Operational documents

During the digital transformation, proper management of information technology and telecommunications (hereinafter – ITT) and a clear interface with the operational goals in the EPSO-G group is understood as one of the most important tools for increasing operational efficiency, decision-making speed, and quality.

To ensure this, an information technology and telecommunications management policy is applied within the EPSO-G group of companies. Its aim is to establish clear rules, principles, and priorities for systematically and consistently enhancing the management of information technology in the group’s companies. To ensure effective ITT operations and control, the EPSO-G group has an ITT management and oversight committee that coordinates operational directions and provides recommendations to the group’s companies.

ITT operational priorities:

• unification, integration, centralization;
• purposeful management of ITT operational costs and investments;
• digitization of processes;
• cybersecurity and ITT risk management;
• application of good ITT practices.

The purpose of the “EPSO-G” group companies’ information security policy is to establish the main information security objectives, management principles, and responsibilities of the group, ensuring the continuous suitability and compliance of the Information Security Management System with the Group’s strategic objectives, its effectiveness, and continuity according to operational, legal, regulatory, and contractual requirements.

It is designed to help the members of the management bodies and employees of the “EPSO-G” group companies to properly protect the information resources entrusted to them.

The policy provisions stipulate that the “EPSO-G” group implements measures for the protection of confidential information in accordance with the highest Information Security standards, taking into account the security needs of each group company.

The proper handling of personal data protection is one of the important elements in creating and maintaining the reputation of the “EPSO-G” group of companies as a reliable business partner and employer. Therefore, the “EPSO-G” group of companies applies a data protection policy that establishes the practice of careful handling of personal data.

The main principles of “EPSO-G” personal data protection:

• Fairness and legality. “EPSO-G” processes personal data with a defined legitimate purpose and in compliance with the General Data Protection Regulation and the requirements of the Law on Legal Protection of Personal Data of the Republic of Lithuania.
• Purpose limitation. “EPSO-G” collects personal data only for clearly defined purposes, with a clear legal basis, and does not process them in a manner incompatible with those purposes. Collected data may only be used for purposes other than those for which they were collected in cases and procedures provided by law or with the consent of the data subject.
• Transparency and clarity. “EPSO-G” informs data subjects about their personal data processing in a concise, transparent, understandable, and easily accessible form, in clear and simple language.
• Data minimization. “EPSO-G” processes personal data only to the extent necessary considering the established data processing purposes. Additional personal data may only be collected and used in cases and procedures provided by law or with the consent of the data subject.
• Storage limitation. “EPSO-G” retains personal data no longer than required by the purposes of personal data processing or provided by legal acts, if they establish a longer data retention period.
• Data accuracy. The personal data processed by “EPSO-G” must be accurate and, where necessary, updated, and inaccurate data must be corrected or deleted.
• Data security. “EPSO-G” implements technical and organizational measures to protect personal data from accidental or unlawful destruction, alteration, disclosure, as well as from any other unlawful processing. These measures must ensure a level of security appropriate to the nature of the personal data being processed and the risks posed by the processing.
• Accountability. “EPSO-G” ensures necessary measures to demonstrate compliance with the GDPR and the principles established in this policy.

If you have any questions about the purpose for which “EPSO-G” collects, processes, and stores your personal data, please contact us by email at . “EPSO-G” will respond to your inquiry no later than one month.

For more detailed information about personal data processing, please refer to the Privacy Notice.

On June 6, 2012, by the resolution No. 665 of the Government of the Republic of Lithuania, the procedure for the implementation of state property rights and non-property rights in state-owned enterprises (hereinafter – Ownership Guidelines) was approved, which states in point 77.2 that “the shareholders aim to ensure, where the number of votes allows, that the state-owned company: establishes the procedures for the sale of real estate owned by the state-owned company and the shares of its subsidiaries and publishes information about them on the website of the state-owned company.”

In accordance with the requirement set out in the Ownership Guidelines, the board of UAB “EPSO-G” approved the policy for the sale of shares of the UAB “EPSO-G” group, the main objective of which is to establish uniform principles for the sale of shares of subsidiaries and (or) lower-level subsidiaries (except for those whose shares are traded on the stock exchange).

The purpose of the EPSO-G Group Code of Ethics is to define the ethical standards and principles for the operations of the Group’s companies.

In order to ensure transparency and efficiency of operations, a centralized internal audit system operates within the “EPSO-G” group of companies. This means that the internal audit division performs assigned functions on a group-wide basis and is directly accountable to the “EPSO-G” board, which, taking into account the recommendations of the audit committee, appoints and dismisses the division head, approves job regulations, remuneration, budget, resources, and operational plan.

The mission of the “EPSO-G” internal audit is to create added value for all group companies and contribute to the achievement of their operational goals by systematically and comprehensively assessing and helping to improve the effectiveness of governance, risk management, and control processes. These functions are implemented through independent and objective assurance and consulting activities.

The division’s employees conduct internal audits and regularly monitor how recommendations are implemented, as well as how other deficiencies related to internal control identified by external auditors, regulators, and state control institutions are addressed.

The principles of “EPSO-G” internal audit activities:

• Independence. A condition that the internal audit division will perform its functions impartially, and independence is ensured through direct and unrestricted access to the group’s top management and the boards of “EPSO-G” and other group companies. The internal audit division has the right to access all information necessary to perform its functions. All requested information must be provided for assurance, consulting services, and other tasks that may be performed if necessary, even if not approved in the annual internal audit activity plan after significant changes in the organization, processes, legislation, or the identification of gross violations of established internal requirements, etc.
• Objectivity. This is a condition that internal auditors can guarantee the results of their work and will not compromise on the quality of their work. In conducting audits, the opinions of other individuals do not influence the internal auditors’ decisions, i.e., they are impartial, do not follow preconceived notions, and avoid any conflicts of interest, supporting their conclusions with established facts and evidence.
• Confidentiality. The employees of the internal audit division consider the content and value of the information obtained while performing tasks and respect the rights of its owner, therefore, they do not disclose such information without appropriate permission, unless required by law or professional necessity. When presenting audit and review reports to external parties, restrictions on the distribution and use of results are indicated.
• Competence. Internal auditors only perform tasks for which they have knowledge, skills, and experience. If the division lacks the necessary competencies for a task, consultants may be engaged.
• Accountability. Every quarter, the internal audit manager reports to the “EPSO-G” board and provides information to the audit committee about the implementation of the operational plan, the division’s observations on identified significant risks and control issues, as well as information about implemented and overdue internal audit recommendations. The “EPSO-G” manager and relevant top management related to the verified activities are informed about all internal audit reports.