Supplier Security Policy
OBJECTIVE
At Gunship Group, we are committed to conducting business ethically, securely, responsibly, and sustainably. This Supplier Security & Responsibility Policy defines the minimum standards expected from all suppliers globally.
All suppliers must comply with this policy as a condition of doing business with Gunship Group.
SCOPE
This policy applies to:
- All direct and indirect suppliers
- Contractors and subcontractors
- Technology vendors
- Service providers
- Logistics and operational partners
- Global partners operating in any jurisdiction
Suppliers are responsible for ensuring that their employees, agents, and subcontractors comply with this policy.
COMPLIANCE & RESPONSIBLE OPERATIONS
Suppliers must operate in full compliance with applicable international, national, and local laws.
• Legal Compliance
Suppliers are expected to operate with the highest standards of legal and regulatory compliance. Accordingly, all suppliers must:
- Comply with Applicable Laws:
Fully comply with all applicable local, national, and international laws, rules, and regulations in the countries where they operate, including but not limited to labour, environmental, tax, anti-corruption, data protection, and corporate governance laws. - Adhere to Export & Trade Regulations:
Strictly follow all export control laws, trade sanctions, customs regulations, and international trade compliance requirements applicable to their products, services, and business transactions. - Maintain Valid Authorizations:
Obtain and maintain all necessary licenses, registrations, permits, certifications, and approvals required to conduct business legally and ensure they remain valid throughout the engagement period. - Regulatory Cooperation:
Cooperate fully and transparently with regulatory authorities during inspections, audits, investigations, or inquiries, and promptly address any identified compliance gaps. - Immediate Notification of Non-Compliance:
Promptly inform the organization of any actual or suspected violations of applicable laws or regulations that may impact business operations or contractual obligations. - Accurate Documentation & Record Keeping:
Maintain accurate, complete, and up-to-date records as required by law and make such records available for review when legally permitted.
• Ethical Business Conduct
Suppliers are expected to uphold the highest standards of integrity, transparency, and ethical behaviour in all business dealings. Suppliers must:
- Prohibit Bribery and Corruption:
Strictly prohibit all forms of bribery, corruption, facilitation payments, kickbacks, or improper advantages, whether direct or indirect, in dealings with public officials or private entities. - Avoid Conflicts of Interest:
Disclose any actual, potential, or perceived conflicts of interest that could improperly influence business decisions. Suppliers must implement internal controls to manage and mitigate such conflicts. - Maintain Accurate Financial Records: Keep complete, accurate, and transparent financial records in accordance with applicable accounting standards and legal requirements. Records must not be falsified, misrepresented, or concealed.
- Ensure Transparent Invoicing and Contractual Practices:
Provide clear, detailed, and truthful invoices, contracts, and supporting documentation. All commercial terms must be formally agreed upon and documented. - Comply with Anti-Money Laundering (AML) Laws:
Adhere to all applicable anti-money laundering and counter-terrorism financing regulations. Suppliers must conduct appropriate due diligence to prevent involvement in illicit financial activities. - Support Audits and Investigations:
Cooperate fully with reasonable audit requests, compliance reviews, and investigations conducted by regulatory authorities or authorized representatives. - Protect Confidential Information:
Safeguard confidential, proprietary, and personal information obtained during the course of business and use it solely for legitimate purposes.
• Fair Labor Practices
Suppliers shall uphold internationally recognized human rights standards and comply with all applicable labor laws and regulations in the countries where they operate. Suppliers are required to adhere to the following principles:
- Prohibition of Child Labour:
Suppliers shall strictly prohibit the use of child labour. Employment shall comply with the minimum working age requirements under applicable local laws and international standards. Suppliers must implement appropriate age-verification processes. - Prohibition of Forced Labour:
Suppliers shall not engage in or support any form of forced, bonded, indentured, trafficked, or involuntary labour. Employees must work voluntarily and be free to leave employment upon reasonable notice, in accordance with applicable law. - Fair Wages and Benefits:
Suppliers shall provide wages, overtime compensation, and benefits that meet or exceed applicable legal requirements, including minimum wage laws. Compensation shall be paid in a timely manner and clearly documented. - Safe and Healthy Working Conditions:
Suppliers shall provide a safe, hygienic, and healthy work environment in compliance with applicable occupational health and safety regulations. Appropriate measures shall be taken to prevent workplace injuries, accidents, and health hazards. - Freedom of Association and Collective Bargaining:
Suppliers shall respect employees’ rights to freedom of association and the right to collective bargaining, in accordance with applicable laws. Employees shall not face retaliation, intimidation, or harassment for exercising these rights. - Non-Discrimination and Anti-Harassment
Suppliers shall promote a workplace free from discrimination and harassment. Employment decisions shall be based on merit and qualifications without regard to race, colour, gender, religion, nationality, age, disability, or any other protected characteristic under applicable law.
DATA SECURITY & CONFIDENTIALITY
Suppliers shall implement robust security measures to protect Gunship Group information assets and ensure the confidentiality, integrity, and availability of data. Suppliers must comply with all applicable data protection and cybersecurity laws and regulations in the jurisdictions where they operate.
- Protection of Confidential Information:
Suppliers shall safeguard all confidential, proprietary, and sensitive information belonging to Gunship Group, including but not limited to business data, intellectual property, customer information, and technical documentation. Such information shall be used solely for authorized business purposes and not disclosed without prior written consent. - Cybersecurity Controls:
Suppliers shall implement and maintain industry-standard cybersecurity controls, including appropriate administrative, technical, and physical safeguards. These controls shall include access management, encryption, network security measures, endpoint protection, vulnerability management, and regular security assessments. - Secure Data Handling:
Suppliers shall ensure secure collection, storage, processing, transmission, and disposal of data. Data must be protected against unauthorized access, alteration, disclosure, loss, or destruction through appropriate security technologies and processes. - Security Incident Reporting:
Suppliers must notify Gunship Group of any actual or suspected data breach, cybersecurity incident, or unauthorized access affecting Gunship Group’s data within 24 hours of discovery. Suppliers shall cooperate fully in investigation, mitigation, remediation, and regulatory reporting obligations. - Compliance with Data Protection Laws
Suppliers shall comply with all applicable data protection and privacy laws, including, where applicable, the General Data Protection Regulation (GDPR) and other relevant regional or national data protection regulations. Suppliers must implement appropriate data protection policies and procedures to ensure lawful processing of personal data. - Third-Party Risk Management
Suppliers shall ensure that any subcontractors or third parties engaged in processing Gunship Group’s data are subject to equivalent data protection and security obligations.
ENVIRONMENTAL ACCOUNTABILITY
Gunship Group expects its suppliers to operate in an environmentally responsible manner and to actively minimize the environmental impact of their operations, products, and services. Suppliers shall comply with all applicable environmental laws and adopt sustainable business practices.
• Environmental Compliance
Suppliers shall conduct their operations in full complianc with applicable environmental laws and demonstrate proactive environmental stewardship. Suppliers must:
- Legal and Regulatory Compliance:
Comply with all applicable environmental laws, regulations, and statutory requirements in the jurisdictions in which they operate, including those relating to air emissions, wastewater discharge, waste management, and hazardous substances. - Permits and Authorizations:
Obtain, maintain, and keep current all necessary environmental permits, licenses, approvals, and registrations required for their operations. Suppliers shall ensure compliance with all permit conditions and regulatory obligations. - Environmental Monitoring and Controls:
Establish and implement appropriate processes to monitor, measure, control, and reduce environmental impacts, including emissions, effluents, waste generation, and energy consumption. Where required, suppliers shall conduct periodic environmental assessments and risk evaluations. - Documentation and Record Keeping:
Maintain accurate, complete, and up-to-date environmental records, reports, and compliance documentation. Such records shall be retained in accordance with legal requirements and made available to Gunship Group or relevant authorities upon reasonable request.
• Resource Management
Suppliers are encouraged to adopt sustainable resource management practices and continuously improve environmental performance. Suppliers should:
- Energy Efficiency:
Implement energy efficiency initiatives to reduce overall energy consumption, including the adoption of energy-efficient equipment, optimized operational processes, and energy monitoring systems. - Water Stewardship:
Optimize water usage by implementing conservation practices, recycling or reusing water where feasible, and minimizing water waste across operations. - Greenhouse Gas (GHG) Reduction:
Take measurable and documented steps to reduce greenhouse gas emissions, including improving operational efficiency, transitioning to lower carbon technologies, and tracking emissions performance indicators where possible. - Waste Management:
Establish and maintain effective waste segregation, recycling, recovery, and responsible disposal programs to minimize landfill contribution and environmental impact. - Sustainable Sourcing:
Promote responsible procurement practices by prioritizing sustainable, recyclable, reusable, or environmentally friendly materials and services where commercially and operationally feasible.
• Hazardous Materials Management
Suppliers shall ensure the responsible management of hazardous materials to protect human health, workplace safety, and the environment. Suppliers must:
- Safe Handling and Disposal:
Safely handle, store, transport, treat, and dispose of hazardous substances in accordance with all applicable local, national, and international laws and recognized safety and environmental standards. - Regulatory and International Compliance:
Comply with relevant chemical safety, transportation, and environmental regulations, including internationally recognized standards governing hazardous materials management. - Documentation and Labelling:
Maintain accurate labelling, inventory controls, and up-to-date Safety Data Sheets (SDS) for all hazardous materials. Documentation must be readily accessible to employees and regulatory authorities as required. - Training and Awareness:
Provide regular training to employees on safe material handling, storage protocols, spill prevention, and emergency response procedures. Training records must be maintained and periodically reviewed. - Emergency Preparedness:
Establish and maintain emergency response plans for chemical spills, leaks, exposure incidents, and other hazardous events, including clear reporting and containment procedures.
GOVERNANCE & COMPLIANCE
Gunship Group expects its suppliers to maintain strong governance frameworks, effective risk management systems, and full compliance with applicable laws and contractual obligations.
• Corporate Governance
Suppliers must establish and maintain sound corporate governance practices to ensure ethical and compliant operations. Suppliers must:
- Internal Controls:
Maintain appropriate internal control systems to prevent fraud, misconduct, and regulatory violations. - Compliance Programs:
Develop, implement, and maintain documented compliance policies and procedures covering legal, regulatory, ethical, and contractual obligations. - Compliance Leadership:
Appoint designated compliance officers or responsible personnel, where applicable, to oversee regulatory adherence and policy implementation. - Internal Audits:
Conduct periodic internal audits or compliance reviews to assess adherence to applicable laws, contractual obligations, and internal policies.
• Risk Management
Suppliers shall implement structured risk management practices to identify, assess, and mitigate risks that may impact service delivery or compliance. Suppliers shall:
- Identify and evaluate operational, cybersecurity, financial, legal, and regulatory risks.
- Maintain documented Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) appropriate to the nature of their services.
- Test continuity and recovery plans periodically to ensure effectiveness.
- Ensure resilience within critical supply chains and maintain contingency measures to address disruptions.
• Audit Rights
To ensure compliance with contractual and regulatory obligations, Gunship Group reserves the right to:
- Conduct audits, assessments, or inspections of supplier facilities, systems, and processes upon reasonable notice.
- Request access to relevant compliance documentation, certifications, and records.
- Conduct information security or data protection assessments where applicable.
- Require corrective action plans in case of identified deficiencies.
- Suspend or terminate agreements in the event of material non-compliance or failure to remediate identified issues within agreed timelines.
• Reporting Violations
Suppliers must promote a culture of transparency and accountability. Suppliers shall:
- Promptly report any known or suspected violations of this policy or applicable laws that may impact Gunship Group.
- Establish and maintain confidential reporting mechanisms, including whistleblower protection procedures.
- Protect individuals who report concerns in good faith from retaliation.
- Cooperate fully and in good faith with investigations, audits, or regulatory inquiries.
SUSTAINABILITY INITIATIVES
Gunship Group encourages suppliers to adopt sustainable and socially responsible business practices and to align with globally recognized sustainability standards. Suppliers are expected to continuously improve their environmental, social, and governance (ESG) performance.
• Sustainable Sourcing
Suppliers should promote responsible procurement and ethical supply chain practices. Suppliers are encouraged to:
- Responsible Material Sourcing: Source raw materials and components from responsible and ethical suppliers, ensuring compliance with applicable environmental and human rights standards.
- Conflict Minerals Compliance:
Avoid the use of conflict minerals and conduct appropriate due diligence to ensure that materials are not sourced from regions associated with human rights abuses or unlawful armed activities. - Supply Chain Transparency:
Promote transparency across their supply chains by maintaining traceability mechanisms and engaging in supplier due diligence programs. - Supplier Code Alignment:
Encourage their own suppliers and subcontractors to adopt standards consistent with this Code of Conduct.
• Social Responsibility
Suppliers are encouraged to contribute positively to society and the communities in which they operate. Suppliers should:
- Community Investment:
Support and invest in local community development initiatives, social welfare programs, or charitable activities where feasible. - Diversity, Equity, and Inclusion (DEI):
Promote diversity, equity, and inclusion within their workforce, ensuring equal opportunity employment practices. - Workforce Development:
Support employee training, skill development, and education initiatives to foster long-term workforce sustainability.
• ESG Commitment
Suppliers are encouraged to institutionalize sustainability within their governance structures. Suppliers should:
- ESG Frameworks:
Establish and maintain Environmental, Social, and Governance (ESG) frameworks aligned with internationally recognized standards where applicable. - Transparency and Reporting:
Publish sustainability, ESG, or Corporate Social Responsibility (CSR) reports, where appropriate, to demonstrate transparency and accountability. - Performance Measurement:
Define, monitor, and track measurable sustainability Key Performance Indicators (KPIs), including environmental impact, social engagement, and governance effectiveness.
INFORMATION SECURITY REQUIREMENTS (MANDATORY FOR TECHNOLOGY VENDORS)
Technology vendors engaged by Gunship Group must implement robust information security controls to protect data, systems, and services. Compliance with these requirements is mandatory for vendors that process, store, transmit, or have access to Gunship Group’s information assets.
Technology vendors must:
• Information Security Framework
Technology vendors shall establish and maintain a structured and risk-based Information Security Management System (ISMS) to protect the confidentiality, integrity, and availability of information assets.
Vendors must:
- ISMS Implementation:
Implement, maintain, and continuously improve an Information Security Management System (ISMS) aligned with ISO/IEC 27001 standards or an equivalent internationally recognized security framework. The ISMS shall be proportionate to the nature, scope, and complexity of the services provided to Gunship Group. - Risk-Based Approach:
Conduct periodic information security risk assessments to identify, evaluate, and mitigate risks affecting systems, applications, infrastructure, and data associated with Gunship Group. - Documented Policies and Procedures:
Maintain formally documented and approved information security policies, standards, procedures, and guidelines covering access control, data protection, incident response, asset management, and business continuity. - Governance and Oversight:
Establish defined roles and responsibilities for information security governance, including senior management oversight and accountability mechanisms. - Continuous Monitoring and Improvement:
Perform regular internal reviews, audits, and management assessments to ensure the effectiveness of the ISMS and implement corrective actions where necessary.
• Access Control & Authentication
Technology vendors shall implement robust access management controls to ensure that access to systems, applications, and data is authorized, appropriate, and securely managed. Vendors must:
- Least Privilege & Role-Based Access:
Enforce strict access control mechanisms based on the principle of least privilege and role-based access control (RBAC). Access rights shall be granted strictly on a need-to-know and job- responsibility basis. - Multi-Factor Authentication (MFA):
Implement Multi-Factor Authentication (MFA) for all privileged, administrative, and remote access accounts. MFA should also be applied to systems processing sensitive or confidential data. - Access Provisioning & Deprovisioning:
Establish formal procedures for user access provisioning, modification, and deprovisioning. Access must be promptly revoked upon employee termination, contract completion, or role change. - Periodic Access Reviews:
Conduct periodic (at least quarterly or risk-based) user access reviews to validate appropriateness of assigned permissions and remove unnecessary or excessive privileges. - Privileged Account Management:
Monitor and log privileged account activities and implement additional safeguards for high-risk accounts, including segregation of duties where feasible. - Authentication Security:
Enforce strong password policies, secure credential storage, and protection against unauthorized credential sharing.
• Data Encryption
Technology vendors shall implement strong encryption controls to safeguard sensitive and confidential information.
Vendors must:
- Encryption at Rest and in Transit:
Encrypt sensitive and confidential data both at rest and in transit using industry-accepted encryption standards, protocols, and algorithms. - Secure Transmission:
Ensure secure communication channels for data exchange, including encrypted network protocols and protected APIs. - Key Management:
Protect cryptographic keys through secure key management practices, including controlled access, secure storage, periodic rotation, and segregation of duties. - Data Classification:
Apply encryption controls based on data classification and sensitivity levels.
• Vulnerability Management
Vendors shall implement a structured vulnerability management program to proactively identify and remediate security weaknesses.
Vendors must:
- Establish a formal vulnerability management process, including regular vulnerability scanning of infrastructure, applications, and network environments.
- Maintain a documented patch management program with defined timelines for remediation based on risk severity.
- Track identified vulnerabilities through to resolution using remediation tracking mechanisms.
- Perform periodic security configuration reviews to ensure compliance with secure baseline standards.
• Penetration Testing
Vendors must validate the effectiveness of security controls through regular testing. Vendors shall:
- Conduct independent penetration testing and security assessments at least annually, or following significant system, infrastructure, or application changes.
- Ensure testing covers externally exposed systems and critical internal systems handling sensitive data.
- Document findings, risk ratings, and remediation actions.
- Address identified vulnerabilities through formal corrective action plans within defined timelines.
• Security Incident Notification
Timely reporting of security incidents is mandatory. Vendors must:
- Notify Gunship Group of any actual or suspected security breach, cybersecurity incident, or unauthorized access affecting Gunship Group’s systems or data within 24 hours of discovery.
- Submit a documented root cause analysis (RCA) and remediation report following incident resolution.
- Cooperate fully in containment, investigation, mitigation, and regulatory reporting obligations.
BUSINESS CONTINUITY & BACKUP
Vendors shall implement robust resilience measures to ensure uninterrupted service delivery and protection of Gunship Group’s data and systems. Vendors must:
- Secure Backup Management:
Maintain secure, encrypted, and regularly tested backup procedures for all critical systems and data associated with Gunship Group. Backup data shall be protected against unauthorized access, alteration, or loss. - Documented Continuity Plans:
Develop, implement, and maintain documented Business Continuity Plans (BCP) and Disaster Recovery (DR) Plans appropriate to the nature, scope, and criticality of the services provided. - Regular Testing and Validation:
Periodically test backup restoration processes and disaster recovery capabilities to validate effectiveness. Test results, identified gaps, and corrective actions shall be documented and retained. - Defined Recovery Objectives:
Clearly define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical systems and ensure alignment with contractual, regulatory, and operational requirements. - Continuous Improvement:
Review and update BCP and DR plans periodically, particularly following major system changes, incidents, or significant organizational updates.
SUBCONTRACTING
Suppliers shall not delegate or subcontract any obligations related to services provided to Gunship Group without prior authorization and appropriate oversight. Suppliers must:
- Prior Written Approval:
Obtain prior written approval from Gunship Group before engaging any subcontractor to perform services or process data related to Gunship Group. - Flow-Down Obligations:
Ensure that subcontractors are contractually bound to comply with the requirements of this Policy and any applicable contractual, security, confidentiality, and regulatory obligations. - Due Diligence:
Conduct appropriate due diligence prior to onboarding subcontractors, including assessment of their compliance, security posture, and operational capability. - Ongoing Oversight:
Monitor subcontractor performance and compliance on an ongoing basis to ensure adherence to agreed standards. - Full Accountability:
Remain fully responsible and liable for the acts, omissions, compliance failures, and performance of subcontractors as if they were the Supplier’s own actions.
NON-COMPLIANCE & ENFORCEMENT
Compliance with this Policy is a material requirement of doing business with Gunship Group. Failure to adhere to the requirements set forth herein may result in corrective and/or legal action, depending on the severity and nature of the violation.
In the event of non-compliance, Gunship Group reserves the right to:
- Corrective Action Plans (CAP):
Require the Supplier to develop and implement a documented corrective action plan within a specified timeframe to address identified deficiencies. - Increased Monitoring or Suspension:
Suspend new work, restrict system access, or place the Supplier under enhanced compliance monitoring until issues are satisfactorily resolved. - Contract Suspension or Termination:
Suspend or terminate existing agreements, in whole or in part, in cases of material breach or failure to remediate non-compliance within agreed timelines. - Recovery of Damages:
Seek recovery of losses, damages, costs, or penalties arising from the Supplier’s non-compliance. - Legal or Regulatory Action:
Initiate legal proceedings or report violations to relevant regulatory authorities where required or appropriate. Suppliers are expected to cooperate fully in remediation efforts and demonstrate timely corrective measures to maintain their approved vendor status.
POLICY ACCEPTANCE
Compliance with this Policy is a mandatory requirement for all suppliers conducting business with Gunship Group. All suppliers must:
- Written Acknowledgment:
Formally acknowledge receipt and understanding of this Policy in writing, through an authorized representative. - Contractual Commitment:
Agree to comply with the requirements of this Policy as a binding contractual obligation incorporated into applicable agreements with Gunship Group. - Annual Review and Confirmation:
Review this Policy at least annually and confirm continued compliance. Suppliers shall ensure that relevant employees, contractors, and subcontractors are informed of and adhere to the applicable provisions. - Ongoing Compliance Obligation:
Promptly notify Gunship Group of any circumstances that may affect their ability to comply with this Policy.
CONTINUOUS IMPROVEMENT
Gunship Group is committed to fostering a culture of continuous improvement across its global supply chain. We recognize that regulatory landscapes, security threats, and sustainability expectations evolve over time, and we strive to ensure our standards remain robust, relevant, and forward-looking. Gunship Group commits to:
- Periodic Policy Review:
Conduct regular reviews and updates of this Policy to ensure alignment with evolving legal requirements, industry best practices, and organizational objectives. - Enhancement of Supplier Standards:
Continuously strengthen supplier governance, security, ethical, and sustainability standards to reflect emerging risks and global expectations. - Encouraging Innovation:
Promote innovation among suppliers in areas such as sustainability, cybersecurity, operational resilience, and responsible sourcing practices. - Collaborative Improvement:
Engage constructively with suppliers to address gaps, share best practices, and support capacity- building initiatives where appropriate. - Building a Resilient Supply Chain:
Work toward developing a resilient, ethical, transparent, and secure global supply chain that supports long-term business sustainability and stakeholder trust.
CONTACT DETAILS
In case of any concerns related to the Policy, suppliers can reach out to the team and the details as below
Email ID : compliance@gunshipgroup.com
ADMINISTRATIVE INFORMATION
This Policy applies to all suppliers, vendors, contractors, consultants, and third parties engaged by Gunship Group. Compliance with this Policy is mandatory for all suppliers conducting business with Gunship Group.
- Scope of Applicability:
This Policy is binding on all suppliers and their employees, agents, affiliates, and approved subcontractors who provide goods or services to Gunship Group. - Effective Date:
This Policy shall be effective from 1st January 2026 and shall apply to all existing and new supplier engagements from that date onward. - Exception Management:
Any exceptions, deviations, or waivers to the provisions of this Policy must receive prior written approval from the Director of the relevant Business Unit at Gunship Group. Approved exceptions shall be formally documented. - Ongoing Compliance Obligation:
Suppliers are responsible for ensuring continuous compliance with this Policy throughout the duration of their engagement with Gunship Group. - Policy Review and Amendments:
Gunship Group reserves the right to review, update, and amend this Policy periodically. Suppliers will be notified of material changes and are expected to comply with revised requirements.
APPROVAL AUTHORITY
This Policy has been reviewed and approved by the authorized leadership of Gunship Group