Correo Group, integrated by Correos and its subsidiaries Correos Express, Nexea and Correos Telecom, operates in the physical and digital communications sector and in the parcel services market. It is leading the non-urgent transport segment and is a reference for the e-commerce sector.

Correos is part of the SEPI Group, a holding company which covers 15 companies in which it has a direct majority participation, with a workforce of more than 78,000 employees. It is also a shareholder in the RTVE Corporation, has a public foundation, and has direct minority holdings in nine companies and indirect holdings in over one hundred companies.

The Correos Group is constituted as a group of companies that carry out their activity in the postal, parcel and communications market where customers demand higher added-value services that can only be offered through excellence and sustainability.

To achieve this goal in accordance with the principles of complying with the law, honesty, integrity and transparency that mark good governance and are found in the Organisation’s Code of Conduct, we have set the following commitments:

– With customers, through efficiency and innovation in processes and products. Constantly seeking excellence in service and developing new solutions adapted to an increasingly digital society.
– With the people working in the Group, by ensuring their health and safety at work, continuous training and personal and professional development of employees.
– And with our environment to actively contribute to the Sustainable Development Goals.

We carry it out in society by promoting the social and cultural development of the communities in which we carry out our activity, such as taking care of the environment in which we work, avoiding contaminating it through the maximum use of available resources, improving the air quality of the cities and reducing the CO2 emissions we produce.

The Correos Group corporate Risk Control And Management Policy, approved by the Governing Board in 2022, sets the principles ad guidelines to ensure the identification, analysis, management and control of risks, systemically and uniformly, thus contributing to:

– achieving strategic corporate goals, maximizing economic value generated;

– providing an adequate level of assurance for all stakeholders;

– compliance with applicable regulations;

– enabling the operations to be carried out with the anticipated safety and quality, ensuring the continuity of public service.

This Policy defines the guidelines to be followed to identify and maintain risks within tolerance thresholds and to provide the elements to decide on the level of acceptable risk at any given time, taking into account the cross-cutting nature of the risks. To this end, its implementation is based on four principles of action: focus on risk management through an effective internal control environment, strengthening corporate governance, comprehensive risk management strategy and culture, and internal transparency.

The Information Security Policy concerns the entire Organisation and states the commitment of the Group’s Management to implement, document and disseminate the security guidelines and requirements through the regulatory framework in place, culminating in the secure management of the information handled by each of our processes.

To this end, the Department has set up the following strategic objectives on Information Security:

• To maintain security levels, in terms of Confidentiality, Integrity and Availability, which are tailored to and consistent with the needs of the Business and the confidence of our customers.

• To ensure the operation of the Corporate Security Committee, the body responsible for managing all matters aimed at preventing, safeguarding and strengthening security of information assets, and to have the necessary resources to do so.

• To implement the technical and organisational measures providing the appropriate level of security to process information in both normal and technological contingency situations, covering the systems and processes that process this information, and guaranteeing compliance with the current legal framework at all times.

• To disseminate this document and the regulatory framework of Information Security that implements it and to promote training and awareness in this area to all the Organisation’s personnel.

• To maintain an Information Security Management System based on international standards to identify, quantify, prioritise and deal with risks, as well as to evaluate and review the development of the Information Security Policy as a framework for defining basic security guidelines.