Environmental, Social & Governance (ESG) Policy

Effective date: 17 September 2026

This policy sets out how Zealogics and its affiliated companies (“Zealogics”, “we”, “us”) manage the environmental, social and governance effects of how we work. It applies to every Zealogics company, to everyone who works for us — employees, contractors and professionals we place with clients — and, through section 8, to the suppliers and partners we work with.

1. Where it applies

Zealogics operates in ten countries: the United States, Canada and Mexico; the United Kingdom; Belgium, the Netherlands and Germany in the European Union; the United Arab Emirates; India; and Taiwan. The commitments in sections 3 to 5 apply in all of them. Section 6 sets out the laws each commitment answers to in each region. Where local law sets a higher standard than this policy, we meet the local standard; where this policy sets the higher standard, we meet this policy.

2. How it is governed

• Ownership. Executive leadership owns this policy and approves changes to it. Each country’s leadership is responsible for meeting it, and the local law behind it, in that country.
• Integration. ESG obligations are managed through the systems we already operate and are audited on: our ISO/IEC 27001 certified information security management system, our CMMI Level 3 appraised delivery process and our AI governance practice.
• Review. The policy is reviewed at least once a year, and whenever a law it relies on changes or we begin operating in a new country.
• Reporting. Zealogics does not currently publish an audited ESG report. Our Sustainability page describes what we do in practice and what has been independently verified. Clients that need supplier ESG information for their own reporting or due diligence can request it from us.

3. Environmental

We are a technology and professional services company. Our environmental footprint comes mainly from our offices, business travel, the electronic equipment our people use, and the cloud and data-centre computing that the systems we build run on. We commit to:

• Measure what matters. Track the main sources of our footprint — office energy, business travel and computing — and use what we learn to reduce them.
• Travel less. Deliver through local and nearshore teams and remote collaboration, and travel when the work genuinely needs a person on site.
• Compute efficiently. Right-size infrastructure and AI workloads: use the smallest model and the least compute that meets the agreed quality, and switch off environments that are no longer needed. Where a client’s data-residency policy leaves the choice open, we prefer cloud regions and providers that power their operations with renewable energy.
• Handle equipment responsibly. Extend the working life of laptops and devices, and dispose of them through recyclers authorised under local law, after data has been securely erased under our information security controls.
• Use shared and efficient workplaces. Prefer shared, serviced and energy-efficient office space over dedicated buildings, and reduce waste and single-use materials in our offices.
• Comply. Meet the environmental and climate laws of every country we operate in, including the reporting obligations set out in section 6 where they apply to us.

4. Social

Our people

• Equal opportunity. We hire, pay, promote and develop people on merit. We do not discriminate on the basis of race, colour, religion or belief, sex, gender identity, sexual orientation, pregnancy, marital status, national or ethnic origin, age, disability or any other characteristic protected by local law.
• Freely chosen work. We do not use forced, bonded, trafficked or child labour, and we do not hold anyone’s identity documents. People we recruit or place are not charged fees for being hired.
• Fair pay and working time. We pay at least the legal minimum and in line with the market, pay on time, and keep to legal limits on working hours, rest and leave.
• A safe and respectful workplace. We provide safe and healthy working conditions, including attention to mental wellbeing, and we do not tolerate harassment, sexual harassment, bullying or victimisation. Every country has a way to raise a complaint and have it investigated.
• Voice. We respect people’s right to join or not to join lawful associations and to bargain collectively where the law provides for it.
• Development. We keep teams together across engagements rather than releasing them at the end of one, and invest in their skills. Our workplace practices are certified by the Great Place to Work® Institute.
• Accessibility. We make reasonable adjustments for candidates and employees with disabilities, including in our AI-assisted interview process.

Clients, users and communities

• Data and privacy. We protect the personal and confidential data we are trusted with, as our Privacy Policy and Security page describe.
• Responsible AI. The AI systems we build keep people accountable, are evaluated before release and are auditable, as our Responsible AI page describes.
• Local value. We hire in the countries we deliver from and build long-term local teams, so that the value of our work stays in the economies we operate in.

5. Governance

• Anti-bribery and corruption. We do not offer, pay, request or accept bribes or facilitation payments, directly or through anyone acting for us. Gifts and hospitality must be modest, infrequent and never intended to influence a decision.
• Conflicts of interest. People declare any interest that could affect, or appear to affect, their judgement on our behalf.
• Sanctions and export controls. We screen the parties we work with and control the export of technology, software and technical data, including in our semiconductor equipment engineering work.
• Financial integrity. We keep accurate books and records, pay the taxes due in every country we operate in, and do not facilitate money laundering or tax evasion.
• Fair competition. We compete on the merits and comply with competition and anti-trust law.
• Information security. Our information security management system is certified to ISO/IEC 27001, and the same controls apply on every programme, in every country.
• Speaking up. Anyone can raise a concern about a breach of this policy without fear of retaliation, as section 9 describes.

6. Regional commitments

The commitments above apply everywhere. In each region they answer to the laws below, among others. Where a law applies only to companies above a size or revenue threshold, we meet it when we are in scope, and help clients that are in scope with the information they need from us as a supplier.

United States

• Employment and equal opportunity: Title VII of the Civil Rights Act of 1964, the Americans with Disabilities Act, the Age Discrimination in Employment Act, the Equal Pay Act and the Fair Labor Standards Act, together with state law where our offices are — including the New Jersey Law Against Discrimination and the California Fair Employment and Housing Act.
• Health and safety: the Occupational Safety and Health Act.
• Governance: the Foreign Corrupt Practices Act, OFAC sanctions and the Export Administration Regulations.
• Privacy: the California Consumer Privacy Act and other applicable state privacy laws.
• Climate disclosure: state climate-disclosure laws, such as California’s, apply to companies above their revenue thresholds. We track whether they apply to us, and provide emissions and supplier information to clients that report under them.

Canada and Mexico

• Canada: the Ontario Human Rights Code, Employment Standards Act, 2000, Occupational Health and Safety Act and Accessibility for Ontarians with Disabilities Act; the Corruption of Foreign Public Officials Act; the Personal Information Protection and Electronic Documents Act; and the Fighting Against Forced Labour and Child Labour in Supply Chains Act, where its reporting thresholds apply.
• Mexico: the Federal Labour Law, including its rules on subcontracting of specialised services; NOM-035-STPS-2018 on psychosocial risk factors at work; the General Law of Administrative Responsibilities on corruption; and Mexico’s federal law on the protection of personal data held by private parties.

European Union — Belgium, the Netherlands and Germany

• Data and AI: the General Data Protection Regulation and the EU Artificial Intelligence Act.
• Sustainability reporting and due diligence: the Corporate Sustainability Reporting Directive and the Corporate Sustainability Due Diligence Directive apply to companies above their thresholds. We respond to reasonable value-chain information requests from clients that report or carry out due diligence under them, and under Germany’s Supply Chain Due Diligence Act (LkSG).
• Equality and pay: EU and national equal-treatment law — including Germany’s General Equal Treatment Act (AGG) — and the national laws implementing the EU Pay Transparency Directive.
• Health, safety and wellbeing: Belgium’s Act on Wellbeing of Workers, including its rules on psychosocial risks and harassment; the Dutch Working Conditions Act (Arbowet); and Germany’s Occupational Safety and Health Act (ArbSchG).
• Whistleblowing: the EU Whistleblower Protection Directive and the national laws implementing it, including access to external reporting channels run by national authorities.

United Kingdom

• The Equality Act 2010; the Health and Safety at Work etc. Act 1974; the Bribery Act 2010, including the offence of failing to prevent bribery; the UK GDPR and Data Protection Act 2018; and the Modern Slavery Act 2015, including a published slavery and human trafficking statement where the turnover threshold applies.

United Arab Emirates

• Employment: Federal Decree-Law No. 33 of 2021 on the Regulation of Labour Relations and its implementing regulations, including their rules on equal treatment, wage protection and working hours, and the UAE’s Emiratisation requirements where they apply to us.
• Data: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
• Climate: Federal Decree-Law No. 11 of 2024 on the Reduction of Climate Change Effects, including its requirements to measure and report greenhouse gas emissions where they apply to us, in support of the UAE’s Net Zero 2050 strategic initiative.
• Governance: the anti-bribery provisions of the UAE Crimes and Penalties Law, and UAE anti-money laundering and sanctions law.
• Local value: Zealogics is certified under the UAE In-Country Value (ICV) programme, which measures our contribution to the UAE economy.

India

• Employment: the Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020, and the Shops and Establishments Acts of the states where our offices are.
• Prevention of sexual harassment: the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, including an Internal Committee to receive and resolve complaints.
• Equality: the Rights of Persons with Disabilities Act, 2016.
• Governance and data: the Prevention of Corruption Act, 1988, and the Digital Personal Data Protection Act, 2023 and its rules.
• Corporate social responsibility and reporting: section 135 of the Companies Act, 2013 where its thresholds apply to us, and the supplier information that listed clients need for their Business Responsibility and Sustainability Reports (BRSR) under SEBI rules.

Taiwan

• Employment: the Labor Standards Act, the Gender Equality in Employment Act, the Employment Service Act’s prohibition of discrimination, and the Sexual Harassment Prevention Act.
• Health and safety: the Occupational Safety and Health Act.
• Data: the Personal Data Protection Act.
• Climate: the Climate Change Response Act and its regulations. Many of our Taiwan clients are in the semiconductor supply chain and report on sustainability under Financial Supervisory Commission rules for listed companies; we provide the supplier information those disclosures and their supplier codes of conduct require.

7. Human rights

We respect internationally recognised human rights, as set out in the Universal Declaration of Human Rights and the International Labour Organization’s Declaration on Fundamental Principles and Rights at Work, and we are guided by the UN Guiding Principles on Business and Human Rights in identifying and addressing human-rights risks connected to our work.

8. Suppliers and partners

We expect our suppliers, subcontractors and partners to meet standards equivalent to this policy — in particular on labour and human rights, health and safety, anti-corruption and data protection. We take these risks into account when selecting suppliers, in proportion to what they do for us, and we may end a relationship with a supplier that does not meet them.

9. Raising a concern

If you believe Zealogics, or anyone acting for us, has breached this policy or the law behind it, email info@zealogics.com with “ESG concern” in the subject line. You may raise a concern anonymously. Every concern is reviewed, investigated where warranted, and handled as confidentially as the investigation allows. We do not tolerate retaliation against anyone who raises a concern in good faith. Employees can also use the internal and statutory channels available in their country, such as the Internal Committee in India or the external reporting channels available in the European Union.

10. Changes to this policy

We will update this policy when our practices or the law change, and revise the effective date above. Questions about it can be sent to info@zealogics.com.