Learn how we protect and manage personal information.

This Data Protection Policy supplements the Code of Conduct and applies to all directors, statutory auditors, employees, contractors and third parties acting on behalf of Genneia or its controlled companies (collectively, “Genneia” or the “Company”). Genneia requires its directors, statutory auditors, employees and third parties acting on its behalf to observe this Policy to the fullest extent permitted by law.

Genneia is committed to respecting privacy rights and protecting the information, networks, systems and devices in its possession against cyber risks or attacks, while maintaining transparency and ensuring the appropriate use of the information collected. One of the Company's priorities is to collect, handle, store, process and protect personal information responsibly, in compliance with applicable regulations.

Data Protection Policy Statement

Genneia will not tolerate violations of applicable privacy or data protection laws, or breaches of Company policies. All directors, statutory auditors and employees are required to maintain the confidentiality of private business information and protect the personal information collected. Genneia requires that all information in its possession be stored securely and used solely for legitimate purposes. Violations of Genneia's Data Protection Policy may result in disciplinary measures or sanctions. The Company expects all third-party representatives, suppliers and customers with whom it does business to comply with all applicable data protection and privacy laws.

Limitations on the use, storage and processing of collected data

Genneia may collect personal information and Sensitive Personal Information (SPI), to the extent permitted by applicable law and in accordance with this Policy. The Company may transfer personal information, including SPI, globally and to third parties for legitimate business purposes in accordance with applicable law. Genneia will retain personal information only for the strictly necessary period and will dispose of it in a manner that prevents loss, theft, misuse or unauthorized access.

Limitations applicable to Sensitive Personal Information: the Company reasonably restricts access to Genneia information, including SPI, to authorized individuals who need to access it for legitimate business purposes, including employment and tax matters.

Cybersecurity and data protection

As part of this Data Protection Policy and the Integrated Management System Policy, Genneia seeks to protect its network systems and devices and all Genneia information. The Company uses different cyber defenses to protect its network systems against attacks, including firewalls and antivirus software. Genneia requires access to its systems to be secure and password-protected, requires employees to change their passwords periodically, and maintains other appropriate access controls. Genneia also only allows access to its networks and network services to employees and third parties acting on its behalf who are specifically authorized to do so.

Records and information management

Genneia takes appropriate measures to retain its business records and information in accordance with applicable regulations. The Company periodically backs up Company emails and documents stored on the server. Emails and documents are stored for the period defined in Genneia's information classification procedures. All financial records are retained for five (5) years and legal and tax records are retained for ten (10) years, in accordance with applicable laws in Argentina. The Systems Area keeps a record of all data protection and privacy incident reports for at least five (5) years, as well as records of investigations into incident reports and their final resolution.

Frequently asked questions

What is personal information?

Personal information is any information related to an identifiable person, such as a person's name, address, email address, telephone number, date of birth, or national identity document, which alone or in combination with other information can be used to identify, contact or locate a specific person.

What is sensitive personal information?

Sensitive Personal Information (or “SPI”) is any personal information that is private, confidential or sensitive in nature. SPI may include financial information, such as bank account or credit card numbers; medical or health-status information; personal data about minors; social security numbers or other personal identification numbers.

What can be done to help protect Genneia against cyber risks?

Genneia relies on its directors, statutory auditors, employees and third parties acting on its behalf to take steps to mitigate cyber risks, such as data breaches, and to fully protect Genneia information.

Prevent unauthorized access and do not share Genneia information:

• Limit access to Genneia information to persons authorized for legitimate business purposes.
• Use strong passwords and change them periodically, in accordance with Genneia procedures.
• Make sure your equipment has the latest security software update installed.
• Use devices, hardware and software approved or provided by Genneia for all work-related matters.
• Do not email Genneia information to your personal email address or store Genneia information on unapproved devices, such as USB drives.
• Keep physical files and printed copies, offices and information-storage areas secure.
• Avoid and report fraudulent emails, social engineering mechanisms or other phishing attempts to improperly obtain Genneia information.
• Do not disclose personal information, confidential or sensitive business information, trade secrets or other private information related to Genneia or its employees.

You can monitor cyber threats and vulnerabilities and immediately report cyber incidents, suspected breaches or other related concerns. You can also help raise awareness about cybersecurity issues by asking third parties, suppliers and customers to report possible cybersecurity vulnerabilities or concerns.

What incidents should be reported?

Employees may report suspected cybersecurity or data privacy incidents, violations of the law, or violations of Genneia policies in accordance with the Compliance Reporting Policy.

How should suspected violations be reported?

Anyone may report a suspected cybersecurity incident or violation to Genneia. Anonymous reports can be made through the Compliance Reporting Form available on Genneia's website, www.Genneia.com.ar, by selecting “Commitments, Integrity and Compliance” and then “Report any inappropriate behavior contrary to its provisions”, or by email at conducta.empresarial@genneia.com.ar. However, if the reporting person identifies themselves, the Company may follow up with them to ensure the incident is resolved and provide feedback.

Employees must report all suspected data protection violations to their supervisor, the Systems Area, the Information Technology Help Desk, or Human Capital. They may also report to the Internal Auditor or the Compliance Program Manager, or submit a written report to conducta.empresarial@genneia.com.ar. All reports related to privacy or data protection complaints or incidents will be investigated and addressed in accordance with the Compliance Reporting Policy and related compliance and information technology procedures.