BANKINPLAY S.L.U. as a company dedicated to the integration of banking movements in corporate management systems, assumes its commitment to information security, committing itself to the adequate management of the same, in order to offer all its stakeholders the greatest guarantees regarding the security of the information used. In view of the above, the Management establishes the following information security objectives:
- Provide a framework for building resilience to respond effectively to critical security situations.
- Ensure the rapid and efficient recovery of services from any physical disaster or contingency that may occur and put the continuity of operations at risk.
- Prevent information security incidents to the extent technically and economically feasible, as well as mitigate the information security risks generated by our activities.
- Guarantee the confidentiality, integrity, availability, authenticity and traceability of information.
The legal and regulatory framework in which we carry out our activities is:
- REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the protection of individuals with regard to the processing of personal data and on the free movement of such data
- Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights.
- Royal Legislative Decree 1/1996, of 12 April, Law on Intellectual Property.
- Royal Decree-Law 2/2018, of 13 April, amending the revised text of the Law on Intellectual Property.
- Royal Decree 3/2010, of 8 January, on the development of the National Security Scheme modified by Royal Decree 951/2015, of 23 October.
- REGULATION (EU) 910:2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market (European eIDAS Regulation).
- Occupational Risk Prevention Law 31/1995 of 8 November 1995 and Royal Decree 39/1997 of 17 January 1997, approving the Prevention Services Regulations.
- Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
- RD-ley 13/2012 of 30 March, cookies law.
- Royal Legislative Decree 1/1996, of 12 April, approving the revised text of the Intellectual Property Law, regularising, clarifying and harmonising the legal provisions in force on the matter.
- Resolution of 7 October 2016, of the Secretary of State for Public Administrations, approving the Technical Security Instruction on the Security Status Report.
- Resolution of 13 October 2016, of the State Secretariat for Public Administrations, approving the Technical Security Instructions in accordance with the National Security Scheme.
- Resolution of 27 March 2018, of the Secretary of State for Public Administration, approving the Technical Security Instruction on Auditing the Security of Information Systems.
- Resolution of 13 April 2018, of the Secretary of State for Public Function, approving the Technical Security Instruction on Security Incident Notification.
- Royal Decree 311/2022, of 3 May, which regulates the National Security Scheme.
In order to achieve these objectives it is necessary to:
- Continuously improve our information security system.
- Comply with applicable legal requirements and any other requirements to which we subscribe in addition to our commitments to customers, and continually update them.
- Identify potential threats, as well as the impact on business operations that such threats, should they materialise, may cause.
- Preserve the interests of our key stakeholders (customers, shareholders, employees and suppliers), reputation, brand and value creation activities.
- Work together with our suppliers and subcontractors to improve IT service delivery, service continuity and information security, leading to greater efficiency in our business.
- Assess and guarantee the technical competence of our staff and ensure that they are adequately motivated to participate in the continuous improvement of our processes by providing training and internal communication to develop the best practices defined in the system.
- To guarantee the correct state of the facilities and the appropriate equipment, in such a way that they are in correspondence with the activity, objectives and goals of the company.
- To ensure a continuous analysis of all relevant processes, establishing the relevant improvements in each case, depending on the results obtained and the established objectives.
- To structure our management system in a way that is easy to understand.
The management of our system is entrusted to the Management Manager and the system will be available in our information system in a repository, which can be accessed according to the access profiles granted under our current access management procedure.
These principles are assumed by the Management, which has the necessary means and provides its employees with sufficient resources to comply with them, and which makes them known to the public through this Integrated Management Systems Policy.
The safety committee is an autonomous, executive body with autonomy in decision-making, and its activity does not have to be subordinated to any other element of our company.
This policy is complemented by the rest of the policies, procedures and documents in force to develop our management system.
In Madrid, 21 November 2024
