on its severity, may lead to the termination of the employment or business relationship, without prejudice to any applicable civil or criminal liabilities.

Approved by the IMTS Management Committee. Last revised: May 2026