Code of Ethics and Business Conduct

This Code brings together the conduct commitments that guide day-to-day work at PRONETSYS S.A.S. (hereinafter, “Pronetsys” or “the company”). It explains what we expect from every person who acts on behalf of the company, how we turn our values into concrete behaviors, and what to do when a question arises or a possible violation becomes known.

Our work gives us access to our customers’ systems, credentials and information. That trust is Pronetsys’s most valuable asset, and it is protected through ethical decisions every day and in every place where we work: the homes from which we work remotely, customer premises, travel and digital channels.

1. Purpose and scope

The purpose of the Code is to guide the decisions of the people associated with Pronetsys, to prevent conduct contrary to the law and to our values, and to provide safe channels for asking questions and reporting concerns.

1.1 Who it applies to

In this document, the term “team members” is used inclusively to refer to all the persons mentioned above, regardless of gender or type of engagement.

1.2 Relationship with other policies

This Code is the general framework of Pronetsys’s corporate governance. It is complemented by the PSEA and Harassment Prevention Policy, the Workplace Conduct Handbook, the Wellbeing and Workload Policy, the Occupational Health and Safety Policy, the Information Security Policy and the Personal Data Processing Policy, as well as by the Internal Work Regulations and individual contracts. If a provision in another policy or in the law is more demanding, the more protective rule applies.

1.3 How to use this Code

No document can anticipate every situation. When facing a difficult decision, ask yourself these questions:

1. Is it legal? If the answer is no or you are not sure, stop and ask.
2. Is it consistent with our values and with this Code? Conduct can be legal and still be wrong.
3. Would I be comfortable if it became known? Consider whether you could calmly explain it to your team lead, the customer or your family.
4. Does it protect the trust of the customer and of my coworkers? If it puts that trust at risk, look for another alternative.
5. Do I have doubts? Consult your team lead, Human Resources or the Ethics and Compliance Officer before acting.

2. Our values as observable conduct

Pronetsys’s values only make sense when they are reflected in behaviors that anyone can recognize.

2.1 General duties of all team members

• Know, comply with and promote this Code and the policies that implement it.
• Comply with Colombian law and, when providing services to customers abroad, the applicable rules of those jurisdictions.
• Participate in ethics and compliance training activities.
• Ask when in doubt and report in good faith any possible violations they become aware of.
• Cooperate with internal reviews and investigations, maintaining due confidentiality.

2.2 Additional duties of those who lead teams

• Set an example of conduct and create an environment in which people feel safe to ask questions and report concerns.
• Address their team’s questions and promptly forward reports to the appropriate channel, without investigating them on their own.
• Prevent any form of retaliation against anyone who asks a question, reports a concern or cooperates with an investigation.

3. Relationship with customers

3.1 Commercial honesty and quality

We offer only the services we are able to deliver with quality. Proposals, quotes and diagnoses must be clear, complete and truthful, without concealing costs, technical limitations or risks. Service conditions are governed by the Support Service Terms, the Warranty Policy and the contracts signed.

3.2 Confidentiality

All information we access in the course of a service belongs to the customer and is confidential, even if it is not marked as such: configurations, network architecture, source code, databases, emails, documents, financial information and personal data. It may be used only to provide the contracted service and may be shared only with those who need to know it for that purpose. The duty of confidentiality continues after the relationship with Pronetsys or with the customer ends.

3.3 Use of customer credentials and access

Customer credentials, keys, certificates, tokens and remote access are a high-risk privilege. Their handling is governed by the following mandatory rules:

1. Prior authorization. A customer’s systems are accessed only when there is documented authorization (contract, service order or ticket) and within the authorized scope.
2. Least privilege. Only the permissions necessary for the task are requested and used, and only for as long as necessary.
3. Secure custody. Credentials are stored only in the secrets management tools approved by the company. Storing them in notes, spreadsheets, on paper, in chats or in emails is prohibited.
4. Personal and non-transferable use. Credentials are not shared and another person’s accounts are not used. Whenever possible, named accounts with traceability will be requested.
5. Transparent remote access. Remote sessions are conducted with the customer’s knowledge and closed when finished, and persistent access tools are not installed without the customer’s express authorization.
6. Need to know. Files, emails, backups or databases that are not essential for the service are not opened, copied, downloaded or reviewed.
7. Closure and revocation. When the service ends, the customer is asked to change or revoke the temporary credentials, and local copies are deleted.
8. Immediate reporting. Any loss, exposure or misuse of a credential is reported immediately to the team lead and in accordance with the Information Security Policy.

3.4 Privacy and personal data

We process the personal data of customers, end users, team members and third parties in accordance with Law 1581 of 2012 and its implementing regulations, and with our Personal Data Processing Policy. When we act as data processors on behalf of a customer (for example, in hosting, backup or chatbot services), we process the data only according to the customer’s instructions. Privacy inquiries should be sent to contactenos@pronetsys.com.co.

3.5 Vulnerabilities and incidents

If, during a service, we detect a vulnerability or a security incident in a customer’s systems, we report it to the customer through the agreed channels, without exploiting it, disclosing it or using it for other purposes. Vulnerabilities in Pronetsys’s own systems are managed in accordance with the Responsible Vulnerability Disclosure Policy.

4. Conflicts of interest

A conflict of interest exists when a personal, family, financial or third-party interest affects, or could appear to affect, the objectivity with which we act on behalf of Pronetsys. Having a conflict is not in itself a violation; concealing it is.

4.1 Common situations

• Providing support, development or networking services on your own account to the company’s customers or prospects.
• Recommending a supplier in which you, your spouse or partner, or a family member has an ownership interest or an employment relationship.
• Participating in the selection, evaluation or supervision of a family member or of a person with whom you have a romantic relationship.
• Holding investments or positions in competing companies, customers or suppliers.
• Using information obtained at work to obtain personal benefits.

4.2 Disclosure and management

1. Disclose. Every team member discloses any potential conflicts in writing upon joining, once a year and whenever a new situation arises, before making any related decision.
2. Abstain. While the case is being reviewed, the person abstains from participating in the decision.
3. Evaluate. The Ethics and Compliance Officer reviews the disclosure and proposes measures: stepping aside from the decision, reassigning the case, establishing additional controls or, if the conflict is permanent and incompatible, recommending its termination.
4. Record. Disclosures and the measures adopted are recorded confidentially.

Conflicts of interest of the Legal Representative are disclosed to the highest corporate body, in accordance with the bylaws and the law.

5. Gifts, hospitality and invitations

Gifts and hospitality can strengthen legitimate business relationships, but they must never influence, or appear to influence, a business decision. We apply these criteria:

If, due to cultural circumstances, it is not possible to decline a gift, it is accepted on behalf of the company and recorded, and Management decides what to do with it.

6. Anti-bribery and anti-corruption

Pronetsys has zero tolerance for bribery and corruption in any of their forms, in both the public and the private sector, in Colombia and abroad.

6.1 Prohibited conduct

• Offering, promising, giving, requesting or accepting, directly or through third parties, money or any benefit to obtain or retain business, a decision or an undue advantage.
• Making facilitation payments, that is, small payments to expedite procedures that are due in any case.
• Offering benefits to a foreign public official in connection with an international business deal or transaction.
• Using intermediaries, suppliers, business partners or consultants to do what the company cannot do directly.
• Making contributions to political campaigns or parties on behalf of the company, or donations and sponsorships that conceal an undue benefit.
• Recording transactions falsely, incompletely or misleadingly in the accounting records, invoices or reports.

6.2 Reference legal framework

If, because of its activity, size or sector, Pronetsys were to become obligated to adopt a Transparency and Business Ethics Program under Law 2195 of 2022 and its implementing regulations, it will adopt one in accordance with the instructions of the competent authority. In the meantime, this Code voluntarily incorporates its principles.

6.3 Due diligence and red flags

Before engaging relevant suppliers, business partners or intermediaries, we verify their identity, reputation and capability. The following are red flags that must be reported: requests for payment in cash or to third-party accounts, disproportionate commissions, insistence on using a specific intermediary without justification, invoices without supporting documentation, or requests for “help” to speed up decisions.

7. Free competition

We compete on the basis of the quality, price and innovation of our services, in accordance with Law 1340 of 2009 and other competition protection regulations. The following are prohibited:

• Agreeing with competitors on prices, rates, margins or commercial terms.
• Allocating customers, territories or markets among competitors, or coordinating bids in tenders, invitations to bid or requests for quotes.
• Exchanging commercially sensitive information with competitors (future prices, costs, strategies, offers).
• Disparaging competitors with false or misleading information.

If a conversation of this kind arises at a trade association meeting or an event, leave, make a record of your departure and inform the Ethics and Compliance Officer.

8. Use of assets, licensed software and intellectual property

8.1 Company assets

Equipment, tools, vehicles, accounts, licenses, repositories, information and working time are used for the company’s purposes, with care and efficiency. Occasional personal use of equipment and connectivity is tolerated only if it is reasonable, does not affect work, does not violate the law and does not compromise security. Assets are returned when the engagement ends.

8.2 Licensed software

• Only software with a valid license, acquired or authorized by the company, is installed and used, both on the company’s own equipment and on customer equipment.
• Installing, distributing or activating unlicensed software, “cracks”, key generators or modified versions is prohibited, even if the customer requests it.
• Open-source software is used in compliance with the terms of its license, especially when it is incorporated into developments for customers.

8.3 Intellectual property

We respect the copyrights, trademarks and trade secrets of third parties, in accordance with Law 23 of 1982 and Andean Decision 351 of 1993. Ownership of software, documentation and other work products is governed by the terms agreed in employment contracts, service agreements and contracts with customers. Code, designs or documentation from one customer are not reused for another without authorization.

9. Responsible use of artificial intelligence

Artificial intelligence (AI) is a valuable tool for our work and for the solutions we deliver, such as chatbots and analytics. We use it with these commitments:

Using AI to impersonate people, produce misleading content, monitor team members without a legal basis or infringe intellectual property rights is prohibited.

10. Human rights, non-discrimination, diversity and inclusion

We respect the dignity of all people and promote a diverse, equitable and inclusive work environment. We do not tolerate discrimination on the basis of sex, gender identity, sexual orientation, ethnic or national origin, skin color, age, disability, physical or mental health condition, religion, political opinion, marital status, pregnancy, family responsibilities or any other protected condition.

• Decisions on hiring, compensation, promotion, training and termination are based on objective, job-related criteria, including equal pay for women and men (Law 1496 of 2011).
• We make reasonable accommodations so that persons with disabilities can access, perform and remain in their jobs (Law 1618 of 2013 and Law 2466 of 2025).
• We reject the acts of discrimination and harassment punished by Law 1482 of 2011 and the discriminatory practices prohibited by the Substantive Labor Code, as amended by Law 2466 of 2025.
• We reject child labor, forced labor and any form of exploitation, and we expect the same from our suppliers.
• All forms of sexual harassment, sexual exploitation or abuse, workplace harassment and violence at work are prevented and addressed in accordance with the PSEA and Harassment Prevention Policy.

11. Relationship with suppliers and business partners

We select suppliers and business partners using objective criteria of quality, price, technical capability, legal compliance, information security and environmental responsibility, in accordance with our Environmental Policy.

• We communicate this Code to them and expect them to act in accordance with its principles when they work with or on behalf of Pronetsys.
• Where applicable, we include in contracts clauses on confidentiality, data protection, information security, anti-bribery and harassment prevention.
• We honor the agreed payments and commitments and treat their personnel with respect.
• Suppliers may report misconduct by company personnel through the Ethics Hotline.

12. Communications, social media and spokespersons

Only the Legal Representative and the persons he or she authorizes speak publicly on behalf of Pronetsys before the media or the authorities, or at events. In your personal use of social media:

• Do not post confidential information about the company or its customers, or photographs or screenshots of systems, customer premises, tickets, virtual meetings or work conversations.
• Do not mention customers or projects without prior written authorization.
• If you identify yourself as a team member, make clear that your opinions are your own.
• Do not post content that is offensive or discriminatory or that could constitute harassment of coworkers, customers or third parties.

Internal communications by chat, email or messaging are governed by the Workplace Conduct Handbook and by the right-to-disconnect rules of the Wellbeing and Workload Policy.

13. Ethics Hotline, inquiries and non-retaliation

Asking questions and reporting concerns is both a duty and a right. Any person, internal or external, may raise questions or report in good faith facts that may be contrary to this Code, to the company’s policies or to the law.

13.1 Available channels

If the report involves any of the people who manage a channel, use another channel. If it involves the Legal Representative, the case is handled through the highest corporate body or through an independent third party appointed for that purpose; if it concerns sexual harassment, the complaint is also filed with the Labor Inspectorate, as provided in the PSEA Policy.

13.2 How we handle reports

1. Receipt and registration. Every report is recorded with a case code.
2. Acknowledgment of receipt. Within the following three (3) business days. In cases of sexual harassment, sexual exploitation or abuse, or violence, within the next business day, in accordance with the PSEA Policy.
3. Preliminary assessment. Within the following five (5) business days (immediately in cases covered by the PSEA Policy), the applicable route is determined (general ethics, PSEA, workplace coexistence, information security, personal data), it is verified that the person investigating has no conflict of interest, and protective measures are adopted if required.
4. Investigation. It is conducted with impartiality, confidentiality and respect for due process, as a general rule within the following thirty (30) business days, which may be extended only once with written justification.
5. Decision and measures. The appropriate corrective, disciplinary or contractual measures are adopted and, if there is evidence of a crime, the authorities are notified.
6. Closure and response. The person who made the report is informed that the case has been closed, to the extent permitted by law and by the protection of the rights of the other persons involved.

13.3 Prohibition of retaliation

Reports made with knowledge of their falsehood and with the intent to cause harm are not protected and will be handled in accordance with the Internal Work Regulations.

14. Non-compliance regime and due process

Non-compliance with this Code may give rise to training, disciplinary or contractual measures, proportionate to the seriousness of the conduct, without prejudice to any applicable civil, criminal or administrative actions.

• Employees: disciplinary sanctions are imposed in accordance with the Internal Work Regulations and the procedure set out in Article 115 of the Substantive Labor Code, as amended by Law 2466 of 2025, guaranteeing due process: written notice of the facts, access to the evidence, an opportunity to present a statement of defense and evidence, a reasoned decision, proportionality of the sanction and the possibility of challenging it. The details are set out in the Workplace Conduct Handbook.
• Contractors, interns and suppliers: the consequences provided for in the contract or agreement apply, which may include its termination.
• Executives and shareholders: the corresponding legal and bylaw provisions apply.

No instruction from a superior justifies conduct contrary to this Code or to the law.

15. Responsibilities, dissemination and updates

Every team member receives this Code during onboarding and states in writing that they are familiar with it and undertake to comply with it. Ethics and compliance training is conducted at least once a year. The Code is reviewed at least once a year and whenever the law, the risks or the company’s operations change. Questions about this document may be sent to lineaetica@pronetsys.com.co.