CBS Systems d.o.o. · Policy

Information Security Policy

SRPS ISO/IEC 27001:2022 · Version 2.0 · Signed version: PDF (English) · PDF (Srpski)

Top management of CBS Systems d.o.o. (“CBS”) establishes this Information Security Policy and commits to protecting all information assets, its own and those entrusted to it by clients, against every form of threat, internal or external, accidental or deliberate. It does so through the establishment, implementation, monitoring, review, maintenance and continual improvement of an information security management system (ISMS) that meets the requirements of SRPS ISO/IEC 27001:2022.

CBS designs, builds, operates and supports enterprise analytics and AI software, including the SightPulse decision intelligence platform, which is commercialised by its subsidiary SightPulse AG (Zug, Switzerland). In this work CBS processes some of its clients’ most commercially sensitive information. Protecting the confidentiality, integrity and availability of that information is the foundation of this policy and of the trust clients place in CBS and SightPulse.

Scope

This policy applies to all CBS employees (permanent, temporary and freelance), contractors and other external parties with access to CBS or client information. It covers all processes, systems, locations and remote workplaces used for: the design, development, deployment, operation and support of the SightPulse platform and other CBS software solutions; data engineering, statistical modelling, data science and AI services; and the processing of market and consumer research data.

Information we protect

CBS acts as a processor or sub-processor of client data and processes it only on the client’s documented instructions. Client information in scope includes:

• Commercial and financial data: sell-in, sell-out, point-of-sale and basket, distributor, pricing, promotion, trade terms, cost and margin data;
• Customer, consumer and shopper data: CRM, loyalty, e-commerce and digital channel data, which may include personal data;
• Research and market data: respondent-level survey, panel and tracker data, and syndicated market data licensed by clients from third parties;
• Outlet, store, field execution and geographic data, and product, customer and organisational master data;
• Models, analyses, segments, forecasts and recommendations produced for clients, which remain client property.

CBS’s own information assets, including source code, models, methods, credentials, infrastructure and business records, are equally in scope.

How we protect information

• Client data stays in the client’s environment. SightPulse is deployed as an Azure Managed Application inside the client’s own Azure subscription and tenant, in the region the client selects. Client data is copied to CBS-controlled systems only on the client’s written instruction; it is then protected by the same controls and deleted when no longer needed.
• Least-privilege, accountable access. Access to client environments is limited to named, trained personnel, protected by multi-factor authentication, logged, and reviewed at defined intervals. Clients choose between standing operational access and just-in-time access that they approve per request.
• Segregation and purpose limitation. Each client’s data is kept separate and used only to deliver services to that client.

It is never used to train or improve models for other clients, and third-party AI providers are not permitted to train on it.

• Data minimisation. Personal data is processed only where a use case requires it. Pseudonymised identifiers are preferred and direct identifiers are avoided wherever possible.
• Encryption of data in transit and at rest, with controlled management of keys and secrets.
• Secure development lifecycle. Security requirements, peer code review, dependency and vulnerability scanning, separate development, test and production environments, and no client production data in development or test without the client’s approval.
• Trustworthy AI. Statistical and machine-learning models perform the analysis; language models orchestrate and explain. Every output is traceable to its source data and validated before release, and inferred results are flagged as such. Clients may use the language model endpoint their own security team has approved.
• Supplier security. Suppliers and subcontractors with access to information are assessed before engagement and bound by confidentiality, security and data protection obligations.
• Monitoring and incident response. Security events are logged and monitored. Incidents are reported, investigated, documented and used to improve. Clients are notified of incidents affecting their data without undue delay and within contractually agreed timeframes.
• Resilience. Backup, business continuity and disaster recovery arrangements are defined, maintained and tested.
• People. Background checks as permitted by law, confidentiality undertakings, security awareness training at onboarding and at regular intervals, and a disciplinary process for violations.
• Legal and contractual compliance with the Serbian Law on Personal Data Protection, the EU General Data Protection Regulation and the Swiss Federal Act on Data Protection where they apply, with client contracts and data processing agreements, and with the licence terms of third-party data providers.
• Return and deletion of client data at the end of a contract, with written confirmation on request.

Objectives

• protection of the confidentiality, integrity and availability of client data entrusted to CBS, in every environment where CBS processes it;
• no unauthorised access to client data, and timely detection, containment and notification of any security incident;
• compliance with legal, regulatory and contractual requirements in every jurisdiction where CBS and its clients operate;
• provision of reliable, accurate and traceable information and analytical outputs;
• availability of information and services to authorised users when they need them;
• continual improvement of the ISMS, informed by risk assessment, audits, incidents and client feedback.

Measurable objectives, owners and targets are set in the ISMS objectives register and reviewed at management review.

Responsibilities

Top management owns this policy, provides the resources for the ISMS and reviews its performance. The Information Security Manager coordinates the ISMS, risk assessment and incident management. Every employee, contractor and external party with access to CBS or client information is responsible for complying with this policy and the rules derived from it, within the scope of their role and contract. Non-compliance is handled under the disciplinary procedure of CBS Systems d.o.o. and the applicable contracts.

This policy is communicated to all employees and relevant external parties, is available to interested parties, including on sightpulse.ai, and is reviewed at least once a year and whenever significant changes occur.

Belgrade, 26 September 2026 · Version 2.0 · Supersedes the version of 28 April 2026 · Classification: Public
Milan Bjeloglav, Director, CBS Systems d.o.o.