Security Policy for the Processing of Personal Data

Adopted and effective at OÜ «Excess Channel», registered in Tallinn, Estonia
Version dated 14 April 2026T

1. General Principles of Security

2. Organisational Security Measures (Organisational Level)

3. Technical Security Measures (Physical and Technical Level)

4. Ensuring Integrity and Availability

5. Vulnerability Management and Testing

6. Demonstration of Compliance (Accountability)

7. Processing of Personal Data by Employees

8. Review and Update of the Security Policy

This Security Policy for the Processing of Personal Data (hereinafter – the "Security Policy" ) has been developed in accordance with Article 32 of the EU General Data Protection Regulation (GDPR) , the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus) , and other applicable legal instruments. The Security Policy defines the technical and organisational measures implemented by OÜ «Excess Channel» (hereinafter – the "Company" , "Excess Channel" ) to ensure the protection of personal data during processing.