Corporate Compliance & Governance Policy

This Policy establishes the governance and compliance framework of OMIYO LTD (“OMIYO”, “the Company”, “we”, “us” or “our”).

OMIYO is a business transformation, technology, AI and advisory company providing services including business transformation, strategy, operations, change, AI and automation, technology development, digital products, software, websites, applications, MVPs and related advisory services.

The purpose of this Policy is to ensure that OMIYO operates responsibly, professionally, securely and in accordance with applicable legal, regulatory, contractual and ethical obligations.

OMIYO LTD is the legal entity responsible for the Company's activities, contracts, services, personnel, intellectual property and obligations.

OMIYO may operate products, services, platforms and brands under its ownership.

Where a product or brand is operated by OMIYO, the underlying legal responsibility remains with OMIYO LTD unless expressly stated otherwise in a valid contract or legal document.

RESORO is a brand/product operated by OMIYO LTD and may maintain additional product-specific terms, privacy information and policies appropriate to its activities.

OMIYO is committed to:

1. 1. acting lawfully and ethically;
2. 2. protecting confidential information;
3. 3. protecting personal data;
4. 4. maintaining appropriate information security;
5. 5. delivering services professionally and competently;
6. 6. managing third-party and supplier risks;
7. 7. protecting intellectual property;
8. 8. using AI responsibly;
9. 9. maintaining accurate business records;
10. 10. identifying and managing operational and security risks;
11. 11. responding appropriately to incidents;
12. 12. respecting equality, dignity and professional conduct;
13. 13. preventing bribery, corruption and improper influence; and
14. 14. continuously improving its governance and controls.

The Director has overall responsibility for OMIYO's compliance framework.

Responsibilities may be delegated to employees, contractors or specialist advisers where appropriate. Delegation does not remove the Director's responsibility for ensuring that appropriate governance arrangements exist.

Employees and contractors are responsible for complying with the policies and procedures applicable to their work.

OMIYO operates a proportionate, risk-based compliance framework.

The level of controls applied to a project will reflect factors including:

• the nature of the service;
• client requirements;
• sensitivity of information;
• personal data involved;
• use of AI;
• access to client systems;
• use of subcontractors;
• geographic location;
• regulatory requirements; and
• potential impact of failure.

Higher-risk projects may require additional contractual, security, privacy or technical controls.

OMIYO will identify and comply with legal and regulatory requirements applicable to its activities.

Relevant areas may include:

• UK company law;
• UK data protection legislation;
• privacy and electronic communications requirements;
• intellectual property law;
• employment and contractor requirements;
• anti-bribery legislation;
• equality and anti-discrimination requirements;
• contractual obligations;
• applicable international requirements; and
• sector-specific requirements where applicable.

Where specialist legal advice is required, OMIYO may obtain advice from appropriately qualified professionals.

OMIYO will maintain appropriate records demonstrating compliance, including where applicable:

• contracts;
• Statements of Work;
• NDAs;
• DPAs;
• supplier records;
• security records;
• incident records;
• training records;
• access records;
• risk assessments;
• privacy records;
• data-processing records; and
• policy approvals and reviews.

Policies will be reviewed:

• at least annually;
• following a significant incident;
• following material changes to the Company's services;
• following significant technology changes;
• following material changes in law or regulation; or
• where otherwise considered necessary.

Superseded versions should be retained where appropriate for governance and audit purposes.

Actual or suspected breaches of OMIYO policies should be reported promptly to the Director or designated responsible person.

OMIYO will assess the issue, take proportionate corrective action and maintain appropriate records.

Where legally or contractually required, OMIYO will notify relevant clients, regulators or other affected parties.

OMIYO will not knowingly represent that it holds a certification, accreditation, security control or compliance status that it does not hold.

Statements concerning compliance, security or certification will accurately distinguish between:

• implemented controls;
• planned controls;
• internal targets; and
• externally certified standards.

This Policy should be read together with OMIYO's:

• Privacy Notice;
• Cookie Notice;
• Website Terms;
• Information Security Policy;
• Data Protection Policy;
• AI & Responsible Technology Policy;
• Supplier & Subprocessor Policy;
• Business Continuity Policy;
• Master Services Agreement;
• Data Processing Agreement; and
• other applicable policies and contractual documents.