XML 23 R7.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management, Strategy and Governance
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Item 16K. Cybersecurity

 

Risk Management and Strategy.

We have implemented a comprehensive process to assess, identify, and manage material risks arising from cybersecurity threats, encompassing both the disruption of business operations and the security of financial reporting systems.

Our cybersecurity risk management practices entail the development, implementation, and continuous improvement of policies and procedures aimed at safeguarding information and ensuring the availability of critical data and systems.

The cybersecurity program is underpinned by advanced security technologies supported by a team of experienced and trained experts with deep knowledge of best practices in this field. This program is designed with controls aimed at identifying, protecting, detecting, responding to, and recovering from information and cybersecurity incidents.

 

As part of our continuous evolution in cybersecurity, we have integrated artificial intelligence (AI) and machine learning (ML) into our protection solutions, enhancing our ability to detect and respond to cyber threats in real time. Additionally, we have designed and are in the process of implementing a Zero Trust Network Access (ZTNA) architecture, reinforcing our approach to securing network access based on continuous verification.

Our Company has a comprehensive framework for cybersecurity and information security, structured into four domains: Governance, Surveillance, Resilience, and Protection. This framework includes risk assessment and mitigation through a threat intelligence-based approach, application controls, and enhanced security against ransomware. We rely on recognized standards such as the International Organization for Standardization (ISO) 27001:2022, which we have adopted as part of our cybersecurity strategy, initiating the path towards the certification of our cybersecurity incident response management process. Furthermore, we have successfully achieved PCI DSS v4.0 certification for card-present transactions (TPV use scope), ensuring compliance with the highest security standards in payment processing.

To protect and monitor our technological environment, we utilize a combination of policies, software, training programs, and hardware solutions. This includes firewalls, unified threat management, intrusion prevention and detection systems, vulnerability and penetration testing, identity management systems, privileged account management systems, anti-malware systems, and cybersecurity risk management systems, among others.

Cybersecurity risk management falls under the responsibility of the cybersecurity and information security team, supervised by our Director of Sustainability, Quality, Innovation, and Information Technology (IT). We conduct annual awareness training on information security for employees involved in our systems and processes handling customer data, as well as system audits and additional specialized training. Additionally, we publish monthly cybersecurity awareness bulletins and conduct theoretical exercises to simulate responses to cybersecurity incidents, using findings to continuously improve our practices, procedures, and technologies.

Our Incident Response Plan coordinates activities to prepare for, detect, respond to, and recover from cybersecurity incidents, including processes for classification, severity assessment, escalation, containment, investigation, and remediation, as well as compliance with applicable legal obligations and mitigating damage to brand and reputation.

Our cybersecurity team conducts periodic testing of our controls through vulnerability scanning, and attack simulations. Additionally, in connection with our cybersecurity risk management processes, our program includes reviews and assessments conducted by third-party external and independent parties to evaluate our internal incident response readiness and help identify areas for focus and continuous improvement.

Our cybersecurity risk management processes do not extend to the oversight and identification of threats associated with our use of third-party service providers, that assesses risks from vendors and suppliers.

Over the past three fiscal years, we have not experienced any material information security breaches, and expenses related to such incidents have not been material, including penalties and settlements. However, we cannot guarantee that we will not be materially affected by such risks or incidents in the future. See “Risk Factors” in Item 3 of this Annual Report on Form 20-F for more information on our cybersecurity related risks.

Governance.

Our Audit Committee, as a cornerstone of our corporate governance structure, is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, our Audit Committee receives comprehensive quarterly reports on cybersecurity and information security. These reports, prepared by the Manager of Cybersecurity and Information Security and presented by our Director of Sustainability, Quality, Innovation, and Information Technology, provide a complete overview of the Companys digital security condition. The reports include a detailed assessment of various critical aspects of cybersecurity. This ranges from detected threats to an analysis of cybersecurity governance processes, evaluations of the status of ongoing projects to strengthen internal security, and reviews of prevention and mitigation efforts, along with an assessment of the results obtained from security breach simulations, such as penetration tests and incident response exercises.

In addition to the quarterly reports, additional updates are provided to the Audit Committee as needed, in response to significant events, regulatory changes, or cyber emergencies. This practice ensures continuous and adaptive surveillance against constantly evolving digital threats.

Furthermore, a thorough evaluation of the Company’s performance in each phase of the cybersecurity lifecycle is provided to the Director of Sustainability, Quality, Innovation, and Information Technology by the Manager of cybersecurity and Information Security. From proactive preparation and prevention to early detection, agile response, and effective recovery, each aspect is meticulously analyzed. This not only enables a clear understanding of current strengths and weaknesses in cybersecurity but also informs strategic and tactical decisions to continuously improve our cybersecurity posture.

Our Board of Directors retains responsibility for overseeing our overall risk management systems and processes, and the Audit Committee provides quarterly reports to the full Board of Directors on cybersecurity risk. As a result, the members of the Board of Directors stay apprised of all relevant updates, as well as of the rapidly evolving cyber threat landscape, and provide guidance to management as appropriate to address the effectiveness of our overall data privacy and cybersecurity program.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] we have integrated artificial intelligence (AI) and machine learning (ML) into our protection solutions, enhancing our ability to detect and respond to cyber threats in real time.Our Company has a comprehensive framework for cybersecurity and information security, structured into four domains: Governance, Surveillance, Resilience, and Protection. This framework includes risk assessment and mitigation through a threat intelligence-based approach, application controls, and enhanced security against ransomware.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance.

Our Audit Committee, as a cornerstone of our corporate governance structure, is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, our Audit Committee receives comprehensive quarterly reports on cybersecurity and information security. These reports, prepared by the Manager of Cybersecurity and Information Security and presented by our Director of Sustainability, Quality, Innovation, and Information Technology, provide a complete overview of the Companys digital security condition. The reports include a detailed assessment of various critical aspects of cybersecurity. This ranges from detected threats to an analysis of cybersecurity governance processes, evaluations of the status of ongoing projects to strengthen internal security, and reviews of prevention and mitigation efforts, along with an assessment of the results obtained from security breach simulations, such as penetration tests and incident response exercises.

In addition to the quarterly reports, additional updates are provided to the Audit Committee as needed, in response to significant events, regulatory changes, or cyber emergencies. This practice ensures continuous and adaptive surveillance against constantly evolving digital threats.

Furthermore, a thorough evaluation of the Company’s performance in each phase of the cybersecurity lifecycle is provided to the Director of Sustainability, Quality, Innovation, and Information Technology by the Manager of cybersecurity and Information Security. From proactive preparation and prevention to early detection, agile response, and effective recovery, each aspect is meticulously analyzed. This not only enables a clear understanding of current strengths and weaknesses in cybersecurity but also informs strategic and tactical decisions to continuously improve our cybersecurity posture.

Our Board of Directors retains responsibility for overseeing our overall risk management systems and processes, and the Audit Committee provides quarterly reports to the full Board of Directors on cybersecurity risk. As a result, the members of the Board of Directors stay apprised of all relevant updates, as well as of the rapidly evolving cyber threat landscape, and provide guidance to management as appropriate to address the effectiveness of our overall data privacy and cybersecurity program.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

Our Audit Committee, as a cornerstone of our corporate governance structure, is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, our Audit Committee receives comprehensive quarterly reports on cybersecurity and information security. These reports, prepared by the Manager of Cybersecurity and Information Security and presented by our Director of Sustainability, Quality, Innovation, and Information Technology, provide a complete overview of the Companys digital security condition. The reports include a detailed assessment of various critical aspects of cybersecurity. This ranges from detected threats to an analysis of cybersecurity governance processes, evaluations of the status of ongoing projects to strengthen internal security, and reviews of prevention and mitigation efforts, along with an assessment of the results obtained from security breach simulations, such as penetration tests and incident response exercises.

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

Our Board of Directors retains responsibility for overseeing our overall risk management systems and processes, and the Audit Committee provides quarterly reports to the full Board of Directors on cybersecurity risk. As a result, the members of the Board of Directors stay apprised of all relevant updates, as well as of the rapidly evolving cyber threat landscape, and provide guidance to management as appropriate to address the effectiveness of our overall data privacy and cybersecurity program.

Cybersecurity Risk Role of Management [Text Block]

Cybersecurity risk management falls under the responsibility of the cybersecurity and information security team, supervised by our Director of Sustainability, Quality, Innovation, and Information Technology (IT). We conduct annual awareness training on information security for employees involved in our systems and processes handling customer data, as well as system audits and additional specialized training. Additionally, we publish monthly cybersecurity awareness bulletins and conduct theoretical exercises to simulate responses to cybersecurity incidents, using findings to continuously improve our practices, procedures, and technologies.

Our Incident Response Plan coordinates activities to prepare for, detect, respond to, and recover from cybersecurity incidents, including processes for classification, severity assessment, escalation, containment, investigation, and remediation, as well as compliance with applicable legal obligations and mitigating damage to brand and reputation.

Our cybersecurity team conducts periodic testing of our controls through vulnerability scanning, and attack simulations. Additionally, in connection with our cybersecurity risk management processes, our program includes reviews and assessments conducted by third-party external and independent parties to evaluate our internal incident response readiness and help identify areas for focus and continuous improvement.

Our cybersecurity risk management processes do not extend to the oversight and identification of threats associated with our use of third-party service providers, that assesses risks from vendors and suppliers.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] our Audit Committee receives comprehensive quarterly reports on cybersecurity and information security. These reports, prepared by the Manager of Cybersecurity and Information Security and presented by our Director of Sustainability, Quality, Innovation, and Information Technology, provide a complete overview of the Companys digital security condition. The reports include a detailed assessment of various critical aspects of cybersecurity. This ranges from detected threats to an analysis of cybersecurity governance processes, evaluations of the status of ongoing projects to strengthen internal security, and reviews of prevention and mitigation efforts, along with an assessment of the results obtained from security breach simulations, such as penetration tests and incident response exercises.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

Our Incident Response Plan coordinates activities to prepare for, detect, respond to, and recover from cybersecurity incidents, including processes for classification, severity assessment, escalation, containment, investigation, and remediation, as well as compliance with applicable legal obligations and mitigating damage to brand and reputation.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Cybersecurity risk management falls under the responsibility of the cybersecurity and information security team, supervised by our Director of Sustainability, Quality, Innovation, and Information Technology (IT). We conduct annual awareness training on information security for employees involved in our systems and processes handling customer data, as well as system audits and additional specialized training. Additionally, we publish monthly cybersecurity awareness bulletins and conduct theoretical exercises to simulate responses to cybersecurity incidents, using findings to continuously improve our practices, procedures, and technologies.

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true