This Policy, approved by the MANAGEMENT of GLOBAL MANAGER IBERIA (*), is the frame of reference for carrying out our activities and relationships, and applies to all the operations of our companies and trade brands, to all our own staff, collaborators and subcontractors, and to anyone acting with authorisation in the name or on behalf of the organisation.
This scope of application is that of the corporate commitment and covers the whole group. The certified scope of each management system is narrower and is defined in the corresponding manuals; see section 4.
(*) GLOBAL MANAGER IBERIA is the name that encompasses the companies GLOBAL MANAGER SPAIN, S.L. and GLOBAL MANAGER PORTUGAL UNIPESSOAL LDA, which provide services based on new ways of working, in Spain and Portugal, under the trade brands EPUNTO Interim Management, The LIQUID finance, The LIQUID build and Círculo de Management.
1. Purpose
This Policy seeks to meet the needs and requirements of our clients, committing to good professional practice and providing services that fulfil their intended use, bearing in mind the importance of focusing on understanding our stakeholders and of preventing, and responding quickly and effectively to, any risk situation.
Our purpose is to solve our clients' challenges by relying on global, flexible, qualified and committed talent. We understand quality as a fundamental strategy for achieving and sustaining this, and information security as an inseparable condition of that service: our services rely on our own information and on information entrusted to us by third parties, and protecting it is part of delivering them well.
Management has provided the resources, responsibilities and mechanisms needed for the implementation, development and continual improvement of an INTEGRATED MANAGEMENT SYSTEM, aligned with the international standards ISO 9001:2015 and ISO/IEC 27001:2022.
2. Quality commitments
-
Quality and its improvement are the responsibility of everyone who works with Global Manager Iberia, starting with Management.
-
Quality is achieved by planning, executing, reviewing and improving the Management System, always bearing in mind the context of the organisation, both internal and external.
-
Quality is aimed at the satisfaction of all our interested parties, meeting their needs and requirements, as well as legal and regulatory requirements and those of the services themselves, including all the implications associated with climate change.
-
Quality relies on the effectiveness of the management system, in which preventing errors is a fundamental aspect, always seeking continual improvement.
-
Quality leads us to pay the utmost attention to technological developments and to the improvements that new technologies make available to us.
3. Information security commitments
Management takes responsibility for the Information Security Management System and declares the following commitments:
-
Suitability to the purpose of the organisation. Information security is aligned with the business strategy and with the context in which we operate, and is sized according to the assessed risk and not to a generic template.
-
Protection of information. We preserve the confidentiality, integrity and availability of our own information and of the information entrusted to us by clients, candidates, employees and suppliers, regardless of its medium or location.
-
Compliance with applicable requirements. We comply with legal, regulatory and contractual requirements on security and data protection —in particular Regulation (EU) 2016/679, the Spanish Organic Law on Data Protection (LOPDGDD) and the applicable Portuguese legislation— as well as the commitments made to clients when we act as data processors.
-
Framework for objectives. This Policy is the basis on which the information security objectives, described in section 5, are set.
-
Continual improvement. We are committed to the continual improvement of the system, addressing nonconformities, incidents and the opportunities identified.
-
Risk management as a pillar. We periodically identify and assess security risks, decide on their treatment and state explicitly when a risk is not sufficiently covered, instead of treating it as resolved.
4. Scope
The scope of the Integrated Management System is the one defined in the system documentation: that of the Quality Management System in the QMS Manual and the context record R-00-00, and that of the Information Security Management System in the ISMS Manual, section 2.3, together with the current Statement of Applicability.
⚠️ The certified scope is narrower than the scope of application of this Policy. In particular, the scope of the ISMS covers only GLOBAL MANAGER SPAIN, S.L. and its Valladolid headquarters, and expressly excludes GLOBAL MANAGER PORTUGAL UNIPESSOAL LDA, the sales offices in Madrid and Lisbon, and design and development provided to clients, in accordance with the ISMS Manual, section 2.3.1. References in this Policy to the group companies, their premises or the legislation of the countries in which it operates do not extend the certified scope.
This Policy does not reproduce the scope: it references it, so that updating it does not give rise to divergent versions.
5. Framework for objectives
Quality and information security objectives are set periodically, are measurable, are communicated and are reviewed in the management review and in the Quality and Security Committee. They are derived from:
-
The analysis of the context and the analysis and assessment of risks and opportunities.
-
The applicable legal, regulatory and contractual requirements.
-
The nonconformities, incidents, complaints and opportunities recorded.
-
The results of internal and external audits.
6. Responsibilities
Management approves this Policy, allocates resources, chairs the system review and formally accepts residual risks. The Quality Director governs the management system, its body of documentation, internal audits and nonconformities. The Information Security Officer (CISO) maintains the ISMS, risk management, incidents and awareness. Process owners apply the controls within their area and provide evidence of their execution. All staff comply with this Policy and report immediately any incident, weakness or suspicion relating to information security to it@gmiberia.com, always within 24 hours of its detection, in accordance with IT-ES03-01 Incident Response Plan.
The nominal assignment of these responsibilities is maintained in the management system.
7. Specific policies
This Policy is developed through topic-specific policies that are mandatory and equally binding, which do not replace it and may not contradict it: access control, password management, cryptographic controls, acceptable use of assets, secure development, acceptable use of cloud services and use of artificial intelligence.
Any future topic-specific policy is subordinate to this document.
8. Ethical conduct
Management promotes a culture of quality and security based on ethical behaviour, transparency and responsibility. This Policy and the Code of Conduct reinforce each other and seek to ensure client satisfaction and the trust of our interested parties as an essential principle of our activity.
The organisation makes available to anyone an ethics channel —https://ethic.gmiberia.com—, confidential and private, to report irregularities, misconduct or ethical conflicts, without retaliation.
9. Communication, availability and review
Quality and Security require the participation and collaboration of everyone, which is why this Policy is communicated to all staff of Global Manager Iberia for their knowledge and understanding, is provided on joining and after each review, and is permanently available in the management system. It is made available to interested parties who require it for contractual or audit reasons.
This Policy is reviewed at least once a year, and whenever there are significant changes in the organisation, in the services provided, in the risk context or in the applicable requirements. It comes into force on the date of its approval and repeals the previous version.