Business Management System Policy · Key Marketing Services T/A kpm Group – ISP01 – 07/09/2025 – Version: 13.1 – Classification: Public · Dated: September 2026. Published here with the wording unchanged from the controlled document supplied by KPM.

The Company is committed to maintaining and continually improving its Business Management System (BMS), which provides a framework for managing information security, quality management, environmental management, regulatory compliance, and business effectiveness in support of its core business as a provider of Direct Mail services.

The Company maintains certification to ISO 27001 for Information Security Management and continues to operate its quality and environmental management systems in accordance with ISO 9001 and ISO 14001 principles and requirements.

The Company has adopted a risk based approach to management relative to the areas identified above so that:

• The needs of clients and the requirements of corporate governance are met.
• Business processes are effective, controlled, and capable of consistently achieving intended results.
• Information is protected against unauthorised access, disclosure, alteration, or loss.
• Partnership arrangements involving sharing and exchange of information are legal and secure.
• Confidence is maintained that products and services provided by third-party suppliers are secure, adequate, and fit for purpose.
• Environmental impacts are identified, managed, and minimised wherever practicable.

The requirements of the Business Management System will be reviewed and maintained in alignment with the Company’s strategic direction, business objectives, applicable legal and regulatory requirements, and the requirements of the management standards adopted by the organisation.

Control objectives for information security are contained in the BMS Manual (6.2) and are supported as appropriate by specific, documented policies and procedures. It is the Policy of KPM to ensure that:

• The contents of this Policy and the BMS Manual are communicated and understood throughout the organisation.
• Regulatory and legislative requirements relevant to the BMS will be met.
• Information security risks are identified, assessed, and managed appropriately.
• Customer requirements and expectations are understood and addressed through effective quality management practices.
• Environmental responsibilities are considered in decision-making, and opportunities to reduce waste, improve resource efficiency, and prevent pollution are actively promoted.
• The BMS is continually improved to enhance effectiveness and support business objectives.

Business Management Objectives are established and reviewed during the Annual Management Review Meeting to assess their status, effectiveness, as well as their appropriateness to the needs of the business.

All employees, contractors, and other relevant parties granted access to Company information or systems are expected to comply with this policy and other applicable BMS policies and procedures. Appropriate training and awareness will be provided according to their roles and responsibilities.

This document is available upon request to all interested parties.

Marian Lively
Managing Director