Corporate ethics and integrity

Grupo Aeromexico has made multiple efforts to align its processes to the best practices in information-security matters, based on risk identification, their assessment, awareness campaigns, and actions taken for their reduction and treatment. Throughout the last ten years, Grupo Aeromexico has developed a regulatory framework to protect the information availability, confidentiality, and aligned with the internationally acknowledged information security practices, such as ISO 27001.

Data security is essential for Grupo Aeromexico and it holds a stringent security position through a methodology based on the implementation of the best practices and security policies that offer coverage across the company, which include:

• Regulatory controls
• Organizational controls
• Controls of service providers
• Standardized process and practices
• Controls of business partnerss

The key policies in force that contribute to the verification and compliance with the Information Security Policy are:

• Awareness and training program
• Data-privacy practices
• Roles and responsibilities
• Policies of technological assets, e-mail, and Internet use
• Network and telecommunications security
• Management of information-security incidents
• Malware control (antivirus)
• Logic access
• Physical access
• Remote access
• Firewall management
• Services of third parties
• Corporate software and appropriate use
• Audit and monitoring
• Data classification, confidentiality, integrity, and availability
• Policy compliance

The policies and procedures mentioned above are documented and available for consultation of the Aeromexico staff to promote their proper compliance.

When you access this website and make any query or search anywhere in our site, a secure server is used.

We use secure data encryption in the transmission of any personal information, including the credit-card details that you provide online.

We have a secure platform for the payment of the services contracted, in compliance with PCI. We do not store your payment-card data online. All the transactions are processed online in real time and are protected by the security standards of the industry.

PCI DSS is a standard that sets forth a set of security measures, practices, and tools focused on ensuring the security in the treatment of the information associated with card payments. This standard aligns the main security initiatives for infrastructure-payment channels, with the purpose of ensuring the existence of a global, consistent framework for the data protection of cardholders, transactions, and authentication data. The standard has been created by the main card brands: Visa Internacional, MasterCard Worldwide, American Express, JCB, and Discover Financial Services.

At present, the PCI DSS standard is managed, reviewed, and updated by the PCI Security Standards Council. The main objective of PCI DSS is to improve the security level of the payments made using cards, promoting the existence of a secure-payment environment for their information and complying with all the control objectives established in PCI DSS, indicated below:

1. Creation and maintenance of a secure network.
2. Protection of the data stored.
3. Maintenance of a vulnerability management program.
4. Implementation of access-control measures.
5. Periodic-network monitoring and review.
6. Maintenance of an Information Security Policy.

Any entity that derived from its business-operation stores, processes, and transmits personal data of cardholders (card number, name of cardholder, expiration date, service code, and/or authentication data) is obliged to comply with the information-protection measures of cardholders agreed by the brands and reflected in the Payment Card Industry Data Security Standard, published on the webpage of the PCI Security Standards Council, www.pcisecuritystandards.org.

The PCI DSS scope includes all the components of the system that stores, processes, or transmits card data. The system components are defined as any component of the network, server, or application included in the cardholder-data environment or that is connected to it. The cardholder-data environment is the part of the network that contains the data of the cardholder or confidential-authentication data. For the case of Grupo Aeromexico, the certification was obtained for the E-commerce sales channel, complying with the 403 specific controls and requirements for the certification.

In an ongoing search for contributing in the aeronautic sector, Grupo Aeromexico is part of organizations like AVIATION A-ISAC (Aviation Information Sharing & Analysis Center).In an ongoing search for contributing in the aeronautic sector, Grupo Aeromexico is part of organizations like Aviation Information Sharing & Analysis Center (A-ISAC).

A-ISAC is a unique closed group where security information is shared in the entire aviation sector, contributing to improve risk-management practices and be prepared before any threat, vulnerability, and incident.

This organization promotes the exchange, as well as timely and actionable information related to threats, vulnerabilities, incidents, possible protection measures, and best practices before a security incident. The cooperation and communication among members is encouraged through a secure and reliable network. The information is investigated and analyzed to validate the accuracy and seriousness to issue strategic-mitigation recommendations, fostering the development of trust-based professional relations in the public and private sectors.

All the collaborators in Grupo Aeromexico are fully convinced that the relationships between employees, with customers, partners, providers, stakeholders, and the society in general must occur relying on a strict framework of ethical principles and corporate integrity.In this context, we have developed and implemented ethical, integrity, and Anti-corruption regulations, aligned with domestic and international practices, and in compliance with the National Anti-corruption System and other international laws, like the FCPA, UK Bribery Act, Sarbanes Oxley Act. These achievements have been possible thanks to the evolution we have had in our corporate governance and culture, stressing and promoting honesty, safety, transparency, and responsibility in all our activities.

Therefore, this portal outlines the most relevant regulatory framework developed in our Compliance Program, including the Code of Conduct about respect and the behavior expected amongst us and acting honestly with our customers and partners. You will also find regulations related to Anti-corruption, anti-trust, conflict of interests, and information security, among other products and tools of the Program.

Additional information available for you on this site are actions related to social development, environmental care, and others that contribute to sustainable development.In Grupo Aeromexico, the human factor is the main building block that supports the company we currently are before our customers and partners. Therefore, on this page, you can also find different campaigns and tools related to the promotion of gender equality, no discrimination, and our commitment with Human Rights.

In our fight against corruption, we are all part of the great Aeromexico crew. Thus, in this space, we share our Compliance Program, which will certainly contribute so that everybody can enjoy the best of flights.

Aeromexico always deals honestly with governments, business partners, and third parties in general, and complies with the applicable laws in all the jurisdictions where we have activities and manage our businesses. In that sense, Aeromexico has assumed the commitment to carry out its businesses ethically and respecting the law, enforcing the highest integrity standards and conforming to all the domestic and international laws and regulations applicable.

Pursuant to the fourth commitment set forth in our Code of Conduct, all the people who work in Aeromexico and its affiliates absolutely reject any act of corruption. This commitment represents an essential element for any honest, reliable, and competitive company in its business and labor relations and in its investments.

In accordance with what is stated in the Anti-corruption Policy of Aeromexico, any form of corruption, bribery, or fraud is strictly prohibited, regardless if the relevant third party is a public officer or any individual. We adhere to a zero-tolerance policy to corruption. Accordingly, Aeromexico will not approve nor will it be involved in any irregular or illegal payments or in undue benefits of any kind or in any circumstances whereby a third party could reasonably perceive that the purpose of the Company is to obtain or retain a business, influence on a business relation, or be linked to any inadequate performance of the tasks of the recipient.

Aeromexico will never accept the direct or indirect participation of any third party in any act of corruption or bribery.

All the operations that involve the resources or assets of Aeromexico or the operations made for and on behalf of Aeromexico by a third party must be recorded in time and with reasonable detail, accurately and completely, as evidence of their occurrence.

Anti-trust represents the effort made by two or more people, businesses, or companies to increase their market share, offering more options of products and services of higher quality at better prices.

The benefits of having anti-trust in the market are that it promotes fair and healthy competition, protects consumers, ensures the availability of higher quality goods at the lowest price possible, and promotes innovation.

Derived from the above and based on the importance of this matter for the wellbeing of our customers, Aeromexico is committed to promoting the compliance with the Federal Law of Anti-trust (Ley Federal de Competencia Económica). For this reason, it has the relevant policy that is communicated to the company staff, as well as an online-training course for the areas that require this knowledge for the tasks they perform.

In accordance with the third commitment set forth in our Code of Conduct, all the workers in Aeromexico share the responsibility to refrain from falling into situations that could result in regulatory non-compliance that affects the reputation of Grupo Aeromexico, and adopt an anti-trust culture as part of our values, strengthening the reputation, increasing productivity, and ensuring the long-term feasibility of the company.

With regards to the competition with other Economic Agents, we must use our best efforts to compete in an independent, strong, legal, and transparent way, so that the value contributed by our products and services becomes the differentiator that appeals and maintains our customers, observing at all times the business practices.

A conflict of interest implies an issue that emerges when the actions, relationships, interests, or investments of an executive or employee interfere or appear to interfere with those of Aeromexico or with the capacity to carry out its activities in an effective and impartial manner.

Pursuant to the second commitment set forth in our Code of Conduct, all the people who work in Aeromexico and its affiliates have the commitment to live with unshakeable integrity and be accountable of our actions.

In this sense, the main duties and obligations of any collaborator are:

1. Avoid operations, commitments, and activities that go against the interests of GAM or involve a conflict with his personal interests.
2. The obligation to refrain from involving in activities that could generate personal benefits and contravene the interests of GAM, and behave ethically at all times and following the highest standards of conduct.
3. Refrain from using money, items of value, assets, or facilities of the company for personal use.

Relatives who work at the same time in Group Aeromexico is allowed, however, to avoid potential conflicts of interest, they must not work in the same area and hiring family members of directors is forbidden.

The purpose of the conflict of interest policy is to establish the position of GAM in terms of conflicts of interest and ensure to the greatest extent possible that all the directors, officers, and employees are aware of and understand it, using the tools and guidelines established to fulfill these tasks and responsibilities.

Aeroméxico in its dealings with suppliers, service providers, intermediaries and business partners, seeks in its relevant relationships to verify adherence to the laws and best practices in matters of corporate integrity; therefore, we check all information provided by the third party itself, and perform background checks on sanctions and disqualification lists.

By monitoring our relationships with third parties, we help protect the Group's reputation, interests, property and rights, and we encourage our suppliers, service providers and business partners to improve their internal controls in order to avoid affecting their business commercial activities.

Under this policy, GAM collaborators must:

1. Identify if the relationship requires a background check process.
2. Apply any applicable questionnaires according to the type of relationship.
3. If any risk factor is found, inform the Legal Compliance Department to establish an acceptable mitigation strategy.

Through the monitoring of the relationship with Third Parties, the following activities are carried out: a) integration of a file; b) monitoring of changes; and c) timely reporting of breaches.