Personal Data Processing Policy

This Policy sets out the guidelines under which PRONETSYS S.A.S. (hereinafter, “Pronetsys” or the “Company”) collects, stores, uses, circulates, updates and deletes the personal data of its clients, prospects, suppliers, employees, candidates, website visitors, support service users and other persons with whom it interacts, as well as the procedure for data subjects to exercise their fundamental right of habeas data.

This document implements Statutory Law 1581 of 2012 and Decree 1377 of 2013, now compiled in Sole Regulatory Decree 1074 of 2015, and applies both when the Company acts as data controller and, where relevant, when it acts as data processor on behalf of its clients.

1. Identification of the data controller

The data controller of the personal data referred to in this Policy is:

2. Purpose, scope and regulatory framework

This Policy applies to all databases, whether physical or digital, that contain personal data processed by Pronetsys, and is mandatory for its directors, employees and contractors, and for third parties that process personal data on the Company's behalf.

Processing is governed by, among others, the following regulations:

• Political Constitution of Colombia, Articles 15 and 20 (rights to privacy, to good name, to habeas data and to information).
• Statutory Law 1581 of 2012, which issues general provisions for the protection of personal data.
• Decree 1377 of 2013, compiled in Chapter 25 of Title 2 of Part 2 of Book 2 of Decree 1074 of 2015.
• Decree 886 of 2014, compiled in Chapter 26 of the same title of Decree 1074 of 2015 and amended by Decree 090 of 2018, on the National Database Registry.
• Single Circular (Circular Única) of the Superintendence of Industry and Commerce (SIC), Title V, and any other instructions issued by that entity as the personal data protection authority.

3. Definitions

For the interpretation of this Policy, the legal definitions shall be taken into account, the most relevant of which are the following:

Authorization

Prior, express and informed consent of the data subject to carry out the processing of their personal data.

Privacy notice

Verbal or written communication addressed to the data subject informing them of the existence of this Policy, how to access it and the purposes of the processing.

Database

Organized set of personal data that is subject to processing.

Personal data

Any information linked to, or that may be associated with, one or more identified or identifiable natural persons.

Public data

Data that is not semi-private, private or sensitive, such as data relating to marital status, profession or trade, or status as a merchant, and data contained in public records or in final court judgments that are not subject to confidentiality.

Sensitive data

Data that affects the data subject's privacy or whose misuse may lead to discrimination against them, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions or in social or human rights organizations, data relating to health and sex life, and biometric data.

Data processor

Natural or legal person that processes personal data on behalf of the data controller.

Data controller

Natural or legal person that decides on the database and the processing of the data.

Data subject

Natural person whose personal data is subject to processing.

Processing

Any operation on personal data, such as collection, storage, use, circulation or deletion.

Transfer

Sending of personal data by a data controller or processor located in Colombia to a recipient that is, in turn, a data controller and is located inside or outside the country.

Transmission

Communication of personal data inside or outside Colombia for the purpose of having a data processor carry out the processing on behalf of the data controller.

Personal Data Protection Officer

Role designated by the Company to oversee compliance with this Policy and to handle data subjects' inquiries and claims.

4. Processing principles

Pronetsys applies the principles set out in Law 1581 of 2012 in a harmonious and comprehensive manner:

In addition, the Company adopts the principle of demonstrated accountability: it documents its processes, keeps evidence of the authorizations and of the security measures, and can demonstrate to the SIC its compliance with its duties.

5. Processing activities and purposes by group of data subjects

The Company collects only the personal data that is relevant and appropriate for the purposes described below. Pronetsys does not sell, rent or trade personal data.

5.1. Clients

Data processed: name, identity document, job title, company, contact details, billing and payment information, service history, quotations, contracts and communications. For clients that are legal entities, the data of their representatives and contact persons is processed.

• Prepare quotations, and enter into and perform service contracts and contracts for the sale of hardware and software.
• Provide the contracted services, including support, hosting, domains, backup, development, VoIP telephony, networks and other solutions.
• Invoice, collect payments, manage accounts receivable and comply with accounting and tax obligations.
• Manage warranties, requests, complaints and claims.
• Measure satisfaction and improve service quality.
• Send information about updates, maintenance, security alerts and changes to the contracted services.
• Send marketing information about related products and services, when the data subject has authorized it; the data subject may object at any time.

5.2. Prospects and business contacts

Data processed: the data provided in the website contact form (name, email, phone, company, service of interest and message), the data shared via WhatsApp, email or phone, and the data collected at events or business meetings.

• Respond to the request for information, advice or a quotation.
• Contact the data subject through the channels they provided in order to follow up on their request.
• Record the request in the website's database and notify the sales team.
• Send marketing information about products and services, when the data subject has authorized it.

5.3. Suppliers and contractors

Data processed: name or legal name, identity document or NIT, contact details, tax and banking information, data of representatives and contact persons, and the documents required for onboarding.

• Evaluate, select and onboard suppliers.
• Enter into, perform and supervise contracts and purchase orders.
• Make payments and comply with accounting and tax obligations.
• Verify, where applicable, information in public sources and restrictive lists to prevent risks of fraud, corruption, money laundering and terrorist financing.
• Control contractors' access to the Company's systems and to its clients' facilities and systems.

5.4. Employees and former employees

Data processed: identification and contact data, résumé, education, experience, enrollment data for social security and family compensation funds, salary and banking information, data on beneficiaries and family members, performance evaluations and, when necessary, sensitive health data related to occupational health and safety.

• Enter into, perform and terminate the employment contract.
• Calculate and pay salaries, benefits and contributions, and enroll the employee and their beneficiaries in the social security system and in the family compensation fund.
• Comply with the obligations of the Occupational Health and Safety Management System (SG-SST).
• Manage training, wellbeing, evaluation and development.
• Manage user accounts, access and work tools, and apply information security controls.
• Issue employment certificates and respond to requests from authorities.

5.5. Candidates in selection processes

Data processed: résumé, contact details, education, experience, references, test and interview results, and the fitness-for-work opinion from the pre-employment medical examination when the candidate is selected.

• Evaluate the candidate's profile and manage the selection process.
• Verify references and the information provided.
• Retain the résumé for future processes, only when the candidate authorizes it.

5.6. Website visitors

Data processed: technical browsing information (IP address, browser and device type, pages visited, date and time), server security logs and, only if the visitor accepts, analytics data obtained through Google Analytics 4 and Microsoft Clarity cookies.

• Ensure the operation, security and availability of the website, and prevent abusive use.
• Remember the visitor's cookie preferences.
• With the visitor's consent, produce usage statistics, heatmaps and anonymized session recordings to improve the website's content and experience.

Details of the cookies used can be found in the Cookie Policy. The website does not offer user registration or e-commerce.

5.7. Technical support service users

Data processed: name, email, phone, company, job title, description of incidents and requests, attachments, information about the equipment serviced and records of remote or on-site support sessions.

• Log, handle, escalate and close requests and incidents in the support portal https://soporte.pronetsys.com.co.
• Verify the identity of the person requesting support and their authorization to do so on behalf of the client.
• Measure service levels, maintain traceability of support activities and improve support quality.

5.8. Whistleblowers and persons related to the Ethics Hotline

Data processed: category and description of the facts, approximate date, identification of the persons involved and, only if the whistleblower chooses to provide them, their name, email, phone and relationship with the Company. The Ethics Hotline accepts anonymous reports and provides a case code for follow-up.

• Receive, analyze, investigate and resolve reports of alleged conduct contrary to the law or to the Code of Ethics and Conduct.
• Communicate with the whistleblower, when they have provided contact details, and allow the case to be tracked using the assigned code.
• Adopt measures to protect against retaliation, as well as corrective measures.
• Respond to requests from competent authorities, when appropriate.

Ethics Hotline information is confidential and may be accessed only by the persons designated to manage the cases. The Company does not attempt to identify those who report anonymously and does not associate technical browsing logs with the content of the reports.

5.9. Common purposes

For all of the groups above, the data may also be processed to comply with legal obligations and requests from authorities; to address internal and external audits; to exercise or defend the Company's rights in judicial or administrative proceedings; and to maintain the security of information and systems.

5.10. Retention period

Personal data is retained only for the reasonable and necessary time to fulfill the purposes of the processing. Once these have been fulfilled, the data is deleted, unless there is a legal or contractual duty to retain it.

6. Processing of sensitive data

The Company processes sensitive data only when strictly necessary and in the cases permitted by law, for example, employees' health data to comply with occupational health and safety and social security obligations, or sensitive information that a whistleblower includes in an Ethics Hotline report.

When sensitive data is requested, the Company:

• Will inform the data subject that they are not obligated to authorize its processing and that their answers to questions about sensitive data are optional.
• Will explicitly indicate which of the data is sensitive and the purpose of its processing.
• Will obtain the data subject's explicit authorization, except in cases where the law does not require it.
• Will not make any activity conditional on the data subject providing sensitive data.
• Will apply enhanced security and access restriction measures.

Sensitive data that the Company processes as data processor on behalf of its clients, including health sector data, is governed by section 8.

7. Data of children and adolescents

The services and website of Pronetsys are intended for businesses and for persons of legal age. The Company does not intentionally collect data from children or adolescents through the website; if it identifies that it has received such data without the corresponding authorization, it will delete it.

Exceptionally, the Company processes data of minors when they are beneficiaries of its employees, in order to enroll them in social security and in the family compensation fund. In these cases, the processing responds to and respects the best interests of the minors, ensures respect for their fundamental rights and is authorized by their legal representative.

8. The Company as data processor

In providing hosting, cloud backup, technical support, AI chatbot, software development, analytics and ERP and CRM consulting services, the Company may have access to its clients' databases. In these cases, the client is the data controller and Pronetsys acts as data processor; accordingly, the Company:

• Processes the data solely to provide the contracted service and in accordance with the client's documented instructions; it does not use the data for its own purposes.
• Formalizes the relationship through a contract or transmission clauses that define the scope of the processing, the activities for which the Company is responsible and its obligations, under the terms of Decree 1377 of 2013, compiled in Decree 1074 of 2015.
• Limits access to the persons who require it to provide the service, who are subject to confidentiality obligations.
• Applies the security measures agreed with the client and those described in this Policy.
• Engages sub-processors, such as cloud infrastructure, messaging or artificial intelligence service providers necessary for the service, only when the client is aware of them and the sub-processors offer equivalent guarantees.
• Upon termination of the contract, returns or deletes the data according to the client's instructions, unless there is a legal duty to retain it.

8.1. Health sector data

The Company's clients include healthcare service provider institutions (IPS), whose databases may contain sensitive data relating to patients' health. With respect to this information, Pronetsys:

• Does not access the content of medical records or other health data, except when strictly essential to provide the service and with the client's authorization.
• Respects the confidentiality that the special regulations of the health sector impose on medical records, including Law 2015 of 2020 on interoperable electronic medical records.
• In the chatbots it implements, recommends that the client design flows that do not request unnecessary sensitive data and that inform the user about the processing.

8.2. Requests and incidents involving client data

If a data subject submits to the Company an inquiry or claim about data that the Company processes on behalf of a client, Pronetsys will forward it to the responsible client within a maximum of two (2) business days, will inform the data subject accordingly, and will provide the client with the support necessary to respond to it.

If a security incident occurs that affects a client's data, the Company will inform the client without undue delay, with the information available so that the client can fulfill its duty to report to the SIC, and will make the reports that are incumbent upon it as data processor.

9. Rights of data subjects

In accordance with Law 1581 of 2012, data subjects have the right to:

1. Know, update and rectify their personal data, including with respect to data that is partial, inaccurate, incomplete, fragmented or misleading.
2. Request proof of the authorization granted, except when the law does not require it.
3. Be informed, upon request, of the use that has been made of their data.
4. File complaints with the Superintendence of Industry and Commerce for violations of the law, once the inquiry or claim procedure before the Company has been exhausted.
5. Revoke the authorization and request the deletion of their data when the legal principles, rights and guarantees are not respected. Revocation and deletion do not apply when the data subject has a legal or contractual duty to remain in the database.
6. Access their personal data free of charge at least once every calendar month and whenever there are substantial changes to this Policy.

These rights may be exercised by the data subject, upon proof of identity; by their successors in interest, upon proof of such status; by their representative or attorney-in-fact, upon proof of representation; and by anyone acting under a stipulation in favor of another. The rights of children and adolescents are exercised through their legal representatives.

10. Data subject authorization

The Company requests the data subject's authorization no later than at the time of collecting their data, informing them of the purposes of the processing, their rights, the optional nature of answers concerning sensitive data or data of minors, and the channels for contacting the Company.

10.1. Ways to grant authorization

Authorization may be granted by any means that allows it to be consulted later:

• In writing, in physical or electronic forms, contracts or other documents.
• Orally, in calls or meetings that are recorded with the data subject's knowledge.
• Through unequivocal conduct from which it can reasonably be concluded that the data subject granted the authorization, such as checking the acceptance box on a web form. Silence shall in no case be deemed authorization.

10.2. Proof of authorization

The Company keeps proof of the authorizations obtained, for example, the date and time record of form submissions with the acceptance box checked, signed documents or the corresponding recordings.

10.3. Cases in which authorization is not required

Authorization is not required in the case of information requested by a public or administrative entity in the exercise of its legal functions or by court order; data of a public nature; cases of medical or health emergency; processing authorized by law for historical, statistical or scientific purposes; and data related to the Civil Registry of Persons.

10.4. Revocation

The data subject may revoke the authorization at any time, in whole or in part, by filing a claim through the channels indicated in section 11. For example, the data subject may object to receiving marketing information without this affecting the provision of the contracted services.

11. Responsible area and service channels

The Personal Data Protection Officer role is responsible for handling data subjects' inquiries, claims and requests, and for overseeing the implementation of this Policy. This role is designated by the Company's Legal Representative and has the resources necessary to perform its functions.

Requests related to data that the Company processes as data processor are handled as provided in section 8.2.

12. Inquiry procedure

Data subjects or their authorized parties may consult the personal information held in the Company's databases. The procedure is as follows:

1. Submission. The inquiry is sent through any of the channels in section 11, stating the data subject's full name, identity document, the information they wish to consult and the means by which they wish to receive the response.
2. Identity verification. The Company verifies the identity of the requester or the capacity in which they act and, if necessary, requests the corresponding supporting documents.
3. Response. The inquiry is answered within a maximum of ten (10) business days from the date of its receipt.
4. Extension. If it is not possible to respond within that period, the Company will inform the interested party of the reasons for the delay and of the date on which the inquiry will be answered, which may not exceed five (5) business days following the expiration of the first period.

13. Claims procedure

Data subjects or their authorized parties who consider that the information contained in a database should be corrected, updated or deleted, or who notice an alleged breach of the legal duties, may file a claim, which is handled as follows:

1. Submission. The claim is addressed to the Personal Data Protection Officer through the channels in section 11 and includes the identification of the data subject, a description of the facts giving rise to the claim, the address or means for the response, and any documents the claimant wishes to rely on.
2. Correction of deficiencies. If the claim is incomplete, the interested party is asked, within five (5) days following its receipt, to correct the deficiencies. If two (2) months elapse from the date of the request without the requested information being submitted, the claim is deemed to have been withdrawn.
3. Referral. If the Company is not competent to resolve the claim, it will forward it to the appropriate party within a maximum of two (2) business days and will inform the interested party of the situation.
4. “Claim in progress” notation. Once the complete claim has been received, the notation “claim in progress” and the reason for it are entered in the database within no more than two (2) business days, and the notation remains until the claim is decided.
5. Response. The claim is answered within a maximum of fifteen (15) business days from the day following the date of its receipt.
6. Extension. If it is not possible to respond within that period, the Company will inform the interested party of the reasons for the delay and of the date on which the claim will be answered, which may not exceed eight (8) business days following the expiration of the first period.

14. Data transfers and transmissions

To operate its services and its website, the Company relies on technology providers that may process personal data on its behalf, inside or outside Colombia. The main ones are:

Transmissions to data processors are formalized through contracts or terms that require the provider to process the data in accordance with the Company's instructions, to safeguard its security and to maintain confidentiality. International transfers are made to countries that the SIC recognizes as having an adequate level of protection, including the United States of America, or in the other cases provided for in Article 26 of Law 1581 of 2012, such as the express and unequivocal authorization of the data subject.

When a data subject contacts the Company via WhatsApp, the messaging platform processes the information in accordance with its own terms and privacy policies.

The Company may also deliver personal data to public authorities that request it in the exercise of their legal functions or by court order.

15. Security measures

In furtherance of the security principle and of the Information Security Policy, the Company applies, among others, the following measures:

• Access control based on the principle of least privilege, with individual accounts and strong authentication where the tool allows it.
• Encryption of the communications of the website and its forms using HTTPS.
• Periodic backups and recovery procedures.
• Logging and monitoring of security events in the systems.
• Access to the website's administrative portal restricted to authorized personnel.
• Confidentiality agreements with employees and contractors, and data protection training.
• Assessment of the security guarantees of the providers that process data on the Company's behalf.
• A security incident management procedure, which includes reporting to the SIC and notifying the affected data subjects when appropriate.

No security measure is infallible; therefore, the Company periodically reviews its controls and receives vulnerability reports in accordance with its Responsible Vulnerability Disclosure Policy.

16. National Database Registry

The Company will register its databases in the National Database Registry (RNBD) administered by the SIC when it is legally required to do so, in accordance with the current criteria set out in Decree 1074 of 2015, as amended by Decree 090 of 2018, and in the SIC's instructions. In that case, it will keep the registered information up to date within the deadlines established by the authority.

17. Effective date and updates

This Policy is effective as of the publication date indicated in this document and replaces the Privacy Policy previously published on the website. The databases will remain in effect for as long as the purposes described are being fulfilled and during the retention periods indicated in section 5.10.

The Company may amend this Policy to adapt it to regulatory or operational changes. Substantial changes, in particular those relating to the identification of the data controller or to the purposes of the processing, will be communicated to data subjects before they are implemented or, at the latest, at the time of their implementation, through the website or the available contact channels. If the purpose of the processing changes, a new authorization will be requested.

18. Privacy notice