Supplier Code of Conduct

01. Introduction & Corporate Identity

This Supplier Code of Conduct ("Code") sets out the ethical, legal, and operational standards that KHODSHIMA SUMN ASSIST LTD ("Company", "we", "us", or "our") requires of all suppliers, vendors, contractors, and business partners ("Suppliers") who provide goods, services, or infrastructure to the Company. The Company is a private limited company incorporated in England and Wales under company registration number 17435961, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

This Code is issued in accordance with the Modern Slavery Act 2015, the UK Bribery Act 2010, the UK Data Protection Act 2018, the UK GDPR, and internationally recognised standards including the UN Guiding Principles on Business and Human Rights and the ILO Declaration on Fundamental Principles and Rights at Work.

02. Scope & Application

This Code applies to all Suppliers who provide any of the following to the Company:

• Cloud & Hosting Infrastructure: Server hosting, DNS, CDN, and network infrastructure providers;
• Payment Processing Services: Stripe Payments Europe Ltd / Stripe Payments UK and Airwallex (UK) Limited;
• Software & SaaS Platforms: Development tools, CI/CD platforms, monitoring services, and security tooling;
• Open-Source Projects: Maintainers and communities of security frameworks (CIS, Lynis, OWASP) referenced in our deliverables;
• Professional Services: Legal, accounting, audit, and administrative service providers;
• Subcontractors: Any subcontractor engaged by a Supplier in the provision of services to the Company.

Suppliers are responsible for ensuring that their own suppliers and subcontractors comply with the principles set out in this Code. The Company reserves the right to request evidence of compliance at any time.

03. Labour Standards & Human Rights

Suppliers must uphold fundamental human rights and labour standards in accordance with the ILO Declaration on Fundamental Principles and Rights at Work and the Modern Slavery Act 2015:

• Prohibition of Forced Labour: Suppliers must not use forced, bonded, indentured, or compulsory labour. All work must be voluntary, and workers must be free to leave employment after reasonable notice;
• Prohibition of Child Labour: Suppliers must not employ any person below the legal minimum age of employment in the relevant jurisdiction. In no circumstances shall any person under 15 be employed;
• Freedom of Association: Workers must be free to join or form trade unions and to bargain collectively without fear of discrimination, retaliation, or intimidation;
• Non-Discrimination: Suppliers must not discriminate in hiring, compensation, training, promotion, or termination on the basis of race, colour, gender, sexual orientation, gender identity, religion, political opinion, nationality, age, disability, marital status, or any other protected characteristic;
• Fair Wages: Suppliers must pay at least the legal minimum wage in the relevant jurisdiction and provide all legally mandated benefits;
• Working Hours: Suppliers must comply with applicable working time laws and ILO standards. Workers must not be required to work more than 48 hours per week on a regular basis, and must receive at least one day off per week;
• Safe Working Conditions: Suppliers must provide a safe and hygienic working environment, adequate safety training, and appropriate personal protective equipment where required.

04. Anti-Corruption & Bribery

Suppliers must comply with the UK Bribery Act 2010 and all applicable anti-corruption laws in the jurisdictions in which they operate. Specifically:

• No Bribery: Suppliers must not offer, promise, give, accept, or authorise any bribe, kickback, or improper payment to or from any person, whether in the public or private sector;
• No Facilitation Payments: Suppliers must not make facilitation payments to expedite or secure the performance of a routine government action;
• Gifts & Hospitality: Any gifts or hospitality offered to the Company's personnel must be modest, proportionate, and transparent, and must not create a conflict of interest or the appearance of impropriety;
• Conflicts of Interest: Suppliers must disclose any actual or potential conflicts of interest with the Company or its personnel;
• Books & Records: Suppliers must maintain accurate books and records that reflect the true nature of all transactions and must not establish off-book accounts or falsify records;
• Whistleblowing: Suppliers must provide a confidential mechanism for workers to report concerns about corruption or unethical behaviour without fear of retaliation.

05. Data Protection & Information Security

Suppliers who process personal data on behalf of the Company, or who have access to Company systems or client data, must comply with:

• UK GDPR & Data Protection Act 2018: Suppliers must process personal data lawfully, fairly, and transparently, in accordance with the principles set out in UK GDPR Article 5;
• EU GDPR: Where applicable, Suppliers must also comply with EU GDPR requirements;
• Data Processing Agreements: Suppliers acting as processors must sign a written data processing agreement with the Company incorporating the required terms under UK GDPR Article 28;
• Security Measures: Suppliers must implement appropriate technical and organisational security measures, including encryption, access controls, audit logging, and incident response procedures;
• Breach Notification: Suppliers must notify the Company of any personal data breach without undue delay and within 24 hours of becoming aware of the breach;
• Confidentiality: Suppliers must maintain the confidentiality of all Company and client information and must not disclose it to any third party without written authorisation;
• PCI-DSS: Payment service providers (Stripe, Airwallex) must maintain PCI-DSS Level 1 certification and provide annual attestations of compliance.

06. Sanctions & Trade Compliance

Suppliers must comply with all applicable international trade and sanctions laws, including:

• UK OFSI & HM Treasury: Suppliers must not be listed on, or conduct business with entities listed on, the OFSI Consolidated List of Financial Sanctions Targets;
• UN, EU & US OFAC: Suppliers must not be designated on any UN, EU, or US OFAC sanctions list;
• Sanctioned Jurisdictions: Suppliers must not be located in, or provide services from, sanctioned jurisdictions including the Russian Federation, Belarus, Iran, North Korea, Syria, Cuba, and occupied territories of Ukraine;
• Export Controls: Suppliers must comply with all applicable export control regulations, including the UK Export Control Order 2008 and the US Export Administration Regulations where relevant;
• Prohibited Activities: Suppliers must not provide services to the Company that involve financial services, cryptocurrency, gambling, adult content, or any FCA-regulated activity, consistent with our Terms & Conditions.

07. Environmental Responsibility

While the Company's digital-only business model has a minimal environmental footprint, Suppliers are expected to:

• Comply with Environmental Laws: Suppliers must comply with all applicable environmental laws and regulations in their operating jurisdictions;
• Energy Efficiency: Cloud and hosting providers should demonstrate commitment to energy-efficient infrastructure and, where possible, use renewable energy sources;
• Waste Reduction: Suppliers should minimise waste generation and implement recycling programmes where practicable;
• Carbon Footprint: Suppliers are encouraged to measure, report, and reduce their carbon footprint. The Company gives preference to suppliers with demonstrated environmental commitments;
• Sustainable Sourcing: Where physical goods are procured (e.g., office equipment), Suppliers should source from environmentally responsible manufacturers.

08. Compliance Monitoring & Enforcement

The Company monitors Supplier compliance through the following mechanisms:

1. Pre-Engagement Assessment: Before onboarding a new Supplier, the Company conducts a basic due diligence assessment covering sanctions screening, reputation, financial stability, and compliance posture;
2. Contractual Obligations: This Code, or its substantive requirements, is incorporated into Supplier contracts. Suppliers acknowledge that compliance is a material condition of the business relationship;
3. Audits & Assessments: The Company reserves the right to request evidence of compliance, including policies, certifications, audit reports, and attestations. For critical Suppliers (e.g., payment providers), annual attestations are required;
4. Self-Certification: Suppliers must annually self-certify their compliance with this Code or promptly notify the Company of any areas of non-compliance;
5. Non-Compliance Consequences: If a Supplier is found to be in breach of this Code, the Company may: (a) require a corrective action plan within a specified timeframe; (b) suspend the business relationship pending remediation; or (c) terminate the relationship immediately for serious violations, including modern slavery, bribery, sanctions evasion, or data protection breaches;
6. Reporting: Suppliers must report any actual or suspected violation of this Code to info@khodshimasumnassistltd.com without undue delay.

09. Policy Amendments & Related Documents

The Company may update this Code to reflect changes in legal requirements, industry standards, or business practices. Suppliers will be notified of material amendments. This Code should be read in conjunction with:

• Compliance & Standards Overview — comprehensive compliance framework;
• KYC & AML Policy — customer due diligence and sanctions screening;
• Modern Slavery Act Statement — Section 54 MSA 2015 statement;
• Privacy Policy — data protection and UK GDPR compliance;
• Terms & Conditions — prohibited activities and contractual obligations.