Management Policy
STRATEGIC DEFINITION OF ASPHALION
ASPHALION S.L. is a regulatory and scientific consultancy firm, targeting the European market that offers pharma and medtech services. The company was founded with the aim of supporting companies by providing value-added solutions that enable them to achieve their objectives while optimizing time and resources.
We are a hybrid, digital, SMART and dual company, organised in units whose philosophy is based on achieving the satisfaction of our customers by engaging a highly-qualified professional team and offering high quality services and advanced technology, fulfilling all the legal requirements that apply to the firm.
QUALITY POLICY
The objective of the quality policy of our company is to guarantee the quality of our services by continuously monitoring the executed services and reviewing our client’s satisfaction with the aim of continuous improvement and alignment with the applicable regulations, assuring sustained effectiveness. In line with this, we have implemented a quality management system based on the UNE-EN ISO 9001 and UNE-EN ISO 13485.
Therefore, at ASPHALION S.L. we are committed to make every effort to:
Ensure excellence in all the services provided, promoting continuous improvement of our services and the management of the company.
Meet and exceed the needs of our customers.
Ensure high qualification, full responsibility and continuous training of all personnel of the organization.
Involve staff of the organization in company management activities and seek continuous improvement.
To comply with the legal requirements and other requirements applicable to the organization.
COMPLIANCE POLICY
ASPHALION S.L. is committed to:
Comply with the laws and regulations in countries in which it operates as well as the Code of Conduct and other established internal procedures.
Have zero tolerance towards behaviour that could result in breaches of law, corrupt practices or unethical professional conduct.
Constitute a compliance body aimed at preventing the committing of crimes, to guide the design of appropriate control measures and to analyse the effectiveness of the system. This body is independent with due authority, freedom of initiative and freedom of control.
Promote training and communication of the compliance model to everyone in the company so that they may be familiar with and understand the rules and compliance commitments necessary for their activity.
Encourage staff to report facts or suspicious behaviour, ensuring the absence of reprisals against those who make such allegations.
Should it be necessary, apply disciplinary sanctions under existing labour laws and the applicable collective agreement.
ASPHALION S.L. is committed to continuous improvement and maintenance of the effectiveness of its management system.
Also, to ensure that this policy is met, the Steering Committee is committed to define objectives consistent with this and to review the system periodically to ensure their effectiveness.
Asphalion, S.L.
Tarragona 151–157, Planta 11 Bloque A
08014 Barcelona, Spain
Document reference: Document reference: Quality and Compliance Policy – Version 05 | 14 December 2023
Effective date: 14 de diciembre de 2023
Security Policy
STRATEGIC IMPORTANCE OF INFORMATION SECURITY
Asphalion S.L. recognizes the critical role that Information Security plays in supporting the strategic and operational functions of the organization. The Information Security Management system (ISMS) ensures business continuity and enhances the efficiency of our operations, aligning with the company’s mission to provide value-added solutions to our customers.
The ISMS is designed to safeguard the confidentiality, integrity, and availability of information assets and processes that underpin the organization’s operations.
INFORMATION SECURITY POLICY
Asphalion S.L. is committed to ensuring robust Information security by implementing and maintaining an Information Security Management System (ISMS) in accordance with ISO/IEC 27001. This commitment is supported through regular review, risk management, and compliance with all relevant regulations and standards.
To achieve this, we are committed to:
Setting and Achieving Information Security Objectives:
Our ISMS establishes a framework that enables us to define, review, and achieve information security objectives that are aligned with our strategic goals.
Commitment to Continual Improvement:
Continuously improving our ISMS to address evolving security threats and enhance the overall security posture of the organization, through regular assessments, audits, and management reviews to ensure strategic alignment and effectiveness.
Protecting Confidentiality, Integrity, and Availability:
Safeguarding information against unauthorized access, disclosure, alteration, or destruction.
Ensuring that resources needed are available to support critical business functions without interruption.
SGSI documentation and records are archived guarantying the integrity beyond a 5-year period.
Protection of Personal Data:
Implementing stringent controls to protect personal data in compliance with applicable data protection laws, including GDPR, ensuring the privacy rights of individuals are respected.
Physical Security Measures:
Establishing and maintaining physical security controls to protect information assets and facilities from unauthorized physical access and environmental threats.
Continuous Risk Management:
Identifying and addressing risks to ISMS through regular assessments and risk treatment plans.
Compliance with Legal and Regulatory Requirements:
Complying with relevant data protection laws, applicable standards, and contractual requirements.
Security Awareness and Training:
Providing continuous education to employees on information security practices to minimize human-related security risks.
Information Security Protocols and guidelines:
Implementing comprehensive security measures as outlined in our Standard Operating Procedures (SOPs), work instructions (WIs), manuals, and training programs.
Effective Governance and Resource Allocation:
Ensuring strategic oversight through regular management reviews and the allocation of necessary resources.
Asphalion, S.L.
Tarragona 151–157, Planta 11 Bloque A
08014 Barcelona, Spain
Document reference: Information Security Policy – P.03.02 | 13 November 2025.
Effective date: 13 November 2025
