Information Security Policy

1. Our Commitment

At LLAMA Games, information security is an integral part of how we develop our products, operate our technology and build trusted relationships with our partners.

We recognise the importance of protecting the confidentiality, integrity and availability of information and systems entrusted to us.

Our approach to information security is based on risk management, appropriate technical and organisational safeguards, continuous improvement and compliance with applicable legal, regulatory and contractual requirements.

2. Purpose

This Information Security Policy sets out the high-level principles that guide LLAMA Games' approach to protecting:

• company and business information;
• personal data;
• intellectual property;
• technology and software;
• information systems and infrastructure;
• information received from partners and service providers; and
• other information assets under our responsibility.

Detailed technical controls, procedures and security standards are maintained internally and are not disclosed publicly where doing so could compromise their effectiveness.

3. Information Security Principles

LLAMA Games' information security approach is based on three fundamental principles:

• Confidentiality – information should be accessible only to authorised persons and systems.
• Integrity – information and systems should be protected against unauthorised or accidental modification, destruction or corruption.
• Availability – information and systems should be available to authorised users when reasonably required.

We also seek to maintain the resilience of our systems and our ability to respond to and recover from security incidents.

4. Risk-Based Security

We apply a risk-based approach to information security.

Security risks are identified and assessed according to their likelihood and potential impact, taking into account factors including:

• the nature and sensitivity of information;
• applicable legal and regulatory requirements;
• technology and infrastructure;
• cyber threats and vulnerabilities;
• business operations;
• third-party dependencies; and
• potential impact on LLAMA Games, our partners and other stakeholders.

Security measures are selected and maintained in proportion to the risks identified.

5. Access Control

Access to information and systems is managed according to business requirements and security principles.

We seek to ensure that:

• access is provided only to authorised persons;
• access rights are appropriate to an individual's role and responsibilities;
• the principles of need-to-know and least privilege are applied;
• appropriate authentication measures are used;
• access rights are reviewed and adjusted when roles or circumstances change; and
• access is removed when it is no longer required.

6. Secure Development and Technology

Information security is considered throughout the development and maintenance of LLAMA Games technology and software.

Our security approach includes, as appropriate:

• secure development practices;
• security considerations throughout the software development lifecycle;
• management of vulnerabilities and security updates;
• appropriate separation of development and production environments;
• change management;
• testing and quality assurance;
• monitoring of relevant systems and services; and
• protection against known and emerging security threats.

We periodically review our security practices as technologies, risks and industry requirements evolve.

7. Protection of Information

We apply technical and organisational measures appropriate to the sensitivity and importance of information.

Depending on the relevant risks and systems, these measures may include:

• logical and physical access controls;
• authentication and authorisation controls;
• encryption and other cryptographic measures;
• network and infrastructure security;
• logging and monitoring;
• backup and recovery mechanisms;
• malware and threat protection;
• vulnerability management; and
• secure configuration and maintenance practices.

Specific security configurations and controls are confidential and are not disclosed publicly.

8. Personal Data

Personal data is protected in accordance with applicable data protection legislation and LLAMA Games' privacy and information security requirements.

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Further information concerning our processing of personal data is available in our Privacy Policy.

9. Security Monitoring and Vulnerability Management

LLAMA Games maintains processes designed to identify and manage security risks and vulnerabilities affecting relevant systems and technology.

Depending on the relevant environment and risk, these processes may include security monitoring, vulnerability assessment, patch management, testing and review of security controls.

Identified vulnerabilities are assessed and prioritised according to risk.

10. Security Incident Management

We maintain procedures for identifying, assessing, managing and responding to information security incidents.

Our approach is designed to:

• detect and assess potential security incidents;
• contain and mitigate their impact;
• protect affected systems and information;
• investigate the cause and scope of incidents;
• restore affected services where necessary;
• preserve appropriate records and evidence;
• notify relevant parties or authorities where legally required; and
• use lessons learned to strengthen our security controls.

11. Business Continuity and Resilience

We recognise that information security includes the ability to maintain and restore important business and technology services.

Appropriate business continuity, backup, recovery and resilience measures are maintained according to the criticality of relevant systems and business processes.

These arrangements are reviewed and tested as appropriate.

12. Third Parties and Supply Chain Security

Third-party providers may introduce information security risks.

We therefore consider security when selecting and working with relevant suppliers, service providers and technology partners.

Depending on the nature of the relationship and associated risks, appropriate security and confidentiality requirements may be incorporated into contractual arrangements.

We expect third parties with access to LLAMA Games information or systems to apply security measures appropriate to the services they provide and the information they process.

13. People and Security Awareness

Information security is a shared responsibility.

Employees and relevant contractors are expected to comply with applicable information security requirements and protect information entrusted to them.

LLAMA Games promotes security awareness and provides appropriate guidance or training to personnel based on their roles and responsibilities.

Confidentiality and information security obligations may continue after employment or contractual relationships end where appropriate.

14. Physical Security

Appropriate measures are applied to protect premises, equipment and other physical information assets against unauthorised access, damage, interference or loss.

The measures applied depend on the nature of the facility, equipment and associated security risks.

15. Compliance

LLAMA Games seeks to comply with applicable:

• information security requirements;
• data protection legislation;
• cybersecurity requirements;
• intellectual property requirements;
• contractual security obligations; and
• other relevant legal and regulatory requirements.

Our information security framework and controls are reviewed and updated where appropriate to reflect changes in technology, threats, business operations and regulatory requirements.

16. Continuous Improvement

Cybersecurity threats and technology continually evolve.

For this reason, LLAMA Games treats information security as an ongoing process rather than a one-time activity.

We seek to continuously improve our security posture through risk assessment, monitoring, testing, review, training and the implementation of appropriate improvements.

17. Responsible Reporting of Security Concerns

We encourage responsible reporting of suspected security vulnerabilities affecting the LLAMA Games Website or technology.

If you believe you have identified a potential security issue, please contact info@llamagames.com.

Please provide sufficient information to allow us to understand and investigate the issue.

We ask that suspected vulnerabilities are not publicly disclosed before LLAMA Games has had a reasonable opportunity to investigate and address them.

18. Policy Review

This Information Security Policy is reviewed periodically and may be updated to reflect changes in our business, technology, security environment or applicable requirements.

19. Contact

Questions concerning this Information Security Policy may be directed to: