Corporate Governance, Risk & Responsibility Policy

Value Weaver Consulting Services Limited is committed to the highest standards of corporate governance, effective risk management, and responsible business conduct. This Corporate Governance, Risk & Responsibility Policy outlines the principles and frameworks that guide ethical decision making, accountability, and transparency across our operations. It defines the roles of the Board, management, and employees in identifying, assessing, and managing risks, while ensuring compliance with applicable laws and stakeholder expectations. The policy also reinforces our responsibility to clients, partners, employees, communities, and the environment, supporting sustainable value creation, prudent stewardship, and long term organisational resilience, and continuous improvement across business activities.

Purpose and Regulatory Context

This policy framework defines how Value Weaver Consulting Services Limited (Value Weaver Consulting thereafter) governs its operations, manages risk, protects information, and delivers services responsibly when supporting clients, including UK‑based organisations and those operating across EU jurisdictions.

The framework is designed to align with:

• UK regulatory expectations
• EU legal and regulatory requirements applicable to third‑party suppliers
• Proportionate governance practices appropriate for a low‑risk professional services provider

All policies apply to employees, directors, and any engaged contractors or subcontractors.

Corporate Governance & Ethical Conduct Policy

Value Weaver Consulting is committed to high standards of ethical conduct and transparent decision‑making. Governance structures are intentionally lean, with clear accountability held by senior leadership to ensure rapid oversight and effective control.

The company operates on principles of honesty, fairness, and responsibility in all dealings with clients, partners, and suppliers. Business decisions are taken with due consideration of client impact, regulatory risk, and long‑term sustainability.

Any unethical conduct, suspected misconduct, or breaches of policy are taken seriously and investigated promptly, with appropriate corrective action taken where necessary.

Financial Crime, Sanctions & Anti‑Bribery Policy

Value Weaver Consulting maintains a zero‑tolerance approach to financial crime, bribery, corruption, facilitation of tax evasion, or breaches of sanctions regimes.

Given the nature of services provided, the company does not handle client money, execute financial transactions, or engage in activities requiring financial authorisation. This significantly reduces inherent financial crime risk; however, vigilance is maintained.Employees and contractors are expected to act in accordance with the UK Bribery Act, applicable EU legislation, and international sanctions requirements. Any concerns related to financial crime risk are escalated immediately to senior leadership and, where relevant, to affected clients.

Regulatory Status & Independence Statement

Value Weaver Consulting provides non‑regulated professional services focused on procurement advisory, transformation, process optimisation, cost-efficiency and software deployment.

The company does not provide regulated financial advice, customer‑facing financial services, or activities requiring FCA or EU regulatory authorisation. Engagements are advisory and operational in nature and do not substitute for legal, regulatory, or compliance advice.

Independence is maintained in all client recommendations. Any commercial relationships with third‑party software vendors or partners are transparently disclosed to ensure objectivity and avoid conflicts of interest.

Information Security & Data Protection Policy

Value Weaver Consulting recognises the sensitivity of client and operational data and is committed to protecting confidentiality, integrity, and availability of information.

Information security controls are designed around recognised best‑practice principles, including least‑privilege access, secure authentication, and responsible data handling. Data is accessed strictly on a need‑to‑know basis and only for legitimate business purposes.The company complies with UK GDPR and EU GDPR obligations and ensures client data is processed lawfully, securely, and transparently. Any suspected information security incidents are assessed promptly, escalated appropriately, and managed in line with contractual and regulatory expectations.

Operational Resilience & Business Continuity Policy

Value Weaver Consulting maintains proportionate operational resilience arrangements to ensure continuity of services in the event of disruption.

The business operates primarily in a remote and cloud‑enabled manner, reducing dependency on physical locations or single points of failure. Key information and working materials are backed up through secure cloud platforms.

In the event of staff unavailability, technology failure, or external disruption, the company prioritises communication with clients and focuses resources on the continuation of critical activities. Resilience arrangements are reviewed periodically to ensure ongoing effectiveness.

Quality & Delivery Assurance Policy

Quality assurance is central to all engagements undertaken by Value Weaver Consulting. Each client engagement is governed by a clearly defined scope, deliverables, roles, and timelines.

Senior leadership maintains oversight of deliverables to ensure consistency, accuracy, and client alignment. Risks, dependencies, and constraints are identified early and communicated openly throughout project delivery.

Client feedback is actively encouraged and used to refine methodologies, strengthen capability, and improve service outcomes.

Subcontractor & Fourth‑Party Risk Management Policy

Subcontractors and associates are engaged only where required to provide specialist expertise or capacity and are carefully selected based on competence and professionalism.

All subcontractors are required to adhere to confidentiality, data protection, and ethical standards equivalent to those applied internally. Access to client systems and data is limited strictly to approved scope.Overall accountability for service delivery remains with Value Weaver Consulting, regardless of subcontractor involvement, ensuring clear ownership and risk management for clients.

Environmental, Social & Governance (ESG) Policy

Environmental

As a professional services firm, Value Weaver Consulting operates a low‑environmental‑impact delivery model. Remote working is the default, with travel undertaken only where client benefit clearly outweighs environmental cost.

Social

The company promotes fair treatment, respect, and inclusion. Employment decisions are based solely on merit, experience, and capability. Harassment, discrimination, or unfair treatment is not tolerated.

Governance

Strong governance is maintained through leadership accountability, ethical oversight, and regular review of policies and controls to ensure continued relevance and effectiveness.

Modern Slavery & Human Rights Statement

Value Weaver Consulting is committed to preventing modern slavery, forced labour, and human trafficking in its operations and supply chain.

While the risk associated with professional consulting services is assessed as low, the company remains alert to potential indicators of abuse. Suppliers are selected based on reputation and ethical standards, and any concerns are escalated immediately.

Health, Safety & Wellbeing Policy

The nature of advisory, consulting and software deployment work presents limited physical risk. However, employee wellbeing is actively supported through reasonable workloads and flexible working practices.Where work is conducted on client premises, client health and safety policies are followed. Safe home‑working practices are encouraged and supported.

Compliance, Oversight & Review

Responsibility for compliance with this framework rests with company leadership. Policies are embedded into daily operations and engagement governance rather than treated as standalone documents.This framework is reviewed annually or following material changes to business activities, regulatory expectations, or client requirements.

Client Assurance & Declaration

This policy framework accurately reflects the practices and controls in place at Value Weaver Consulting Services Limited and is applied in a manner proportionate to the size, services, and risk profile of the organisation.

Name: Ravi Pachauri
Title: Director
Date: 05 Jan 2026

Annex A – Data Processing & GDPR Compliance Statement

A.1 Role of the Parties

For most client engagements, Value Weaver Consulting acts as a Data Processor, processing personal data on documented instructions from the client, who acts as the Data Controller.

In limited circumstances (e.g. internal contact management), the company may act as an independent Data Controller for its own business data.

A.2 Categories of Data Processed

Data processed may include:

• Business contact information (name, role, email, phone)
• Professional profile data relevant to procurement or systems access
• Limited client system metadata where required for delivery
• Third party entities (suppliers) data-
  • Supplier profile, business contacts etc
  • Purchasing contracts for good and services
  • Compliance & policy documents

Special category personal data is not processed unless explicitly agreed and contractually governed.

A.3 Purpose & Lawful Basis

Personal data is processed solely for:

• Delivering contracted services
• Project administration and communication
• Meeting legal or contractual obligations

Processing is limited to what is necessary, appropriate, and proportionate.

A.4 Data Security Measures

Value Weaver Consulting implements appropriate technical and organisational measures, including:

• Access controls and authentication
• Secure devices and cloud platforms
• Confidentiality obligations for staff and contractors
• Secure deletion upon completion of services

A.5 Data Transfers

Where data is accessed outside the UK or EU (e.g. remote working scenarios), appropriate safeguards are applied consistent with GDPR requirements.

A.6 Incident & Breach Management

Any suspected personal data breach is:

• Investigated promptly
• Escalated internally
• Communicated to the client without undue delay where required

A.7 Data Retention & Deletion

Data is retained only for the duration required to fulfil contractual obligations and is securely deleted thereafter, unless legal retention requirements apply.

A.8 Audit & Client Rights

Clients may reasonably audit compliance with this annex through:

• Policy review
• Written assurance
• Proportionate information requests

Full on‑site audits are not typically applicable given the size and risk profile of the organisation but may be discussed where required.