INFORMATION SECURITY POLICY

OVERVIEW

AIMM is committed to maintaining appropriate standards of information security throughout its business operations.

This Policy establishes the principles that support the protection of confidential information, proprietary Commercial Intelligence, business information and personal information processed by AIMM.

Information security is an ongoing business process. AIMM may review, modify and improve its security practices as technology, operational requirements, business needs and applicable legal obligations evolve.

POLICY OBJECTIVES

The objectives of this Information Security Policy are to support:

• the confidentiality of information;

• the integrity of information;

• the appropriate availability of information;

• responsible information governance;

• protection of proprietary Commercial Intelligence;

• compliance with applicable legal and contractual obligations;

• responsible operational risk management;

• continual improvement of information security practices.

INFORMATION SECURITY PRINCIPLES

AIMM's information security approach is guided by the following principles.

Confidentiality

AIMM seeks to protect confidential information from unauthorised access, disclosure or misuse.

Access to confidential information is limited to those persons who require such access for legitimate business purposes.

Integrity

AIMM seeks to maintain the integrity of information by implementing appropriate governance processes designed to reduce the risk of unauthorised alteration or corruption.

Information supplied by third parties remains subject to the limitations of those sources.

Availability

AIMM seeks to maintain appropriate availability of information and business systems to support its Commercial Intelligence Services.

Operational priorities and business continuity arrangements may be reviewed and updated as AIMM's business develops.

Proportional Security

Information security measures are selected having regard to the nature of the information, the associated risks and AIMM's operational requirements.

AIMM reserves the right to modify its security practices where considered appropriate.

INFORMATION CLASSIFICATION

Information processed by AIMM may include, where applicable:

• Public Information;

• Internal Business Information;

• Confidential Commercial Information;

• Proprietary Commercial Intelligence;

• Contractual Documentation;

• Personal Information.

The classification applied to any information remains at AIMM's discretion.

ACCESS MANAGEMENT

AIMM seeks to implement appropriate procedures governing access to information and business systems.

Access may be granted, modified, restricted or withdrawn where AIMM considers this necessary to protect its business interests, confidential information or legal obligations.

COMMERCIAL INTELLIGENCE

Commercial Intelligence Deliverables may contain proprietary information belonging to AIMM.

Recipients are expected to use Commercial Intelligence Deliverables only in accordance with the applicable contractual documentation.

Nothing within this Policy grants any licence, ownership right or permission to reproduce, distribute or otherwise exploit AIMM's Commercial Intelligence.

INFORMATION HANDLING

AIMM seeks to manage information responsibly throughout its operational lifecycle.

Where appropriate, information may be:

• collected;

• organised;

• analysed;

• stored;

• transmitted;

• archived; or

• securely disposed of,

• using processes determined by AIMM.

The methods used may change over time as AIMM's business and technologies develop.

THIRD-PARTY INFORMATION

Commercial Intelligence Deliverables may contain information originating from third-party sources.

AIMM does not control third-party information systems and cannot guarantee the security, availability, completeness or continued accessibility of information maintained by third parties.

ARTIFICIAL INTELLIGENCE & INFORMATION SECURITY

Artificial Intelligence may be used by AIMM to support certain research and analytical activities.

The use of AI forms part of AIMM's broader governance framework and remains subject to AIMM's AI Governance Framework and internal governance procedures.

The use of AI does not alter the confidentiality obligations applicable to Commercial Intelligence Deliverables or other confidential information.

CLIENT RESPONSIBILITIES

Clients and Recipients are responsible for implementing appropriate measures to protect Commercial Intelligence Deliverables and other confidential information once received.

Recipients should take reasonable steps to prevent unauthorised disclosure, copying or distribution of confidential information.

AIMM is not responsible for the security of information after it has been lawfully transmitted to, or received by, the intended Recipient.

SECURITY INCIDENTS

AIMM may investigate suspected or actual information security incidents where considered appropriate.

Where required by applicable law or contractual obligation, AIMM may take such actions as it considers appropriate in response to a security incident.

CONTINUOUS IMPROVEMENT

Information security is an evolving discipline.

AIMM may review, update, replace or discontinue its information security policies, governance arrangements and operational practices at any time to reflect changes in technology, business operations, legal requirements and recognised good practice.

RELATIONSHIP WITH OTHER POLICIES

This Information Security Policy should be read together with:

• AI Governance Framework

• Compliance

• Privacy Policy

• Cookie Policy

• Terms of Business

• Commercial Intelligence Framework

• Commercial Intelligence Licence

• Website Terms of Use

• Acceptable Use Policy

IMPORTANT NOTICE

This Information Security Policy provides a general overview of AIMM's information security principles.

It is provided for general information only and does not constitute a contractual commitment, warranty or representation regarding any specific security measure, technology, operational control or level of protection.

The rights and obligations of AIMM and its Clients are governed exclusively by the applicable written contractual documentation.