Correo Group, integrated by Correos and its subsidiaries Correos Express, Correos Express Portugal and Correos Telecom, operates in the physical and digital communications sector and in the parcel services market. It is leading the non-urgent transport segment and is a reference for the e-commerce sector.

Correos is part of the SEPI Group, a holding company which covers 15 companies in which it has a direct majority participation, with a workforce of more than 78,000 employees. It is also a shareholder in the RTVE Corporation, has a public foundation, and has direct minority holdings in nine companies and indirect holdings in over one hundred companies.

The Correos Group is made up by a series of companies engaged in the physical and digital communications sector and the parcel delivery market, in which customers increasingly demand services of greater added value that can only be achieved through excellence and sustainability.

Based on the principles of legal compliance, honesty, integrity and transparency that are enshrined in the General Code of Conduct and the various corporate policies, and within the framework of the United Nations Sustainable Development Goals (SDG) Alignment Model and the company’s Sustainability Master Plan, we have made the following commitments:

• To customers through efficiency and innovation in our processes and products. Constantly striving for excellence in our service and developing new solutions that are tailored to an increasingly more digital society.
• To the people who work for the Group by safeguarding their health and safety in the workplace, through lifelong learning and through their professional and personal development.
• To environmental sustainability by encouraging people to look after the environment through certain specific targets in terms of air quality, climate change and the circular economy, and ensuring that those targets are in line with the United Nations Sustainable Development Goals.
• To society by promoting social and cultural development in the communities where we operate, thereby making a contribution to their well-being and progress.

The Correos Group corporate Risk Control And Management Policy, approved by the Governing Board in 2022, sets the principles ad guidelines to ensure the identification, analysis, management and control of risks, systemically and uniformly, thus contributing to:

– achieving strategic corporate goals, maximizing economic value generated;

– providing an adequate level of assurance for all stakeholders;

– compliance with applicable regulations;

– enabling the operations to be carried out with the anticipated safety and quality, ensuring the continuity of public service.

This Policy defines the guidelines to be followed to identify and maintain risks within tolerance thresholds and to provide the elements to decide on the level of acceptable risk at any given time, taking into account the cross-cutting nature of the risks. To this end, its implementation is based on four principles of action: focus on risk management through an effective internal control environment, strengthening corporate governance, comprehensive risk management strategy and culture, and internal transparency.

The Information Security Policy concerns the entire Organisation and states the commitment of the Group’s Management to implement, document and disseminate the security guidelines and requirements through the regulatory framework in place, culminating in the secure management of the information handled by each of our processes.

To this end, the Department has set up the following strategic objectives on Information Security:

• To maintain security levels, in terms of Confidentiality, Integrity and Availability, which are tailored to and consistent with the needs of the Business and the confidence of our customers.

• To ensure the operation of the Corporate Security Committee, the body responsible for managing all matters aimed at preventing, safeguarding and strengthening security of information assets, and to have the necessary resources to do so.

• To implement the technical and organisational measures providing the appropriate level of security to process information in both normal and technological contingency situations, covering the systems and processes that process this information, and guaranteeing compliance with the current legal framework at all times.

• To disseminate this document and the regulatory framework of Information Security that implements it and to promote training and awareness in this area to all the Organisation’s personnel.

• To maintain an Information Security Management System based on international standards to identify, quantify, prioritise and deal with risks, as well as to evaluate and review the development of the Information Security Policy as a framework for defining basic security guidelines.