Social Media Policy

Introduction

Epcotec's people write in public. We share engineering work, discuss our craft and take part in the professional conversation where it happens: on social platforms, in forums, in blogs and in developer communities. That visibility is good for our people and good for the company, and it carries real obligations. This Policy sets out those obligations so that everyone who works with Epcotec, and everyone who engages with us online, knows what is expected.

The Policy protects three things above all: the Confidential Information and Intellectual Property of Epcotec and its clients, the people who work here, and the trust our clients place in us. It applies to employees and to independent contractors and labour-hire contractors engaged by Epcotec ("contractors"), and, as appropriate, to consultants, subcontractors and suppliers providing services or goods to Epcotec and its clients.

Scope

This Policy applies to all employees and contractors, and to all their interactions on Social Media Applications. Its application is not limited to Epcotec-provided devices or information systems, to Epcotec premises, or to standard working hours. As appropriate, it also extends to our relationships with customers, clients, vendors and other business associates.

This Policy supplements, and should be read together with, our:

• Code of Conduct;
• Privacy Policy;
• Whistleblower Policy;
• Equal Employment Opportunity (EEO), Discrimination, Bullying and Harassment Policy; and
• IT and Information Security Policy.

What this Policy covers

Epcotec has a legitimate business interest in protecting its Confidential Information, its clients' data and code, and its reputation. This Policy therefore applies to all information shared and all communications made through Social Media Applications, which include, without limitation:

• social networking sites (e.g. Facebook, Instagram, TikTok, LinkedIn, Snapchat, Telegram);
• video and photo sharing websites (e.g. YouTube, Vimeo);
• micro-blogging and newsletter platforms (e.g. X, Mastodon, Substack);
• weblogs, whether corporate, personal or hosted by media publications;
• forums and discussion boards (e.g. Reddit, Hacker News, Discord and Slack communities);
• instant messaging and collaboration services (e.g. Microsoft Teams, Slack, WhatsApp, Signal);
• online encyclopaedias and collaborative sites (e.g. Wikipedia); and
• any other website or application that lets individuals or companies publish directly.

Social Media Applications are not limited to public websites; they include any electronic application, including mobile and messaging applications, used to communicate or share information with user groups or the public. Online communications include posting or publishing information, uploading or sharing photos or images, direct messaging, status updates and any other form of interaction facilitated by electronic means.

Personal use during work time

Employees may use Social Media Applications during work time on a reasonable-use basis, subject to this Policy. Any communication made through Epcotec's information systems may be monitored in accordance with our IT and Information Security Policy. Use of social media must not interfere with the performance of your role.

Personal and professional accounts

We encourage our people to talk about their work, their craft and their experience at Epcotec, including at Epcotec events and, with client consent, on engagements we deliver. Keep personal and corporate accounts separate:

• Personal accounts are your own. You are personally responsible for what you post, and you must not imply that your personal views are Epcotec's.
• Professional or corporate accounts, meaning accounts operated on Epcotec's behalf or clearly associated with your role at Epcotec, are governed by our brand and communications standards and may only be created or operated with Epcotec's approval.

If you identify yourself as working at Epcotec on a personal account, you increase exposure for both yourself and the company. You are accountable for the information you put forward and should monitor your posts accordingly.

Responsibilities

Employees and contractors must:

• not disclose Epcotec or client-related information, including source code, data, credentials, architecture details or unannounced product and research work, on any Social Media Application unless authorised by Epcotec;
• not encourage, aid or abet any other person to use social media inappropriately or contrary to this Policy;
• not disclose information about other employees on any Social Media Application without that person's permission;
• behave consistently with our Equal Employment Opportunity (EEO), Discrimination, Bullying and Harassment Policy, and publish nothing that is obscene, defamatory, threatening, harassing, discriminatory or hateful toward any person or entity, including Epcotec, its officers, directors, employees, agents or representatives, its clients, partners, suppliers, competitors or contractors;
• notify their manager, the People & Compliance lead or another appropriate person within Epcotec if they become aware of material posted on social media that may damage Epcotec or its reputation or breach this Policy;
• make no communication that disparages Epcotec, that might damage Epcotec's reputation, brand image or commercial interests, that might undermine the confidence of Epcotec's customers, or that is likely to bring Epcotec into disrepute or ridicule;
• not use the name "Epcotec", or any other like title, mark or logo identifying Epcotec, in any domain name, or in the title of any blog or other personal site they establish; and
• not use or display any Epcotec or client Intellectual Property in any communication without the express written consent of Epcotec or the client, as applicable.

Speaking for Epcotec

Only people authorised by Epcotec may speak on its behalf on social media or present themselves as an official Epcotec spokesperson. If you are authorised:

• follow Epcotec's brand, tone and communications standards;
• be accurate, and correct or retract errors promptly and transparently; and
• make no commitments about pricing, timelines, features or research outcomes unless you are authorised to do so.

If a journalist, analyst or content creator approaches you about Epcotec, refer the enquiry to the People & Compliance lead rather than responding yourself.

Client confidentiality and intellectual property

Clients own their code and IP, and that ownership extends to social media. You must never:

• share client source code, data, screenshots of internal systems, dashboards or unannounced features;
• reveal that a named or identifiable client is using a particular product or service without the client's consent;
• discuss client security incidents, vulnerabilities or architectural details; or
• post about an engagement in a way that could identify the client, unless the client has agreed and Epcotec has approved the post.

Before posting, consider whether private, confidential or secure information could be shared unintentionally, including through geolocation and other metadata embedded in a post or an image. Epcotec treats the privacy, confidentiality, security and integrity of its people, clients, engagements and Confidential Information with the highest priority.

AI-generated content

Epcotec works by a "human judgment, AI assistance" principle, and our public communications follow the same transparency:

• if a post is materially generated or assisted by AI, in text, images, audio or video, that fact must be disclosed where the platform allows it, and in any event whenever the content could reasonably be mistaken for human-authored material;
• AI-generated content must be reviewed by a human before posting and must meet the same accuracy, confidentiality and conduct standards as any other content; and
• AI tools must not be used to create content that would breach this Policy, such as fabricated quotes, manipulated images of people, or content that discloses Confidential Information.

Posting on personal social media

Posts on personal Social Media Applications (other than official or corporate communications approved by Epcotec) must:

• comply with this Policy and the policies listed above;
• if they include an image or personal information about another Epcotec employee or contractor, be shared only with that person's express permission; and
• not reveal information, images, photographs or details about Epcotec, an engagement or a client that might breach privacy, confidentiality or security.

If you are unsure whether a post about Epcotec, an engagement or a client is appropriate, raise it with us first. We would much rather help before it goes out than clean up afterwards.

Breach of this Policy

Epcotec may require any post on a Social Media Application that breaches this Policy to be corrected, clarified or removed by the person or entity that made it, and that person must comply with any such request. An employee or contractor who breaches this Policy may face disciplinary action, up to and including termination of engagement. Where Epcotec incurs costs because of a breach of this Policy, it may seek to recover those costs.

Definitions

Confidential Information includes, without limitation, information relating to or belonging to Epcotec, its customers and clients: customer lists or requirements; suppliers; terms of trade; pricing lists or pricing structures; marketing information and plans; Intellectual Property and other trade secrets; inventions; business plans or dealings; technical data; employees or officers; financial information and plans; designs, reports and templates; product lines; research activities; software and the source code of any such software; and any metadata, including geolocation and other embedded data. It does not include information that is generally available in the public domain, or that the person knew before its disclosure by Epcotec.

Intellectual Property means all intellectual property rights, whether registered or unregistered, and whether existing under statute, at common law or in equity, throughout the world, including:

• all trademarks, trade names, logos, symbols, get-up, brand names and similar rights;
• registered or unregistered designs, patents, copyright, circuit layout rights and trade secrets, together with the right to have Confidential Information kept confidential; and
• any application, or right to apply, for any of those rights.

Social Media Applications is defined under "What this Policy covers".

---

Approved: Eugene Pivnev, Founder & Managing Director, Epcotec

Version 1.2, 2 October 2026