Public Information Security and Privacy Policy Statement
ISMS and PIMS policy for external interested parties
1. Purpose
To make the policy of Keedian’s Information Security Management System (ISMS) and Privacy Information Management System (PIMS) available to external interested parties, in accordance with requirement 5.2 g) of ISO/IEC 27001:2022 and controls 6.2.1.1, A.7.3.2 and A.7.3.3 of ISO/IEC 27701:2019 as regards public information. It summarises PO-SYC-001 and PO-SYC-002, which prevail in the event of any discrepancy. Equivalence in ISO/IEC 27701:2025: requirement 5.2, controls A.1.3.2 and A.1.3.3.
2. Scope
The ISMS and PIMS scope is set in ALC-SYC-001, section 2 (verbatim, with unofficial translation):
«Gestión de la seguridad y privacidad de la información para la protección efectiva de los activos de información propios, actuando KEEDIAN, Inc. como Procesador y Controlador de información personal en ciertos contextos definidos, y asegurando que la información sea procesada y utilizada en los procesos de Operations, Finance, People, Product, Tecnología, Revenue y Workflow Management Solutions de acuerdo con la Declaración de Aplicabilidad. Todas las actividades de la organización se realizan de manera remota.»
“Management of information security and privacy for the effective protection of its own information assets, with KEEDIAN, Inc. acting as Processor and Controller of personal information in certain defined contexts, and ensuring that information is processed and used in the Operations, Finance, People, Product, Technology, Revenue and Workflow Management Solutions processes in accordance with the Statement of Applicability. All of the organisation’s activities are carried out remotely.”
Keedian acts as PII Controller when it determines the purposes and means of the processing, and as PII Processor when it processes data on behalf of its customers in the platforms and workflows it operates.
3. Top Management Commitments
Keedian’s Top Management undertakes, among others, the following obligations:
- To protect information assets in their entirety, ensuring their confidentiality, integrity and availability against a range of threats.
- To comply with the applicable information security and personal data protection requirements, including legal, regulatory and contractual requirements.
- To establish the ISMS and PIMS objectives, compatible with the strategic direction, and to provide the resources needed for their maintenance and continual improvement.
- To continually improve the ISMS and the PIMS and to carry out the Management Review at planned intervals.
Framework objectives: regulatory and legal compliance; risk management; continual improvement; a security and privacy culture; confidentiality, integrity and availability of information; and incident management. Their targets are approved in the management review.
4. Privacy Principles
Keedian is committed to protecting the privacy and personal data of its interested parties in accordance with the following principles:
- Lawfulness, legitimacy and transparency: all processing of personal data is based on valid legal grounds and on legitimate and clearly defined purposes, and data subjects are informed about it.
- Minimisation, purpose limitation and accuracy: personal data is adequate, relevant and limited to what is strictly necessary for the purposes of the processing, and is kept accurate and up to date.
- Privacy by design and by default: processes and systems protect personal data from their design and, by default, limit its processing to what is strictly necessary.
- Controlled sharing, transfer and disclosure: only when necessary, under the applicable laws and agreements that guarantee equivalent protection; these activities are recorded.
- Data subject rights: access, rectification, updating, erasure, objection, information on the use of their data and revocation of the authorisation.
- Accountability: Keedian demonstrates compliance with these principles through appropriate technical and organisational measures and records of processing activities.
- Processing on behalf of customers: as PII Processor, Keedian processes data in accordance with the purposes, instructions and limits agreed with the customer, and does not use it for its own purposes or for marketing.
5. Certification
Keedian, formerly Tutenlabs, holds NQA Certificate No. 804717 (ISO/IEC 27001:2022), issued on 7 March 2023 and reissued on 27 October 2025, and NQA Certificate No. 804867 (ISO/IEC 27701:2019, as an extension to ISO/IEC 27001), issued on 27 October 2025, both valid until 7 March 2029 and issued to TUTENLABS INC.
6. Contact
Enquiries and data subject rights requests: contacto@keedian.com, coordinated by the PIMS Manager / Data Protection Officer.
7. Publication and Communication
This statement shall be published on www.keedian.com, with a copy of the current certificates, and provided to anyone who requests it at contacto@keedian.com.
Copies of the current certificates will be published after the 2026 surveillance audit.
8. Approval
| Name | Position |
|---|---|
| Roi Amszynowski | CEO |
| Felipe Sánchez | Chief Operating Officer |
| José Miguel Concha | Head of Product and Engineering |
9. Validity and Review
This statement enters into force upon its formal approval by Top Management and is reviewed at least once a year, together with PO-SYC-001, or earlier in the event of a significant change in the organisation, its services or its legal framework.
The current version is the one recorded in LMD-SYC-001; any copy stored outside the official ISMS repository is considered an uncontrolled copy.