v202505.1

Responsible Disclosure Policy

We consider the security of our systems a top priority. However, despite our efforts to maintain a high level of security, vulnerabilities may still be present.

If you discover a vulnerability or information security incident, we would like to hear about it so that we can take appropriate action as quickly as possible. We ask for your help in better protecting our systems and our customers.

Please do the following:

• Report security vulnerabilities to: responsibledisclosure@office-dtc.com
• Report (suspected) information security incidents to: incidenten@office-dtc.com
• Do not exploit the vulnerability or issue you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability, or by modifying or deleting other people’s data;
• Do not share the problem with others until it has been resolved;
• Do not perform attacks on physical security, social engineering, distributed denial of service, spam, or third-party applications; and
• Provide sufficient information to reproduce or analyze the issue, so we can resolve it as quickly as possible. Typically, the IP address or URL of the affected system and a description of the vulnerability or incident are sufficient, but more detailed explanation may be required for complex cases.

What we promise:

• We will respond to your report within 3 working days with our evaluation and an expected resolution date;
• If you have followed the instructions above, we will not take legal action against you regarding the report;
• We will treat your report as strictly confidential and will not share your personal information with third parties without your permission;
• We will keep you informed of the progress in resolving the issue;
• We will acknowledge your name as the discoverer of the issue in public communications (unless you prefer otherwise); and
• As a token of appreciation, we offer a reward for every security issue that was previously unknown to us. The amount of the reward depends on the severity of the issue and the quality of the report. The minimum reward is a gift voucher of €50.

We aim to resolve all issues and incidents as quickly as possible and are happy to play an active role in the eventual publication of the resolved issue.