Qorect Corporate Statement of Principles & Code of Ethics

At QORECT, we believe that technology has real value when it serves people, businesses and sustainable growth in a meaningful, secure and responsible way. Our company operates in the fields of business software, ERP, eCommerce, retail and hospitality solutions, as well as customized digital implementations, with the PLANO ecosystem and its individual capabilities at the core, including ERP, CRM, Workflows, Project Management, eCommerce, Retail and Hospitality. QORECT's public presence reflects precisely this philosophy: reliable and scalable software solutions tailored to the real needs of businesses, with an emphasis on quality, flexibility and effective support.

This statement expresses the principles that guide QORECT's conduct, decisions and relationships with customers, employees, partners and every third party with whom it interacts. It is not merely a formal compliance document. It represents our commitment to a way of operating based on integrity, professionalism, respect and continuous improvement.

Our first and non-negotiable principle is integrity. We strive to communicate honestly, act consistently and responsibly honor our commitments. We do not promise more than we can deliver, and we do not conceal critical aspects of a project, business relationship or technical decision. We want our customers and partners to know that they can rely on us not only for our expertise, but also for the professional way in which we stand beside them.

Our second fundamental principle is respect for the customer. QORECT publicly states that its primary concern is delivering quality results and providing serious and responsible customer support, both at a technical and advisory level, including matters relating to everyday business operations. This position also reflects our internal culture: we listen carefully, study the actual needs of each business and design solutions that provide functional and operational value. We do not view the customer simply as the recipient of a service, but as a partner with whom we build a relationship of trust over time.

Likewise, we consider respect for our employees and partners to be of fundamental importance. We seek to foster a working environment that promotes collaboration, meritocracy, courtesy, continuous learning and knowledge sharing. Any form of insulting, intimidating, abusive or discriminatory behavior is not acceptable. We believe that the quality of the software, support and services we provide externally is directly connected to the quality of the relationships and culture we cultivate internally.

QORECT operates with the understanding that business software affects critical functions of its customers. For this reason, we place particular emphasis on the quality, functionality and reliability of the solutions we design and support. PLANO and our broader technology ecosystem must serve the day-to-day operations of businesses with clarity, speed, practicality and stability. From commercial management and workflows to eCommerce, retail and hospitality, our goal is to provide tools that genuinely help businesses organize, monitor, grow and adapt.

Confidentiality of information and data protection have a particularly important place among our principles. QORECT publicly states that information security is a top priority and that it operates an Information Security Management System in accordance with ISO/IEC 27001. Public corporate information regarding the operating environment of Plano eCommerce also refers to ISO 22301-certified facilities for business continuity and ISO/IEC 27017 for cloud service security.

Based on this commitment, every member of QORECT is expected to handle with discretion and responsibility any business, technical, financial or personal information received in the course of their work. Customer information, project data, access credentials, commercial data, financial information, databases, infrastructure, configurations and know-how are protected and must not be disclosed to unauthorized persons. Compliance with the GDPR and all applicable data protection legislation is a continuing obligation and not an optional practice.

Within the same framework, cybersecurity is a daily responsibility. We regard security as an ongoing process of prevention, control and improvement. We apply principles of secure access, controlled use of systems, careful management of passwords and permissions, secure storage and transmission of data, and immediate reporting of incidents or suspected breaches. The existence of certified infrastructure for information security, business continuity and cloud security demonstrates that our technological operations are supported by a specific framework of controls and resilience.

Business continuity is also an essential part of our responsibility toward our customers, partners and the wider service ecosystem. The solutions we provide must be designed and supported in a way that strengthens availability, stability and operational resilience. When a customer relies on ERP, eCommerce, retail or hospitality systems for their operations, they have the right to expect a serious approach to service continuity and the minimization of operational risk. QORECT's public reference to certifications for business continuity and secure cloud environments reinforces this commitment.

Responsible use of Artificial Intelligence (AI) also has a distinct place in our code. QORECT recognizes that AI tools can enhance productivity, analysis, customer service, content creation and operational support. However, their use must be measured, transparent and subject to human oversight. We do not use AI systems in a way that exposes confidential data, generates misleading content, uncontrollably replaces human judgment or makes critical business decisions without appropriate oversight. For us, AI is a tool for support and improvement, not a mechanism for uncontrolled automation. Particularly in matters involving customer data, technical decisions, financial processes, legal matters or communication with third parties, human verification, professional judgment and compliance with security and privacy principles are always required.

With regard to relationships with partners and suppliers, we seek clear terms of cooperation, professional conduct and mutual respect. We pursue partnerships that align with the level of quality, consistency and professional responsibility that we consider necessary. We expect our partners to respect confidentiality, security, data, legality and the company's reputation, just as we commit to doing the same toward them.

Avoiding conflicts of interest is equally important. Every executive, employee or partner of QORECT must act based on the legitimate and genuine interests of the company and its customers, without being influenced by personal benefits, external pressures or parallel activities that could compromise professional judgment. Where a potential conflict of interest exists, it must be disclosed promptly and transparently.

Finally, QORECT is committed to continuous improvement. Technology, security, business needs and regulatory requirements are constantly evolving. For this reason, we regularly review our practices, policies and tools, invest in knowledge and ensure that we continue to evolve without losing the human character of our partnerships. Our goal is to remain a reliable technology partner that does not simply provide software, but builds relationships based on trust, consistency and long-term perspective.

This statement reflects QORECT's commitment to operating responsibly, transparently and respectfully toward everyone: the customers who trust us, the people who work with us, the partners who contribute to our work and the market in which we operate.

1. Purpose

This Code establishes the fundamental principles of professional conduct and information security that all QORECT employees and partners are expected to follow.

The objectives are:

• protecting the information of QORECT and its customers,
• protecting information systems and infrastructure,
• ensuring the confidentiality, integrity and availability of information,
• complying with company policies and the Information Security Management System (ISMS),
• promoting responsible, professional and secure behavior.

The Code applies to all personnel, regardless of position or employment relationship, as well as external partners who have access to QORECT information or systems.

2. Fundamental Principles of Professional Conduct

Every QORECT employee must act with:

Integrity

Acting with honesty, responsibility and professionalism.

Confidentiality

Protecting the information received in the course of their work.

Respect

Treating colleagues, customers, partners and suppliers with respect.

Responsibility

Taking responsibility for their actions and their use of company systems.

Compliance

Following the policies, procedures and instructions established by QORECT.

3. Information Confidentiality

Information managed by QORECT constitutes a company asset.

Employees:

• use information exclusively for the purpose for which it was provided,
• do not disclose company or customer information to unauthorized persons,
• do not discuss confidential information in public places,
• do not send company data to personal email accounts or unauthorized services,
• do not copy company files to personal computers or storage media without prior authorization,
• do not publish information concerning customers, projects or QORECT's internal operations without authorization.

The obligation of confidentiality remains in effect after termination of the relationship with the company.

4. Protection of Customer Data

QORECT manages information relating to customers, partners, users, applications, commercial processes and information systems.

Employees must have access only to the information necessary to perform their duties.

The following are prohibited:

• searching for customer data without a professional reason,
• copying databases without approval,
• using real customer data in unauthorized test environments,
• sending data to third parties without authorization,
• photographing or recording customer information for personal use.

5. User Accounts and Access Credentials

Every employee must use exclusively their personal account.

Passwords:

• are personal,
• must not be shared with colleagues or third parties,
• must not be sent via email, messaging applications or other insecure means,
• must not be written down in visible locations,
• must not be reused across personal and professional accounts.

Where Multi-Factor Authentication (MFA) is available, it must be used in accordance with company policy.

Use of another employee's account is prohibited.

Employees are responsible for every action performed through their personal account.

6. Use of Computers and Company Equipment

Company equipment is provided for professional use.

Employees:

• must not install unauthorized software,
• must not disable antivirus, firewall or other security systems,
• must not change security settings without authorization,
• must install or allow the installation of required updates,
• must lock their screen when leaving their workstation,
• must protect equipment against loss, theft or unauthorized use.

Employees must not leave company laptops, mobile devices or other equipment unattended in an insecure location.

7. Clear Screen and Clear Desk Policy

When leaving the workstation:

• the computer screen must be locked,
• documents containing confidential information must not be left exposed,
• passwords or credentials must not be written in visible locations,
• sensitive documents must be stored appropriately at the end of the workday.

Documents that are no longer required and contain sensitive information must be securely destroyed.

8. Electronic Mail

Company email is a professional business tool.

Before sending any email, the following must be checked:

• the recipient,
• the content,
• the attachments,
• the necessity of sending confidential information.

Particular attention is required when dealing with:

• unknown senders,
• links,
• ZIP files,
• executable files,
• password change requests,
• requests involving bank transactions,
• IBAN changes,
• unusual or urgent requests.

In case of doubt, employees must not open a link or attachment and must notify the ISMS Manager or the appropriate technical department.

9. Phishing and Social Engineering

No employee should assume that a message is safe simply because it appears to come from a known person.

Social engineering attacks may take place through:

• email,
• telephone,
• SMS,
• messaging applications,
• social media,
• physical presence.

The following must never be disclosed without verifying that the requester is authorized:

• passwords,
• MFA codes,
• access credentials,
• customer information,
• technical infrastructure information.

10. Internet Use

Internet access through company systems must be carried out in a manner that does not compromise QORECT's security.

The following are prohibited:

• accessing suspicious or malicious websites,
• downloading unauthorized software,
• using torrents or P2P services,
• bypassing security mechanisms,
• using unauthorized VPN or proxy services,
• using company systems for illegal activities.

11. USB Devices and Removable Media

USB flash drives, external drives and other removable media may be used only when there is a business need and in accordance with QORECT policies.

Unknown USB devices or storage media must not be connected to a company computer.

For the transfer of confidential data, approved and, where required, encrypted solutions must be used.

12. File Storage and Sharing

Company files must be stored only on approved company infrastructure.

Company data must not be stored on:

• personal cloud accounts,
• personal Google Drive accounts,
• Dropbox or other unauthorized services,
• personal computers,
• personal USB devices,
• personal email accounts.

File sharing must take place only with authorized users.

13. Remote Work

During remote work, the same security requirements that apply at QORECT premises must be followed.

Employees:

• must protect their equipment,
• must use approved connection methods,
• must not allow third parties to use company equipment,
• should avoid unsecured public Wi-Fi networks,
• must ensure that third parties cannot view confidential information on their screen.

14. Use of Cloud and External Services

Company information must not be stored or processed on unauthorized cloud services.

The use of any new SaaS, cloud or online service for company data must be approved before use.

15. Use of Artificial Intelligence – AI

Artificial intelligence tools must be used with particular care.

Without prior approval, the following must not be entered into public or unauthorized AI systems:

• personal data,
• passwords or API keys,
• confidential source code,
• credentials,
• contracts,
• financial information,
• customer information,
• databases,
• internal company documents,
• non-public technical information.

Employees remain responsible for checking the accuracy and suitability of any result generated by AI.

16. Secure Software Development

Employees involved in software development must follow QORECT's secure development procedures.

In particular, they must:

• not embed passwords or API keys in source code,
• use approved repositories,
• follow version control procedures,
• not transfer source code to personal repositories,
• perform the required tests before production deployment,
• follow the company's change management and deployment procedures.

17. Access Rights

Access to information systems is granted according to each employee's role and business needs.

Employees must not attempt to access:

• files,
• applications,
• servers,
• databases,
• administrative consoles,
• accounts

for which they do not have authorization.

The technical ability to access a system does not automatically constitute authorization to access it.

18. Source Code and Intellectual Property Protection

QORECT's source code, applications, systems, processes, technical specifications, designs, data and know-how constitute company assets.

Copying, transferring or using them outside the approved company environment without appropriate authorization is prohibited.

19. Physical Security and Visitors

Employees must contribute to the protection of company premises.

Unauthorized persons must not enter restricted-access areas.

Visitors must follow the company's access procedures and, where required, must be accompanied.

Any suspicious presence or behavior must be reported immediately.

20. Security Incident Reporting

Every employee is required to immediately report any actual or suspected security incident.

Examples include:

• loss of a laptop or mobile device,
• equipment theft,
• suspicious email,
• phishing,
• malware or ransomware,
• unauthorized access,
• email sent to the wrong recipient,
• data leakage,
• loss of files,
• password disclosure,
• suspicious system behavior,
• unauthorized modification of data.

Promptly reporting a mistake is more important than attempting to conceal it.

Employees must not attempt to investigate a serious incident on their own if doing so could affect evidence or other relevant information.

21. Personal Data Protection

Employees must handle personal data in accordance with:

• QORECT policies,
• the GDPR,
• applicable legislation,
• the instructions of Management and authorized personnel.

Only data that is necessary for the specific professional purpose may be collected and used.

22. Conflict of Interest

Employees must avoid situations in which personal interests may affect the objectivity of their professional decisions.

Any potential conflict of interest must be disclosed to Management.

23. Relationships with Customers and Partners

Employees represent QORECT with professionalism.

The following are prohibited:

• providing false or misleading information,
• making commitments beyond the employee's authority,
• disclosing information belonging to other customers,
• using privileged information for personal benefit.

24. Social Media and Public Statements

Personal use of social networks must not create a risk for QORECT.

The following must not be published without authorization:

• screenshots of company applications,
• project information,
• customer information,
• internal discussions,
• financial or commercial data,
• images revealing information from company offices or systems.

Only authorized persons may make official statements on behalf of QORECT.

25. Software Installation

Installation of software, browser extensions, utilities or other applications must be carried out only in accordance with company procedures.

Unauthorized or illegal software is prohibited.

26. Updates and Vulnerabilities

Employees must not unreasonably postpone security updates applied by the company.

Any known or suspected technical vulnerability must be reported to the appropriate responsible person.

Public disclosure of a technical vulnerability affecting a company system without authorization is prohibited.

27. Backup and Data Deletion

Employees must store company data in approved locations so that it is included in the designated backup mechanisms.

Permanent deletion of important company data may only be performed in accordance with established procedures.

28. Employee Departure

Upon termination of an employment or partnership relationship:

• all company equipment must be returned,
• documents and storage media must be returned,
• no copies of company data may be retained,
• access rights must be revoked,
• the obligation of confidentiality continues to apply.

29. Training and Awareness

All employees must participate in the information security training organized by QORECT.

Information security is everyone's responsibility and not solely the responsibility of the IT department or the ISMS Manager.

30. Non-Compliance

Violation of this Code or QORECT's security policies may, depending on the severity, result in:

• guidance and retraining,
• restriction or removal of access rights,
• corrective actions,
• disciplinary procedures in accordance with company policy and applicable legislation.

31. QORECT's 10 Golden Security Rules

1. Never share passwords.
2. Always lock your computer when you leave your workstation.
3. Never open suspicious links or attachments.
4. Never install software without approval.
5. Never transfer company data to personal services or devices.
6. Always check the recipient before sending an email.
7. Never disclose customer information to unauthorized persons.
8. Never enter confidential data into unauthorized AI tools.
9. Immediately report any suspicious incident.
10. If you are unsure about something, ask before taking action.