IMS Policy Statement

The Board and Management of Flutterwave, which operates in the Financial Technology sector, is committed to preserving the confidentiality, integrity, and availability of all physical and electronic information assets throughout the organisation, in order to preserve its assets, legal, and regulatory as well as contractual, compliance and image. The Integrated Management Systems (ISO 27001, ISO 27701, ISO 27017, ISO 27032, ISO 22301, ISO 20000) requirements will continue to be aligned with organisational goals and are also intended to be an enabling mechanism for information sharing, electronic operations, and reducing information & technology-related risks to acceptable levels.

Flutterwave is committed to providing quality services to our customers, both internal and external, by aligning Information Technology investments with organisational goals. Flutterwave has aligned its processes and operations with the ISO 27001, ISO 22301, ISO 27701, ISO 27032, ISO 27017, and ISO 20000 standards, as well as PCI-DSS requirements, to ensure business continuity, service management, cyber resilience, data privacy, protection of its information assets, and maximisation of benefits/returns on IT investments.

It is, therefore, Flutterwave’s policy to ensure:

1. Flutterwave’s current strategy and Integrated Management Systems (IMS) provides the context for identifying, assessing, evaluating, and controlling information/process/service-related risks through establishment and maintenance of the IMS. The risk assessment and risk treatment plan capture how identified risks are controlled in alignment with Flutterwave’s risk management strategy.
2. In particular, business continuity and contingency plans, data backup procedures, access control to systems and information security incident reporting are fundamental to this policy. All employees of Flutterwave shall have the responsibility of reporting incidents.
3. All employees of Flutterwave and external parties identified in the Management Systems are expected to comply with this policy. All staff and certain external parties will receive or be required to provide evidence of receiving appropriate training.
4. The IMS shall be subject to continuous and systematic review with improvements adopted, where necessary.
5. Management is committed to the continual improvement of the IMS in the Organizations.
6. Breach of the policy or security mechanism may warrant disciplinary measures, up to and including termination of employment/contract as well as legal action in line with the Cybercrime Prohibition Act 2015.