Personal Data Processing Policy

This is a courtesy translation. In case of any discrepancy, the Spanish version prevails.

PURPOSE AND SCOPE OF THE PERSONAL DATA PROCESSING POLICY

RISKTECH (hereinafter the “Company”), in order to strictly comply with the regulations in force on the protection of Personal Data, as set forth in Law 1266 of 2008, Law 1581 of 2012, Decree 1074 of 2015 and any other provisions that amend, add to or supplement them, hereby presents its Processing Policy on the Protection of Personal Data (hereinafter the “Policy”) for PERSONAL DATA PROCESSING, which sets out general provisions for the protection of information related to, or that may be associated with, one or more identified or identifiable natural persons (the “Personal Data”), by virtue of the prior authorization granted by the Data Subjects.

This Policy shall apply to all Processing carried out in the territory of the Republic of Colombia by RISKTECH and, where applicable, by those third parties with whom all or part of any activity relating to, or connected with, the Processing of Personal Data is agreed.

In this Personal Data Processing Policy, RISKTECH sets out the general corporate guidelines it observes in order to protect the Personal Data of Data Subjects, the purposes of the Processing of information, the rights of Data Subjects, the area responsible for handling complaints and claims, and the procedures that must be followed to access, update, rectify and delete the information.

RISKTECH, in compliance with the constitutional right of habeas data enshrined in Article 15 of the Political Constitution, only collects and Processes Personal Data when this has been previously authorized by the Data Subject, implementing for this purpose clear measures regarding the confidentiality and privacy of Personal Data. In cases where an Authorization for the Processing of Personal Data is not required, the Company shall also implement the measures necessary to Process the information in accordance with the provisions in force.

DEFINITIONS

For the purposes of this Policy, the definitions set forth in Law 1581 of 2012 and Decree 1074 of 2015 shall apply, as transcribed below:

a) Personal Data: Any information linked or that may be associated with one or more identified or identifiable natural persons.

b) Data Subject: Natural person whose Personal Data are subject to Processing.

c) Sensitive Data: Data that affect the privacy of the Data Subject or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social or human rights organizations, or that promote the interests of any political party, or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data.

d) Processor: The natural or legal person, public or private, who, alone or in association with others, carries out the Processing of Personal Data on behalf of the Controller.

e) Personal Data Processing Policy: Refers to this document.

f) National Registry of Databases (Registro Nacional de Bases de Datos): means the public directory of databases subject to Processing, operated by the Superintendencia de Industria y Comercio (SIC).

g) Controller: The natural or legal person, public or private, who, alone or in association with others, makes decisions about the Database and/or the Processing of Personal Data. In this case, it is RISKTECH.

h) Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion, as well as their Transfer and/or Transmission to third parties through communications, queries, interconnections, assignments and data messages.

i) Transfer: A Transfer of Personal Data takes place when the Controller and/or Processor of Personal Data, located in Colombia, sends the Personal Data to a recipient who is in turn a Controller and is located inside or outside the country.

j) Transmission: Processing of Personal Data that involves communicating them to a third party inside or outside the territory of the Republic of Colombia, when the purpose of such communication is for the Processor to carry out Processing in the name and on behalf of the Controller, in order to fulfill the latter's purposes.

PRINCIPLES

In accordance with Article 4 of Law 1581 of 2012, the principles governing RISKTECH's Processing of Personal Data are:

a) Principle of legality in the Processing of Personal Data: The Processing of Personal Data is a regulated activity that must comply with the provisions of Law 1581 of 2012 and Decree 1074 of 2015 and any other provisions that implement, add to or amend them.

b) Principle of purpose: Processing must serve a legitimate purpose in accordance with the Constitution and the Law, which must be communicated to the Data Subject.

c) Principle of freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal Data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives consent.

d) Principle of accuracy or quality: Information subject to Processing must be truthful, complete, accurate, up to date, verifiable and understandable. The Processing of partial, incomplete, fragmented or misleading data is prohibited.

e) Principle of transparency: Processing must guarantee the Data Subject's right to obtain from the Controller or the Processor, at any time and without restrictions, information about the existence of data concerning them.

f) Principle of restricted access and circulation: Processing is subject to the limits arising from the nature of the Personal Data. Accordingly, Processing may only be carried out by persons authorized by the Data Subject and/or by the persons provided for in Law 1581 of 2012.

g) Principle of security: Information subject to Processing by the Controller or Processor must be handled with the technical, human and administrative measures necessary to ensure the security of the records, preventing their tampering, loss, consultation, use or unauthorized or fraudulent access.

h) Principle of confidentiality: All persons involved in the Processing of Personal Data that are not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks involved in the Processing has ended, and may only supply or communicate Personal Data when this corresponds to the performance of the activities authorized in Law 1581 of 2012 and under the terms thereof.

PURPOSES OF THE PROCESSING OF INFORMATION

The Personal Data collected by RISKTECH are included in a Database to which authorized RISKTECH personnel have access in the performance of their duties, it being understood that in no case is the Processing of the information authorized for purposes other than those described herein and communicated directly to the Data Subject no later than at the time of collection.

The purposes for the collection and Processing of the Personal Data of RISKTECH's customers and prospective customers shall be the following:

Carrying out the contract management process for the products or services with RISKTECH's suppliers that it requires to carry out its activities in accordance with the regulations in force.
Supervising and monitoring the correct and proper performance of our contractual relationship.
Managing the administrative, accounting, financial, operational and logistical aspects associated with the fulfillment of both parties' obligations.
Administrative and tax procedures and formalities.
Billing activities and the operations aimed at making them effective.
Economic and accounting management.
Record of business relationships.
Verification of legal, technical and financial requirements.
Tax and collection activities.
Opinion surveys.
Verifying commercial and reputational background, as well as any relationship risks associated with Money Laundering and Terrorist Financing.
Any others intended to develop the business relationship between RISKTECH and the Supplier that are inherent to the nature of this type of relationship, without prejudice to the right, under Law 1581 of 2012, to request, modify, delete and/or correct the information reported as the data subject of the personal data provided.

The purposes for the collection and Processing of the Personal Data of visitors, authorized personnel and authorized contractors shall be the following:

Having the necessary information in the event of an emergency inside the Company's premises.
Protecting the security of RISKTECH's premises.
Identifying and keeping a log of the entry and exit of equipment, vehicles, visitors, authorized personnel, authorized contractors or natural persons, and carrying out other physical security activities.

The purposes for the collection and Processing of the Personal Data of the Company's employees, as well as its contractors, shall be the following:

Hiring, performance of duties or provision of services, and departure or termination, depending on the type of contractual relationship established with RISKTECH (including, among others, employees, former employees, customers, interns and job applicants).
Conducting audits and administering our systems and databases.
Contacting Data Subjects to send information related to the contractual and obligational relationship with employees.
Accessing, storing and processing all the information provided by Data Subjects in one or more databases, in the format deemed most appropriate.
Fulfilling the obligations undertaken in its capacity as Controller toward the Data Subject, in relation to the payment of salaries, social benefits and other remuneration provided for in the employment contract or as provided by law and the contract.
Developing the Occupational Health and Safety Management System based on medical and occupational health information from the time of hiring, as well as during the performance and completion of the assigned activities.
Developing education, training and coaching programs according to the employee's position.
Performing the contracts entered into with the data subjects.
Managing, maintaining, developing and controlling the existing contractual relationship between the parties, responding to their requests for information, as well as handling their claims and processing their requests for termination of the contract and for revocation of the authorization for the processing of personal data.
Handling inquiries made by data subjects.
Managing information associated with the possible occurrence of acts or circumstances that require ethical or disciplinary control procedures in accordance with the applicable internal regulations and other applicable legal provisions.
Making backup copies and files of the information on the equipment provided by RISKTECH.
Sorting, cataloging, classifying, dividing or separating the information provided by data subjects.
Offering corporate wellness programs and planning company activities for the data subject and their beneficiaries.
Meeting legal requirements and requests for information from the administrative, social security and judicial authorities that regulate, supervise or oversee RISKTECH's activities and operations, subject to due process.
Complying with the Internal Work Regulations, as well as RISKTECH's internal policies.
Verifying the information contained in the résumé submitted to RISKTECH.
Preventing fraud or the improper use of our services.
Enabling the creation of cases or users in RISKTECH's information systems, associated with the hiring of employees, as well as for the performance of strategic, administrative, commercial and accounting functions.
Recording information about the family members of the Company's employees in order to fulfill the duties established by Law, as well as to include them in the wellness activities or benefits provided by the Company.
Controlling access to the Company's premises.
Collecting data to fulfill the duties that correspond to the Company as Controller of the information and personal data.
Meeting legal obligations, such as those related to the prevention of money laundering and terrorist financing.
Verifying, corroborating, checking, validating, investigating or comparing the information provided by data subjects with any information legitimately available to it.

The information provided by the Data Subject shall only be used for the purposes set forth herein. Once the need for the Processing of the Personal Data ceases, such data shall be deleted from RISKTECH's databases.

RIGHTS OF DATA SUBJECTS

To access, update and rectify their personal data vis-à-vis RISKTECH as Controller and Processor. This right may be exercised, among others, in relation to partial, inaccurate, incomplete, fragmented or misleading data, or data whose Processing is expressly prohibited or has not been authorized.
To request proof of the authorization granted to RISKTECH as Controller and Processor, except where it is expressly exempted as a requirement for Processing, in accordance with Article 10 of Law 1581 of 2012.
To be informed by RISKTECH as Controller and Processor of personal data, upon request, of the use RISKTECH has made of the Data Subject's personal data.
To file complaints with the Superintendencia de Industria y Comercio (SIC) for violations of Law 1581 of 2012 and any other regulations that amend, add to or supplement it.
To revoke the authorization and request the deletion of personal data when the Processing does not respect constitutional and legal principles, rights and guarantees. Revocation and deletion shall proceed when the Superintendencia de Industria y Comercio has determined that, in the Processing, the Controller or Processor has engaged in conduct contrary to Law 1581 of 2012 and the Constitution.
The data subject may always request the sender of commercial or advertising messages to stop sending them that type of information.
To access, free of charge, their personal data that have been subject to Processing. Data subjects may at any time request the deletion of their personal data and/or revoke the authorization granted for their Processing, through the following channels:

RISKTECH office	Carrera 13A # 34-72, office 212, Monday to Friday (8:00 AM to 4:00 PM)
Contact Center	(601) 745 6006
Email	protecciondedatospersonales@risktech.com.co

In accordance with Article 2.2.2.25.4.1 of Decree 1074 of 2015, the aforementioned Rights may be exercised by:

The Data Subject, who must sufficiently prove their identity through the various means made available by the controller.
Their successors in title, who must prove such status.
The representative and/or attorney-in-fact of the Data Subject, upon proof of the representation or power of attorney.

DUTIES OF THE PERSONAL DATA CONTROLLER

In accordance with Article 17 of Law 1581 of 2012, the Controller shall have the following duties:

a) To guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data;

b) To request and keep a copy of the respective authorization granted by the Data Subject;

c) To duly inform the Data Subject about the purpose of the collection and the rights they have by virtue of the authorization granted;

d) To keep the information under the security conditions necessary to prevent its tampering, loss, consultation, use or unauthorized or fraudulent access;

e) To ensure that the information provided to the Processor is truthful, complete, accurate, up to date, verifiable and understandable;

f) To update the information, promptly notifying the Processor of all changes regarding the data previously provided to it, and to take any other measures necessary to keep the information provided to it up to date;

g) To rectify the information when it is incorrect and to notify the Processor accordingly;

h) To provide the Processor, as the case may be, only with data whose Processing has been previously authorized;

i) To require the Processor at all times to respect the security and privacy conditions of the Data Subject's information;

j) To handle inquiries and claims made under the terms set forth in this Policy;

k) To adopt an internal manual of policies and procedures to ensure proper compliance with Personal Data protection regulations and, in particular, for handling inquiries and claims.

l) To inform the Processor when certain information is being disputed by the Data Subject, once the claim has been filed and the respective procedure has not been completed;

m) To inform the Data Subject, upon request, of the use made of their data;

n) To inform the data protection authority when there are breaches of security codes and risks in the management of Data Subjects' information;

o) To comply with the instructions and requirements issued by the Superintendencia de Industria y Comercio.

AUTHORIZATION, PROCESSING AND STORAGE OF PERSONAL DATA

As of the effective date of this Policy, RISKTECH, at the time of collecting Personal Data, shall request prior authorization from the Data Subjects, informing them of the specific purposes of the Processing for which such consent is obtained, unless one of the exceptions set forth in Article 10 of Law 1581 of 2012 applies.

RISKTECH shall Process the Personal Data that the Data Subject voluntarily provides. In general, the Company shall collect, store, use, circulate, transmit and transfer the Personal Data it Processes. This information may only be used by RISKTECH, its employees, consultants, advisors, affiliates of the business group and commercial and strategic partners expressly authorized by the Company who require access to this information. In any case, RISKTECH, upon request of the Data Subject, shall provide the complete information on the authorized persons and/or third parties that Process their Personal Data.

RISKTECH shall keep proof of such authorizations appropriately, respecting the principles of confidentiality and privacy of the information.

DATA PROTECTION

In accordance with Law 1581 of 2012 (Personal Data Protection Law), partially regulated by Decree 1377 of 2013, which seek to develop the constitutional right of all persons to know, update and rectify the information that has been collected about them, we hereby inform you that, prior to the issuance of Decree 1377 of 2013, and for the purpose of maintaining ongoing communication, personal data were collected from stakeholder groups identified as strategic allies, shareholders, employees, customers, customers' users, suppliers and related parties, which are held in RISKTECH's databases and physical files.

The data we currently hold are stored in our own magnetic and physical files, safeguarded through the use of information security tools, such as access control and backup procedures and protocols, among others, in order to prevent and control unauthorized access to the stored personal data.

By means of this notice, we inform you that your data are used for the purposes inherent to our corporate purpose and that we are responsible for their handling and processing; therefore, in all cases, we always request authorization to keep and continue processing them in order to continue our relationships and keep you informed of our changes and services.

We inform you that, if your data were collected before Law 1581 of 2012 came into force, a notice was published so that you could deny or withdraw authorization for the processing of such data, dated July 22, 2013, which remained published for 3 months until October 22, 2012, based on Article 10 of Decree 1377 of 2013, in compliance with the law.

In view of the above, and in line with our interest in protecting your privacy, we inform you that data subjects once again have the opportunity to authorize or not authorize whether we continue processing their personal data, and that they may at any time exercise their rights to access, update, rectify or request the deletion of their personal data by sending their communication to protecciondedatospersonales@risktech.com.co, stating whether or not they authorize the processing of their data.

PERSONAL DATA PROTECTION POLICY: INITIAL CONSIDERATION

RISKTECH's information collection processes are carried out on open data and public information, directly from the official and public source of information.

RESTRICTIONS ON USE OF THE SERVICE

It is prohibited to use RISKTECH's services to infringe the rights of third parties in accordance with Law 1273 of 2009, Law 1581 of 2012, Decrees 1377 of 2013 and 886 of 2014, and any other regulations that amend or supplement them. The use of the services for unlawful purposes is prohibited.

The availability of the information subject to the referral depends entirely on the information providers. RISKTECH strives to provide the user/customer with the best accessibility and response when using the service, without guaranteeing or assuming responsibility for the availability of the information. The information subject to the referral will be available as long as the information provider publishes it in accordance with constitutional and legal guidelines. The execution of the service and the information obtained are provided to users/customers as permitted by the corresponding sources. RISKTECH does not guarantee that it is error-free.

DATA OF MINORS

RISKTECH has no commercial and/or contractual relationships with minors; therefore, it does not process data of minors.

INFORMATION FOR USERS

Users and/or customers acknowledge that the execution of the RISKTECH service entails risks intrinsic to technology, which are assumed upon acceptance of these terms and conditions. Notwithstanding the foregoing, RISKTECH makes its best efforts to minimize the presence of such risks, without guaranteeing their elimination in the execution of the service.

INDEMNIFICATION OF RISKTECH S.A.S.

Users and/or customers agree to hold RISKTECH harmless from any possible claim, lawsuit, fine, penalty, sanction, indemnification and/or compensation. Improper processing of the information shall be the sole responsibility of the users/customers. The indemnification owed by users/customers includes any court costs and/or legal fees incurred. In any event in which an act or omission by RISKTECH contrary to these terms and conditions is proven, and which results in indemnification to users/customers, such indemnification shall only be made up to a maximum of the amount paid by the user/customer for contracting RISKTECH services.

REGULATORY PROVISIONS

In accordance with the Colombian legal framework for personal data protection, specifically Statutory Law 1581 of 2012 and regulatory Decrees 1377 of 2013 and 886 of 2014, RISKTECH communicates its personal data processing policies, in accordance with the provisions enacted on the subject: Article 15 of the Political Constitution of Colombia protects the rights to privacy, good name and habeas data. From this constitutional provision derive the other regulations governing data protection in Colombia. Statutory Law 1581 of October 17, 2012 establishes the minimum conditions for the lawful processing of data subjects' personal data. In addition, it sets out the principles under which information must be managed, imposing clear obligations on organizations. Law 1581 was regulated by Decrees 1377 of 2013 and 886 of 2014, which defined specific aspects regarding the collection of personal data, the content of the privacy policy and the National Registry of Databases, among other matters. In accordance with the above, RISKTECH shares its processing policies with all personal data subjects, in compliance with Article 13 of Decree 1377 of 2013:

SCOPE OF THE POLICY

This information processing policy is the result of the strategies and commitment within the framework of RISKTECH's administrative, operational, commercial, accounting, financial and customer service management.

PROCEDURES THE DATA SUBJECT MUST FOLLOW TO EXERCISE THEIR RIGHTS OVER PERSONAL DATA

The Data Subject may exercise their rights over the Personal Data provided through the customer service area designated within the Company to handle petitions, inquiries and claims regarding Personal Data. The Data Subject may exercise the rights listed above as set out below:

At the RISKTECH office	Carrera 13A # 34-72, office 212, Monday to Friday (8:00 AM to 4:00 PM)
Contact Center	(601) 745 6006
Email	protecciondedatospersonales@risktech.com.co
WhatsApp	+57 313 3095410

STRUCTURE FOR HANDLING DATA SUBJECTS' REQUESTS

Data Subjects or their successors in title who consider that the information contained in a database of this organization should be subject to inquiry, correction, updating or deletion, or who notice an alleged breach of any of the duties set forth in Law 1581 of 2012, may file a claim with RISKTECH through any of the communication channels described above, which must contain the following information:

Name and identification of the Data Subject.
A precise and complete description of the facts giving rise to the claim.
The physical or email address to which the response should be sent and updates on the status of the procedure provided.
The documents and other evidence to be relied upon.

PROCEDURE FOR SUBMITTING INQUIRIES (REQUESTING PROOF OF AUTHORIZATION, LEARNING WHICH DATA HAVE BEEN COLLECTED AND HOW THEY HAVE BEEN PROCESSED)

The Data Subject, their successors in title, representatives and/or attorneys-in-fact may submit inquiries about the Personal Data held in RISKTECH's Databases, in accordance with the following rules:

a) The request will be reviewed to verify the identity of the Data Subject. If the request is made by a person other than the Data Subject and it is not proven that such person is acting on the Data Subject's behalf in accordance with the laws in force, the request will be rejected.

b) All Inquiries will be answered within a maximum period of ten (10) business days from the date of receipt. When it is not possible to answer the inquiry within that period, the interested party will be informed, stating the reasons for the delay and indicating the date on which the inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first period.

PROCEDURE FOR FILING CLAIMS FOR THE UPDATING, CORRECTION OR DELETION OF DATA, OR REVOCATION OF THE AUTHORIZATION

The Data Subject, or their successors in title, who consider that the information contained in RISKTECH's Databases should be corrected, updated or deleted, or who notice an alleged breach of any of the duties, may file a claim in accordance with the following rules:

b) The claim must contain the following information: (i) The identification of the Data Subject; (ii) Contact details (physical and/or email address and contact telephone numbers); (iii) The documents proving the identity of the Data Subject, or the representation; (iv) A clear and precise description of the Personal Data with respect to which the Data Subject seeks to exercise any of the rights; (v) A description of the facts giving rise to the claim; (vi) The documents to be relied upon; (vii) Signature and identification number.

c) If the claim is incomplete, RISKTECH will ask the interested party, within five (5) days following receipt of the claim, to correct the deficiencies. If two (2) months elapse from the date of the request without the claimant submitting the required information, the claim will be deemed withdrawn.

d) If the area that receives the claim is not competent to resolve it, it will forward it to the appropriate party within a maximum of two (2) business days and will inform the interested party of the situation.

e) Once the complete claim has been received, a note reading “claim in process” and the reason for it will be added to the database within no more than two (2) business days. Such note must remain until the claim is decided.

f) The maximum period to address the claim will be fifteen (15) business days from the day following the date of its receipt. When it is not possible to address the claim within that period, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first period.

g) The Data Subject has the right, at all times, to request the deletion of their Personal Data. Deletion involves the total or partial removal of the Personal Data from the Databases, as requested by the Data Subject. The right to deletion is not absolute, and RISKTECH may deny its exercise in the following events: (i) The Data Subject has a legal or contractual duty to remain in the Database, or the Controller has a legal or contractual obligation that requires it to keep the Personal Data; (ii) The deletion of the Personal Data would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions; (iii) The Personal Data are necessary to protect the legally protected interests of the Data Subject, to carry out an action in the public interest, or to fulfill an obligation legally acquired by the Data Subject or the Controller.

If RISKTECH is not competent to resolve the request submitted, it will forward it to the appropriate party within a maximum of two (2) business days and will inform the interested party of the situation.

If the inquiry, claim, request, correction, update or revocation regarding personal data is incomplete, RISKTECH will ask the interested party, within five (5) days following its receipt, to correct the deficiencies. If two (2) months elapse from the date of the request without the petitioner submitting the requested information, it will be deemed withdrawn.

NOTICE OF THE POLICY

RISKTECH makes this information processing policy available to all its data subjects by displaying it in the terms and conditions of use of the services and products and of access to the information.

RELATIONSHIPS WITH THIRD PARTIES

Where third parties provide services to RISKTECH that are directly or indirectly related to the processing of personal data, they must comply with this personal information processing policy and must state under oath that they will comply with the guidelines established in Law 1581 of 2012 and other implementing regulations, guaranteeing respect for the human dignity of the data subjects. Without prejudice to the foregoing, the contractual relationships with each of the third parties will establish the obligations that will govern the provision of the service.

EFFECTIVE DATE OF THE INFORMATION PROCESSING POLICY AND RETENTION PERIOD OF RISKTECH S.A.S. DATABASES

To be published and complied with.

This policy is effective as of February 23, 2023

The Personal Data included in the Databases subject to Processing will remain and be processed based on the criterion of temporality for the contractual term of the product or service, for the period during which the purpose for which they were collected continues to exist, plus the term established by law.

This Policy may be amended by RISKTECH when required without prior notice, provided that the amendments are not substantial. Only amendments regarding the purposes of the Processing and the Controller's details, or any other substantial amendment, will be communicated in advance to the Data Subjects.