ExactFlow p.s.a. Breach Notification Policy

Under GDPR Article 4(12), a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes three types:

Any person (staff, contractor, Client, sub-processor) aware of or suspecting a breach must immediately report to privacy@exactflow.com and security@exactflow.com. Include: what happened (as known); when discovered; what data may be involved; estimated number of individuals; systems affected. Preserve all evidence — do not delete logs or records.

CISO leads containment — isolate affected systems from the network

• Revoke compromised credentials and access tokens
• Preserve forensic evidence — take system snapshots before remediation; do not wipe affected systems
• Brief the DPO with initial assessment of data categories, record volumes, and individuals potentially affected

DPO leads risk assessment — determine data categories, sensitivity, volume, special category or children's data

• Assess risk to individuals using four factors: type of breach; nature and sensitivity of data; ease of identification; consequences for individuals
• Classify breach Level 1–4; determine whether UODO notification is required
• Document all findings in the Breach Notification Record

Where breach poses risk to individuals (Level 2, 3, or 4), DPO submits notification to UODO via https://uodo.gov.pl/p/zgloszenie-naruszenia. GDPR Article 33(3) requires:

• Nature of breach; categories and approximate number of data subjects and records concerned
• Name and contact details of the DPO
• Likely consequences of the breach
• Measures taken or proposed, including mitigation of adverse effects

Where all information is unavailable within 72 hours, submit what is available with a clear note that it is a partial notification — supplement within 7 days.

Late UODO notification — or failure to notify — is a material GDPR violation exposable to administrative fines under GDPR Article 83(4) of up to €10,000,000 or 2% of total annual worldwide turnover, whichever is higher.

Where breach is likely to result in HIGH risk (Level 3 or 4), ExactFlow notifies affected data subjects directly without undue delay under GDPR Article 34. Notification must be in plain language and include: nature of breach; DPO contact; likely consequences; measures taken; specific, practical advice for the individual (e.g. change passwords; monitor bank statements).

Remediate root cause; strengthen failed controls; retrain staff; update processes

• Post-incident review within 30 days — documented findings and action plan
• High and critical priority remediation actions implemented within 30 days
• Post-incident review findings reported to the Board

All breaches — notifiable or not — documented in the Breach Register (GDPR Article 33(5)). Entry must include: discovery and containment timestamps; breach type and severity; data categories and estimated records/individuals affected; root cause; UODO notification details; individual notification details; remediation actions; DPO sign-off confirming closure.

NIS2 Directive (EU) 2022/2555: where ExactFlow qualifies as Essential or Important Entity, significant ICT incidents must be reported to CSIRT NASK within 24 hours (early warning) and 72 hours (full notification). Classification assessment underway — Policy to be updated on determination.

Polish Cybersecurity Act (Dz.U. 2018 poz. 1560): ICT incidents affecting critical services reported to relevant CSIRT (CSIRT GOV, CSIRT NASK, or CSIRT MON) per Act requirements.

PCI-DSS v4.0: card data breaches reported to Visa and Mastercard and the acquirer within 24 hours of confirming card data involvement per card scheme rules.

Where ExactFlow acts as Data Processor on behalf of a Platform Client and discovers a breach affecting the Client's personal data, ExactFlow will: notify the Client within 24 hours; provide all information needed for the Client's own GDPR notification assessment; cooperate fully with the Client's investigation; implement containment and remediation as directed where not in conflict with ExactFlow's own obligations.

All sub-processors are contractually required to notify ExactFlow at privacy@exactflow.com and security@exactflow.com within 24 hours of becoming aware of any breach affecting ExactFlow personal data.

— END OF BREACH NOTIFICATION POLICY — EXACTFLOW P.S.A. —