Version: September 2025

Cielo Sustainable Procurement Policy

Policy Statement

At Cielo, our purpose is to illuminate talent, wherever it’s found, and our Responsible Business Strategy is core to achieving this. This Sustainable Procurement Policy is a direct extension of that strategy, formalizing our commitment to making a positive impact through our purchasing decisions. We are dedicated to integrating environmental, social, and economic factors into our procurement processes to ensure they protect the environment, uphold human rights, good governance and create an ethical marketplace. This policy serves as a guide for our employees and a statement of our expectations for our suppliers, ensuring that together, we build a more just and sustainable future for all.

Scope

This policy applies to all who work for and with Cielo, including employees, contractors, and all third-party suppliers, vendors, and business partners involved in providing goods or services to or on behalf of Cielo. We expect everyone to share our commitment and adhere to the principles outlined herein.

Core Sustainable Procurement Principles

Our procurement decisions will be guided by our core Responsible Business pillars. We will prioritize suppliers who demonstrate a clear commitment to these principles.

a. Climate Action and Environmental Stewardship

We are committed to protecting our planet and minimizing our environmental impact. We will actively work towards our carbon reduction ambitions by:

  • Prioritizing suppliers who are measuring, managing, and reducing their own carbon footprint and other harmful emissions
  • Utilizing carbon accounting such as (SBTi) methodology to measure and manage our own operational emissions and, critically, our supply chain (Scope 3) SBTi carbon emissions.
  • Promoting a circular economy by reducing consumption, prioritizing recycled and renewable materials, and minimizing waste.
  • Considering the total lifecycle impact of products and services, from creation to responsible end-of-life disposal.
  • Conserving vital resources, including energy and water.

b. Thriving People and Upholding Human Rights

We believe that respecting and promoting human rights is a fundamental responsibility. We are committed to fostering safe, inclusive, and equitable environments. In our procurement practices, we will:

  • Strictly prohibit human trafficking, forced, bonded, indentured, or child labor within our operations and supply chain.
  • Partner with suppliers who guarantee safe and healthy working conditions and provide, at a minimum, a living wage compliant with local applicable laws.
  • Promote a harassment-free workplace and prohibit all forms of unlawful discrimination.
  • Uphold the principles of the International Labour Organization and the UN Universal Declaration of Human Rights.

c. Ethical Marketplace and Governance

We are committed to maintaining a culture of absolute integrity. We have a zero-tolerance policy for bribery and corruption and expect our suppliers to demonstrate the highest ethical standards. This includes:

  • Complying with all applicable international and domestic laws regarding ethical business practices.
  • Maintaining robust procedures to prevent bribery, corruption, fraud, and money laundering.
  • Actively managing and transparently disclosing any actual or potential conflicts of interest.
  • Competing fairly and honestly in compliance with all antitrust and competition laws.
  • Safeguarding all personal and confidential data in accordance with applicable data privacy laws and policies.

d. Supplier Community Impact

We recognize that our differences make us stronger and are committed to building strong connections within our communities. We commit to encouraging our suppliers to invest in the social, economic, and educational well-being of the communities in which they operate.

e. Transparency and Accountability

  • Maintain openness in procurement decisions and avoid conflicts of interest.
  • Apply consistent criteria and document procurement decisions for auditability.

Implementation and Responsibilities

Leadership Commitment

Cielo's senior leadership is accountable for the successful implementation and sponsorship of this policy.

Procurement Process

Sustainability criteria are integrated into all stages of our procurement lifecycle, from initial needs assessment and supplier selection to contract management and performance reviews. Prefer suppliers with recognized certifications (e.g. ISO 14001, SA8000, EcoVadis).

Supplier Due Diligence

We will conduct risk-based due diligence on our suppliers. This process will be managed jointly by the Responsible Business & Impact and InfoSec Compliance teams. As part of this process, we leverage recognized third-party sustainability assessment platforms, such as OneTrust, to evaluate and verify our suppliers' alignment with the principles of this policy. The InfoSec Compliance team will facilitate the technical assessment process within these platforms, while the Responsible Business & Impact team will own the review of the results and subsequent supplier engagement.

Supplier Expectations

We will communicate our expectations via our Global Supplier Code of Conduct available at trust.cielotalent.com/item/sustainable-procurement. All suppliers are required to acknowledge and adhere to the Code of Conduct. We will work collaboratively with our partners on a journey of continuous improvement, providing support and clear communication to help them meet our expectations.

Procurement Criteria

When purchasing goods and services from Key Suppliers (assessed according to volume, impact, spend and term of service) the procurement criteria used to evaluate the right supplier for Cielo shall be based on the following:

  • Quality, cost, and value
  • Responsible Business / ESG credentials
  • Risk of adverse human rights or environmental impacts

Monitoring, Reporting, and Continuous Improvement

We believe that what gets measured gets managed. To ensure the effectiveness of this policy, we will:

  • Establish Key Performance Indicators (KPIs): We will track our performance against specific metrics, including:
    • Percentage of key suppliers assessed for sustainability performance using platforms like OneTrust.
    • Measurable reduction in supply chain (Scope 3) greenhouse gas emissions, tracked via platforms like Persefoni.
  • Perform Regular Reviews: This policy and its associated KPIs will be reviewed annually by senior leadership to ensure continued alignment with our strategic goals and to drive continuous improvement.
  • Provide Transparency: We will communicate our progress and challenges to key internal and external stakeholders through our Responsible Business Taskforce and in the Responsible Business section of our annual report.

Grievance and Reporting

Any suspected violation of this policy, our Global Supplier Code of Conduct, available at trust.cielotalent.com/item/sustainable-procurement, or the law must be reported. Cielo provides a confidential Speak Up Line for all stakeholders. The Speak Up Line is 24/7 and available via website or app in multiple languages. Reports can be made anonymously where permitted by law and are addressed promptly. Cielo has a strict non-retaliation policy for any concerns raised in good faith.

Cielo Speak Up Line: cielotalent.speakup.report/speakup

Policy References

This policy should be read in conjunction with other relevant company policies, including but not limited to:

  • Cielo Global Supplier Code of Conduct
  • Cielo Employee Code of Conduct
  • Global Human Rights Policy
  • Global Anti-Bribery & Corruption Policy
  • Global Equal Opportunities Policy
  • Data Protection Policy

Compliance Measurement

The Responsible Business & Impact team, in partnership with the Information Security (InfoSec) Compliance team, will verify compliance with this policy. The InfoSec Compliance team will be responsible for generating reports from business tools, such as OneTrust, to monitor supplier assessments. The Responsible Business & Impact team will be responsible for reviewing these reports, analyzing the findings, and taking appropriate action. Compliance will be verified through methods including but not limited to these reports, internal and external audits, and feedback to the policy owner.

Exceptions

Any deviations from this policy must be reported to the Responsible Business & Impact team or the Privacy Office. Requests for exceptions shall be jointly reviewed by the Responsible Business & Impact team and the InfoSec Compliance team and recorded by members of the Responsible Business Taskforce Committee.

Exception approvals will be processed and logged using Cielo's Risk Management engine or, at a minimum, in the InfoSec exception tracker to ensure a consistent and auditable record.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Continual Improvement

The policy is updated and reviewed as part of the continual improvement process.