Ethical Business Conduct Policy

To deliver voice consultancy services, project and operational support on routing solutions, call analytics, and user experience design for our clients, Sound of Data operates in a complex regulatory, contractual, and commercial environment. This requires that our business activities are conducted lawfully, responsibly, and in a manner that safeguards the integrity of our services and prevents misconduct, misuse, or harm to customers, end users, and other stakeholders.

We are committed to complying with applicable laws and regulations and to preventing bribery, corruption, fraud, conflicts of interest, and other forms of unethical or unlawful behavior. We take guidance from internationally recognized standards for ethical and compliance management, such as ISO 37001, which we use as a reference framework and source of best practices, without claiming certification.

We continuously challenge ourselves to strengthen ethical awareness, accountability, and compliance within our organization. Everyone at Sound of Data is expected to act in accordance with this policy and the principles established under our integrated management system.

Teamwork, engagement, ownership, and support from everyone in the organization are critical to achieving our ethical business objectives. We are committed to providing the necessary leadership and resources to enable Sound of Data to review, maintain, and communicate ethical business practices as part of our integrated management system.

We are committed to achieving high standards in the way we design, deliver, and operate our services and organizational processes. To this end, we have implemented an integrated management system that brings together our key governance domains. This system applies to the entire organization and supports consistent, controlled, and responsible management of our activities. Where applicable, our integrated management system is aligned with internationally recognized standards and is subject to independent assessment.

• We conduct our business with integrity and fairness at all times and do not accept, offer, promise, request, or authorize any form of bribery or corruption.

• We take appropriate measures to prevent fraud, misuse of company assets, and other forms of unethical or unlawful behavior.

• We avoid conflicts of interest and expect employees to act in the best interest of Sound of Data and its stakeholders.

• We comply with applicable economic and trade sanctions and do not engage in business relationships that would violate such restrictions.

• We encourage employees and relevant stakeholders to speak up and report suspected misconduct without fear of retaliation.

• We expect our suppliers and business partners to conduct their activities in a manner consistent with our ethical standards and applicable laws.

As a provider of voice and communication services, Sound of Data acknowledges its responsibility to prevent the misuse of its services for illegal, fraudulent, or harmful calling activities, including unlawful robocalls.

Sound of Data maintains a Robocall Mitigation Plan (RMP) in accordance with applicable legal and regulatory requirements. Where required, this plan is filed with relevant authorities and maintained in line with regulatory expectations. As part of our ethical and responsible business conduct, the effectiveness of this plan is periodically reviewed and supported through our ISO 9001–certified quality management system.

Before establishing services for new customers, Sound of Data applies proportionate due diligence measures. These measures may include verifying business identity, legal establishment, authorized contact persons, and the nature of the customer’s activities. This approach supports responsible use of our services and helps reduce the risk of misuse, including illegal robocalling.

During service delivery, Sound of Data applies appropriate technical and operational controls to mitigate robocall risks. These controls may include caller identification management, blocking of unauthorized or unknown traffic sources, and destination-based access restrictions where required. Access to specific destinations, such as the United States, may be subject to additional contractual and technical requirements, including adherence to frameworks such as STIR/SHAKEN.

Traffic relevant to regulatory risk areas is monitored on a continuous basis using automated monitoring and call detail analysis. Suspicious patterns or anomalies are investigated and escalated in accordance with internal procedures.

Sound of Data cooperates with authorized investigative and regulatory bodies and participates in traceback and investigation processes where applicable. The CTO/COO is designated as the single point of contact for handling such requests and coordinating responses in accordance with applicable laws, contractual obligations, and regulatory frameworks.