Security Policy

Infinitas Learning is committed to protecting the confidentiality, integrity and availability of its information,
systems and services, as well as the data entrusted to us by schools, teachers, students and partners. We
apply appropriate security controls to the information we process and to the risks associated with our services.
These controls include measures to protect data against unauthorized access, disclosure, alteration or loss,
as well as controls for access management, secure data transmission and storage, and protection of the
underlying infrastructure.

Security controls are reviewed and maintained throughout the service lifecycle in line with established security
practices and applicable Group security standards.
This policy sets out how we approach information security and how third parties may report potential security
issues to us.

This policy applies to all websites, applications, platforms, APIs and infrastructure owned or operated by
Infinitas Learning Holding B.V. and its group companies, including, but not limited to, Liber, Noordhoff and
Plantyn (together, “Infinitas Learning”).

Identity and Contact Details

Infinitas Learning Holding B.V., having its office at, Reykjavikstraat 1, 3543 KH Utrecht, the Netherlands.
Security matters can be reported via security@infinitaslearning.com.

Our Commitment to Security

Infinitas Learning implements technical and organizational measures appropriate to the risks associated with
its services, in line with applicable laws and regulations of the Netherlands and the European Union, and with
recognized information security standards.

These measures are reviewed and improved on a continuous basis.

Vulnerability Disclosure & Bug Bounty Program

Infinitas Learning does not operate a Bug Bounty Program.

Infinitas Learning does not offer monetary rewards, gifts, compensation or public recognition of any kind for
unsolicited vulnerability reports.

Submitting a report does not create any contractual relationship, obligation to pay or expectation of reward.

Requests for payment made as a condition for disclosing, withholding or not publishing information will not be
entertained.

Prohibited Activities

Unless Infinitas Learning has provided prior written authorization, third parties are not permitted to perform
any active security testing against Infinitas Learning systems, including, but not limited to:

• security scanning, automated vulnerability scanning or port scanning;
• Penetration testing or vulnerability assessments;
• Attempts to gain unauthorized access to systems, accounts or data;
• Accessing, downloading, modifying or deleting data that does not belong to you;
• Denial-of-service or load testing;
• Social engineering, phishing or physical attacks against employees, customers or facilities;
• Use of automated tools that may degrade the performance or availability of our services; or
• Any other activity intended to actively identify, exploit or validate security vulnerabilities in infinitas learning systems.

Such activities may violate applicable law. Infinitas Learning reserves the right to take appropriate legal action
and, where appropriate, report such activities to the competent authorities

Reporting a Potential Vulnerability

We welcome reports of security vulnerabilities discovered through normal and lawful use of our services.

If you come across a potential security issue, please report it to security@infinitaslearning.com.

• A clear description of the issue;
• The affected url, application, system or service;
• The date and time the issue was observed;
• A description of the potential security impact; and
• Any information necessary for us to understand and reproduce the issue without requiring further testing

When reporting a vulnerability, please:

• Do not exploit the issue beyond what is strictly necessary to identify or demonstrate it;
• Do not access, modify, download or retain personal data or content belonging to others;
• Do not perform additional scanning, testing or exploitation after submitting the report;
• Do not share the issue with third parties before it has been resolved; and
• Delete any data obtained as a result of the issue.

Reporting a vulnerability does not grant authorization to perform further testing, scanning, exploitation or
verification.

Infinitas Learning will assess submitted reports based on their relevance and potential security impact. We
may not be able to respond to, confirm or provide updates on every report.

Third-Party Services

Some of our services rely on third-party providers.

Security issues concerning third-party platforms or services should be reported directly to the relevant
provider. Infinitas Learning is not responsible for the security policies, practices or services of those providers
or of linked websites.

Changes to This Policy

Infinitas Learning reserves the right to change this policy at any time.

This policy was most recently updated on 29-09-2026.