Risk Management Policy

1.1 Purpose

This Risk Management Policy explains Tool-O's approach to identifying, assessing, managing and monitoring risks that may affect the Platform, its Users or its operations.

The purpose of this Policy is to support informed decision-making, strengthen organisational resilience and promote the safe, reliable and sustainable operation of the Tool-O marketplace.

1.2 Objectives

This Policy seeks to:

• establish a structured approach to risk management;

• support informed operational decisions;

• protect Users and Platform assets;

• strengthen organisational resilience;

• reduce operational uncertainty;

• encourage continuous improvement;

• comply with applicable legal obligations.

1.3 Scope

This Policy applies to risks associated with:

• Platform operations;

• User Accounts;

• Bookings;

• payments;

• cyber security;

• fraud;

• legal and regulatory compliance;

• technology;

• third-party service providers;

• business continuity;

• reputation;

• all other activities connected with the Platform.

1.4 Guiding Principles

Tool-O administers risk management in accordance with the following principles:

• accountability;

• proportionality;

• transparency;

• continuous improvement;

• resilience;

• informed decision-making.

1.5 Relationship with Other Policies

This Policy should be read together with the:

• Business Continuity Policy;

• Incident Response Policy;

• Security Policy;

• Platform Availability Policy;

• Trust & Safety Policy;

• Marketplace Enforcement Policy;

• Terms of Use;

• all other Platform policies.

1.6 Updates

Tool-O may amend this Risk Management Policy from time to time.

The latest version published on the Platform replaces all previous versions.

2.1 Risk Identification

Tool-O may identify risks through:

• operational monitoring;

• User reports;

• security assessments;

• internal reviews;

• audit activities;

• incident investigations;

• regulatory developments;

• third-party information;

• other appropriate sources.

2.2 Categories of Risk

Risks managed by Tool-O may include:

• operational risks;

• cyber security risks;

• fraud risks;

• financial risks;

• legal and regulatory risks;

• privacy risks;

• technology risks;

• third-party risks;

• reputational risks;

• health and safety risks;

• strategic risks;

• environmental risks.

2.3 Risk Assessment

Tool-O may assess identified risks by considering:

• likelihood;

• potential impact;

• affected Users;

• legal obligations;

• operational consequences;

• financial implications;

• reputational consequences;

• available mitigation measures.

2.4 Risk Mitigation

Where reasonably appropriate, Tool-O may implement measures to reduce identified risks, including:

• operational controls;

• security controls;

• verification procedures;

• monitoring systems;

• staff training where appropriate;

• policy improvements;

• technical safeguards;

• contingency planning.

2.5 Risk Acceptance

Certain risks may be accepted where Tool-O reasonably determines that:

• the risk is low;

• mitigation is disproportionate;

• the remaining risk is acceptable;

• legal obligations are satisfied;

• appropriate monitoring remains in place.

2.6 Monitoring

Tool-O may monitor identified risks through:

• operational reporting;

• security monitoring;

• fraud detection;

• compliance reviews;

• incident reporting;

• User feedback;

• performance indicators;

• other appropriate monitoring activities.

2.7 Emerging Risks

Tool-O may periodically review emerging risks arising from:

• technological developments;

• cyber security threats;

• regulatory changes;

• marketplace developments;

• operational experience;

• changes in User behaviour;

• third-party service providers.

2.8 User Responsibilities

Users contribute to effective risk management by:

• complying with Platform policies;

• reporting suspected issues;

• maintaining Account security;

• providing accurate information;

• cooperating with investigations;

• acting responsibly while using the Platform.

2.9 Integration with Other Policies

Risk management supports the operation of other Platform policies including those relating to:

• security;

• privacy;

• fraud prevention;

• business continuity;

• Trust & Safety;

• incident response;

• Platform availability.

2.10 Commitment to Risk Management

Tool-O seeks to manage risks responsibly through appropriate governance, ongoing monitoring, continuous improvement and proportionate risk mitigation measures that support the long-term security, resilience and sustainability of the Platform.

3.1 Governance

Tool-O may maintain governance arrangements to support the identification, assessment, monitoring and management of risks affecting the Platform.

Risk management responsibilities may be allocated to appropriate personnel, service providers or authorised representatives based on operational requirements.

3.2 Risk Reviews

Tool-O may periodically review identified risks to determine whether:

• existing controls remain effective;

• new risks have emerged;

• mitigation measures require improvement;

• operational changes have introduced additional risks;

• legal or regulatory developments require further action.

3.3 Incident Integration

Information arising from:

• security incidents;

• fraud investigations;

• User complaints;

• Platform outages;

• data breaches;

• operational failures;

• other significant events,

may be considered as part of Tool-O's ongoing risk management activities.

3.4 Third-Party Risk

Tool-O may assess risks associated with third-party providers by considering:

• operational reliability;

• information security;

• legal compliance;

• service availability;

• contractual obligations;

• business continuity capabilities.

Where reasonably appropriate, Tool-O may implement measures to reduce third-party risks.

3.5 Regulatory Risk

Tool-O may monitor legal and regulatory developments that may affect:

• Platform operations;

• User obligations;

• payment services;

• privacy;

• cyber security;

• consumer protection;

• taxation;

• other applicable legal requirements.

3.6 Documentation

Tool-O may maintain records relating to risk management including:

• risk assessments;

• mitigation measures;

• monitoring activities;

• incident reviews;

• governance decisions;

• corrective actions;

• other relevant records.

Records may be retained in accordance with the Data Retention Policy and applicable laws.

3.7 Escalation

Where a significant risk is identified, Tool-O may take appropriate action including:

• implementing additional controls;

• restricting affected activities;

• initiating incident response procedures;

• activating business continuity arrangements;

• engaging relevant service providers;

• complying with legal or regulatory obligations.

3.8 Continuous Improvement

Tool-O may periodically review and improve its risk management framework through:

• operational experience;

• internal reviews;

• lessons learned from incidents;

• technological developments;

• User feedback;

• evolving industry practices.

3.9 User Cooperation

Users are encouraged to support effective risk management by:

• complying with Platform policies;

• promptly reporting significant issues;

• providing accurate information;

• cooperating with reasonable investigations;

• protecting their Account credentials;

• acting responsibly while using the Platform.

3.10 Responsible Risk Management

Tool-O seeks to manage risks in a structured, proportionate and proactive manner while supporting the safety of Users, maintaining Platform integrity and promoting the long-term resilience and sustainability of the Tool-O marketplace.

4.1 Governance

Tool-O is responsible for administering this Risk Management Policy and may maintain internal governance frameworks, operational procedures and risk management processes to support the effective identification, assessment and management of risks affecting the Platform.

4.2 Compliance

Tool-O seeks to manage risks in accordance with applicable laws, regulatory requirements and recognised risk management practices where appropriate.

Nothing in this Policy guarantees that all risks can be identified, eliminated or prevented.

4.3 Policy Review

Tool-O may periodically review this Policy to reflect:

• legislative changes;

• regulatory guidance;

• operational experience;

• technological developments;

• emerging risks;

• industry best practices;

• lessons learned from incidents.

4.4 Continuous Improvement

Tool-O may periodically review and improve its risk management framework by:

• strengthening governance arrangements;

• enhancing monitoring processes;

• improving risk assessments;

• updating mitigation measures;

• refining operational controls;

• incorporating lessons learned from reviews and incidents.

4.5 Risk Appetite

Tool-O may determine the level of risk it is prepared to accept in connection with different aspects of Platform operations, having regard to:

• legal obligations;

• User safety;

• operational resilience;

• financial sustainability;

• reputational considerations;

• strategic objectives.

Risk tolerance may vary depending on the nature of the activity and the circumstances involved.

4.6 Relationship with Other Policies

This Risk Management Policy should be read together with the:

• Business Continuity Policy;

• Incident Response Policy;

• Security Policy;

• Platform Availability Policy;

• Trust & Safety Policy;

• Marketplace Enforcement Policy;

• Terms of Use;

• all other Platform policies.

Where there is any inconsistency, the Terms of Use prevail to the extent permitted by applicable law.

4.7 Contact

Questions regarding this Risk Management Policy may be directed to Tool-O using the contact details published on the Platform.

4.8 Policy Updates

Tool-O may amend this Risk Management Policy from time to time.

The latest version published on the Platform replaces all previous versions.

4.9 Commitment

Tool-O is committed to maintaining a structured and proportionate approach to risk management that supports the safety of Users, protects Platform operations and promotes the long-term resilience and sustainability of the Tool-O marketplace.

4.10 Final Statement

Effective risk management is fundamental to maintaining a secure, reliable and trusted marketplace.

By proactively identifying risks, implementing appropriate controls and continually improving its governance practices, Tool-O seeks to minimise uncertainty, strengthen operational resilience and support the ongoing success of the Platform.

END OF RISK MANAGEMENT POLICY