top of page
Transparent Logo.png

Information security policy

1. Purpose and Scope

GuestWorld’s Information Security Policy establishes the principles, responsibilities and commitments for protecting the organisation’s information assets within the scope of the Information Security Management System (ISMS), implemented in accordance with ISO/IEC 27001.

This Policy applies to all employees, regardless of their contractual relationship, as well as to partners, suppliers, service providers and any other entities that, directly or indirectly, have access to GuestWorld’s information or systems.

Its main objective is to safeguard trust, legal compliance and business continuity.

​

2. Pillars

Information Security at GuestWorld is based on a process management approach aimed at ensuring the three essential pillars:

  • Confidentiality, ensuring that information is accessed only by duly authorised individuals;

  • Integrity, ensuring that information remains accurate, complete and protected against unauthorised changes;

  • Availability, ensuring that information and systems are accessible to authorised individuals whenever required, in a secure and continuous manner.

​

3. Objectives

  • Risk Reduction: Reduce the organisation’s exposure to risks, threats and vulnerabilities related to information security;

  • Legal and Regulatory Compliance: Ensure compliance with applicable legislation, regulations, contractual requirements and internal policies, including the General Data Protection Regulation (GDPR);

  • Awareness and Training: Promote an information security culture among employees through awareness initiatives, continuous training and the sharing of best practices;

  • Access Control: Ensure that access to the organisation’s information and assets is granted only to authorised individuals, according to their respective roles and responsibilities;

  • Backup and Recovery: Ensure the maintenance of the necessary information in the cloud environments of suppliers and partners in order to preserve the integrity and availability of business-critical information;

  • Incident Management: Ensure the identification, communication, recording, handling and analysis of information security incidents, promoting the implementation of corrective and preventive actions.

 

GuestWorld is committed to continuously reviewing and improving its Information Security Management System (ISMS), ensuring its alignment with the organisation’s objectives, evolving risks, legal and regulatory changes, business needs and technological developments. The IT Department is responsible for implementing and maintaining technical information security controls and proposing the necessary measures to ensure the effectiveness of the ISMS.

 

For the purposes of compliance with the General Data Protection Regulation (GDPR), as well as with the requirements of the Corruption and Related Offences Risk Prevention Plan (PPR) and the General Regime for the Prevention of Corruption (RGPC), the RSI and CICO functions are currently performed by the IT Department.

 

However, in the event of organisational growth or changes to the legal framework, GuestWorld may formally establish a CISO function, ensuring more robust and specialised information security management.

 

4. Information Classification

All information produced, received, processed or stored by GuestWorld must be classified according to its level of sensitivity and the impact that its disclosure, alteration, loss or unavailability may have on the organisation, its clients or other interested parties:

  • Public: Information whose disclosure does not pose a risk to the organisation and may be made available without restrictions;

  • Restricted: Information intended exclusively for internal use within the organisation, the unauthorised disclosure of which may have a limited impact;

  • Confidential: Information accessible only to expressly authorised individuals, the unauthorised disclosure of which may have a significant impact on the organisation;

  • Critical: Information whose disclosure, alteration, loss or unavailability may seriously compromise the organisation’s activities, compliance with legal or contractual obligations, or the interests of its clients.

 

Approval from the CEOs is required according to the nature and criticality of the document produced, ensuring that no relevant document is created or made available without their knowledge.

 

5. Access and Resource Control

GuestWorld ensures that access to information systems, applications, equipment and other assets is granted only to duly authorised employees, suppliers or partners. Access rights are assigned, reviewed, modified and removed in a controlled manner, ensuring that each user has only the permissions strictly necessary to perform their duties (SGSI.MAT.02 Access Matrix).

 

Physical access to the premises is controlled, and visitors, suppliers or service providers are only permitted entry with prior authorisation and supervision, whenever applicable.

 

Whenever external entities have access to GuestWorld’s information or assets, appropriate protection measures are implemented, including, where applicable, confidentiality agreements and the definition of specific information security requirements.

 

Caneças, 21 July 2026

 

Management

​​​

bottom of page