1.  Purpose

This policy details what is expected of all Staff of EXPEND LIMITED (the “Company”) with regard to information security.

EXPEND LIMITED’s Staff play a significant role in the information security goals the Company seeks to achieve. Effective information security is a team effort involving the participation and support of all Staff who interact with the Company’s data. Therefore, all Staff are responsible for maintaining, understanding and complying with the information security policies. This policy outlines the significance of information security and the disciplinary action that the Company may take if Staff do not comply with the respective information security policies.

2.  Scope

The procedures and principles set out herein must be followed at all times by the Company and all its employees, agents, contractors, consultants, temporary staff, casual or agency staff, or other suppliers or data processors (hereafter referred to as“Staff”) working for or on behalf of the Company.

3.  Staff Responsibilities

Staff are required to read and attest to all the Company’s Information Security policies applicable to them.

Upon hire Staff will be provided with details of all the policies that the Company has determined are relevant to their role and are expected to read and attest to each of those policies.

Policies are reviewed by the Company periodically to ensure they remain relevant and fit for purpose. In order for Staff to maintain an understanding of the policies they are required to review and re-attested each policy on a periodic basis.

All staff have an obligation to help protect the:

• confidentiality of information, which means only authorised people have the right to access certain information;

• integrity of information, which means that only authorised people can change the information, and

• availability of information, which means information must be accessible to the authorised people whenever it is needed.

As conveyed throughout the Company’s Information Security policies, successful protection of the Company’s assets requires Staff to work as a team and follow the processes and procedures outlined. Underpinning the policies are key activities that Staff must follow:

• Report suspicious activity - Examples of suspicious activity may include, but are not limited to, an email request from an unidentified party to initiate a wire transfer, a slow or lagging computer when prompted to open a file or document, an account password was changed without your knowledge, inability to access a Company account, hostile employee behaviour, etc.

• Adhere to the policies - The policies are there to protect the Company, it’s Staff and our stakeholders. Where there are legitimate reasons to depart from the procedures outlined within a policy, request approval as detailed in the policy, if in doubt ask your manager.

• If you are unsure ask - Ask questions about Information Security policies or procedures if you are unsure how they should be applied. All policies include details of who to contact if you have any questions.

• Report Company policy violations - Do not be afraid to report violations or suspected violations of Company policies to your immediate manager or, if more comfortable, to a member of the senior management team. The Company will take all reasonable steps to ensure that no person under their control victimises the whistleblowing individual. Violations can be reported anonymously if preferred.

4.  Company Responsibilities

At the Company’s discretion, the Information Security policies will be amended. This is likely to be a result of a change to:

• the law

• regulation

• industry best practice

• the nature of EXPEND LIMITED’s business

Any material changes made to Company policies will be communicated to the relevant Staff. Staff will be asked to read and attest to the updated policy.

5.  Failure to Comply

If the Company determines that a member of Staff has violated a Company Information Security policy or policies, disciplinary action may be taken, including, but not limited to, termination. The Company reserves the sole and absolute right to determine the appropriate disciplinary action. This does not impact Staff’s right to appeal. The Company will treat appeals fairly, consistently, and in a timely fashion.