XML 56 R41.htm IDEA: XBRL DOCUMENT v3.25.3
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Jun. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Cybersecurity is one of our strategic priorities, and information security and critical data governance are important to us. Our information security team defines the strategy, policies, practices, procedures, and organizational structure that we use to identify, analyze, evaluate, measure, mitigate, and monitor cybersecurity risks. We work together with various teams within our Company to conduct continuous analysis of potential failures and vulnerabilities, as well as risks that may affect our processes and assets.

This strategy, which is under constant review and evaluation, allows us to identify, protect, detect, respond to, and recover our systems and data from potential threats. This strategy also ensures the proper integration of security into business processes, minimizing risks and impacts that could materially affect us or our subsidiaries. We also adopt preventive controls and processes that allow us to supervise and monitor our corporate information security strategy and carry out investments and initiatives that enable us to achieve our business goals.

In recent years, the average number of cybersecurity incidents has increased significantly worldwide. Therefore, we focus on using advanced threat detection and blocking tools that allow us to prevent the most frequent cyberattacks, which are related to ransomware (hacking of virtual files), malware, spam, phishing, executive impersonation, and BEC (Business Email Compromise), among others.

In response to the evolving risk of cyber threats, we have undertaken several projects to improve our security systems. Our main Enterprise Resource Planning (ERP) system has levels of protection and contingency recovery that allow us to be prepared for the constant evolution of cyberattacks. During 2023 and 2024, among other initiatives, we (i) conducted a risk analysis that allows us to identify residual risks to be treated or accepted, (ii) deepened cybersecurity training for our employees with the aim of distributing simulations, tips, best practices, and knowledge about cybersecurity threats, (iii) implemented the use of two-factor authentication with respect to our employees’ user accounts to minimize the risk of identity theft and information theft, and (iv) established mechanisms for employees to report cybersecurity incidents, for identification, management, containment, and analysis by our incident response team. These actions deepen our commitment to cybersecurity management, increase protection against threats, and build and adequate environment for our Company.

In response to the evolution of cyber threats, we have engaged external advisors with experience in the cybersecurity field who provide us with vulnerability assessment services, customized training, and protection recommendations against cyber threats. Additionally, we work with business partners who provide us with advanced tools for early threat detection, allowing us to identify potential cybersecurity risks. We have processes to oversee and identify risks related to cybersecurity threats associated with the use of third-party service providers. Before engaging with any third parties, we conduct thorough due diligence, assessing their security protocols and practices to ensure they meet our internal standards. Additionally, we continuously monitor third-party services through regular security audits, reviews, and performance assessments.

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Role of Management [Text Block]

Governance

Our management has instituted a Data Protection Committee whose responsibilities include managing unforeseen situations that can negatively affect the Company’s operations and assets, coordinating a quick and effective response to a cybersecurity crisis, managing internal and external communication during a crisis, making critical real-time decisions, constantly evaluating the impact of the situation, adjusting decisions, and ensuring compliance with applicable laws and regulations. The Data Protection Committee is composed of our CFO, our Legal, Compliance and Sustainability Director, and our Operations Director.

We have an information security management team led by our Compliance Manager, who has over 14 years of experience in auditing systems, internal controls, technology risks, user training, and security awareness. Our Compliance Manager completed the preparatory training for the CRISC certification (Certified in Risk and Information Systems Control), which validates his expertise in identifying and managing IT risks, as well as implementing and maintaining effective security controls to mitigate these risks. Our information security management team is independent from our IT management and integrated into our compliance management. Our information security management team has an individual annual budget and a strategy based on two principles: (i) the continuous review and improvement of our information security model; and (ii) a cybersecurity framework based on the National Institute of Standards and Technology (NIST).

Our Compliance Manager reports monthly on incidents to our Data Protection Committee. Additionally, our Compliance Manager, representing the Data Protection Committee, provides quarterly reports on cybersecurity to our Audit Committee, which is responsible for the strategy and oversight of cybersecurity issues, and our Audit Committee also reports on these matters to our Board of Directors, ensuring that the highest levels of governance are informed. This structured reporting process ensures comprehensive oversight and alignment of our cybersecurity policies across our Company.

We have a cybersecurity incident response process designed to report incidents to our Data Protection Committee and Audit Committee. Our Compliance Manager is responsible for managing and resolving cybersecurity incidents that affect the Company. His main responsibilities include supervising the security detection and alert system, notifying relevant parties about detected incidents, conducting initial assessments of incidents, isolating compromised systems, coordinating recovery efforts with our IT management, investigating cybersecurity incidents, managing internal communication about incidents, and reviewing the effectiveness of implemented corrective and preventive measures.

Also, our Compliance Manager is responsible for ensuring that the Company complies with all laws, regulations, and standards related to the management of cybersecurity incidents applicable to it, cooperating with regulatory entities, promoting the review and updating of policies and procedures, acting as a spokesperson for the Data Protection Committee, and keeping the Audit Committee informed about the status of the Company’s regulatory and legal compliance.

Additionally, our legal management team receives reports on cybersecurity incidents, cooperates in determining the materiality of such incidents, evaluates the severity and scope of such incidents from a legal perspective, reviews contracts with suppliers, evaluates the possibility of potential litigation, and provides legal guidance to our Company. Similarly, our fraud prevention team participates in the analysis of cybersecurity incidents to identify possible fraudulent activity, collects evidence for legal purposes, monitors suspicious transactions, and cooperates with our other teams to report incidents.

Also, as part of our processes with respect to contracts with suppliers, our Company establishes specific contractual provisions to ensure that these partners comply with adequate data protection standards and security measures that meet our internal requirements.

As previously disclosed, we experienced a cybersecurity incident in 2019 which temporarily disrupted our systems. We have no reason to believe that such an incident resulted in the unauthorized disclosure of confidential information. See “Item 3.D. Risk Factors - We were the target of a cybersecurity incident that disrupted our systems.” Except for that incident, we have not recorded any significant Information Security events that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition. We are aware of the constant cybersecurity risks and continue to implement protective measures that allow us to minimize potential negative impacts on our business. However, these protective measures may be insufficient to fully protect against cybersecurity risks. For more information about these risks, see “Item 3.D. Risk Factors - Risks Relating to Our Business -Cybersecurity events could negatively affect our reputation, our financial condition and our results of operations.”

Cybersecurity Risk Board of Directors Oversight [Text Block] Additionally, our Compliance Manager, representing the Data Protection Committee, provides quarterly reports on cybersecurity to our Audit Committee, which is responsible for the strategy and oversight of cybersecurity issues, and our Audit Committee also reports on these matters to our Board of Directors, ensuring that the highest levels of governance are informed
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] our Audit Committee also reports on these matters to our Board of Directors, ensuring that the highest levels of governance are informed.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] our Audit Committee also reports on these matters to our Board of Directors, ensuring that the highest levels of governance are informed. This structured reporting process ensures comprehensive oversight and alignment of our cybersecurity policies across our Company.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true