Privacy and Personal Data Processing Policy

Overview

This document sets out the personal data processing policies of KSoft S.A.S., identified by tax ID (NIT) 900.364.630-7 (the Company). It describes how the Company manages personal and business data collected in its databases, in accordance with Colombian Law 1581 of 2012 and Decree 1377 of 2013, so data subjects can exercise their habeas data rights.

Data controller

KSoft S.A.S. is a private legal entity domiciled in Bogotá, incorporated by a private document of the shareholders' meeting dated June 19, 2010, and registered on January 21, 2010, under number 01392732 in Book IX. Its contact details are:

Definitions and principles

• Authorization: the data subject's prior, express and informed consent to the processing of personal data.
• Database: an organized set of personal data subject to processing.
• Personal data: information linked to, or that can be associated with, one or more identified or identifiable natural persons.
• Processor: a natural or legal person, public or private, that processes personal data on KSoft's behalf, alone or jointly with others.
• Controller: a natural or legal person, public or private, that decides on the database and/or the processing of data.
• Data subject: the natural person whose personal data is processed.
• Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
• Lawfulness: data processing is a regulated activity and must comply with the law and its implementing provisions.
• Purpose limitation: processing must serve a legitimate purpose under the Constitution and the law, which must be disclosed to the data subject.
• Freedom: processing requires the data subject's prior, express and informed consent, unless a legal exception or court order applies.
• Accuracy or quality: information must be truthful, complete, accurate, up to date, verifiable and understandable. Partial, incomplete, fragmented or misleading data must not be processed.
• Transparency: data subjects may obtain information from KSoft or its processor, at any time and without restriction, about the existence of data concerning them.
• Restricted access and circulation: processing is subject to legal and constitutional limits. Data may only be processed by persons authorized by the data subject or by law. Non-public data will not be made available on the Internet or other mass media unless access can be controlled and restricted to data subjects or other legally authorized parties.
• Security: KSoft applies the technical, human and administrative measures needed to protect records against alteration, loss, consultation, use or unauthorized or fraudulent access. Privacy matters may be sent to privacidad@ksoftonline.com.
• Confidentiality: anyone involved in processing non-public data must keep it confidential, including after their relationship with the processing activities ends. Data may only be supplied or disclosed for activities authorized by law and this policy.

Database contents

KSoft S.A.S. databases may store general information such as full name, identification number and type, gender and contact details (email, physical address, landline and mobile phone). Depending on the nature of each database, they may also include specific data needed for the relevant processing purpose.

Employee and contractor databases additionally include employment and academic history, as well as sensitive data required by the nature of the employment relationship. Sensitive information may be stored with the data subject's prior authorization, in accordance with Articles 5 and 7 of Law 1581 of 2012.

Processing activities

Information in the Company's databases may be collected, exchanged, updated, processed, reproduced, compiled, stored, used, systematized and organized, in whole or in part, for the purposes set out in this policy.

Information may be provided, transmitted or transferred to public entities, business partners, contractors, affiliates and subsidiaries solely to fulfill the purposes of the relevant database. Where required, these activities are subject to commitments to protect confidentiality. The source policy states that personal or business information, including sensitive information, may be transferred, transmitted or provided to third countries regardless of the level of security of the rules governing personal information there.

To comply with legal duties, KSoft S.A.S. may provide personal information to judicial or administrative authorities. The Company will safeguard the proper use of minors' personal data, compliance with applicable legal requirements and the protection of their best interests.

Cookies and analytics technologies

With your consent, this site uses Google Analytics 4 and Microsoft Clarity to understand how visitors use the site and improve its content and functionality. These tools may process technical and interaction information, such as pages visited, browser and device details, and actions taken during a visit.

Analytics scripts are loaded only if you accept this category. If you reject it, you can continue browsing normally and those scripts are not loaded. Your choice is saved in your browser's local storage so it can be remembered; you can change it at any time using “Cookie settings” in the footer.

After consent, the providers may use analytics cookies or identifiers. The actual names and duration depend on each service's configuration.

Purposes

Information collected is intended to support the proper development of KSoft S.A.S.'s corporate purpose, which includes:

1. Advisory and consulting services for organizations' administration, operations and procedures.
2. Information management and information technology.
3. IT consulting and computer-facility management activities.
4. Monitoring infrastructure and information systems.
5. Infrastructure administration.
6. Virtualization of application and server workloads.
7. Software design and implementation.
8. Development guidelines and leadership.
9. Information systems integration.
10. Business process management.

KSoft S.A.S. also retains information needed to:

1. Fulfill legal obligations.
2. Fulfill contractual obligations.
3. Conduct negotiation processes.
4. Conduct statistical processes.
5. Offer products and services in general.

Information about current or former customers, suppliers, partners and employees is retained to facilitate, promote, enable or maintain employment, civil and commercial relationships.

Data subject rights

Under Article 8 of Law 1581 of 2012, data subjects may:

1. Know, update and rectify their personal data before KSoft S.A.S. or its processors, including partial, inaccurate, incomplete, fragmented or misleading data, data whose processing is expressly prohibited, or data processed without authorization.
2. Request proof of the authorization given, unless authorization is not required for the processing under Article 10 of the law.
3. Ask KSoft S.A.S. or its processor how their personal data has been used.
4. Submit complaints to the Superintendence of Industry and Commerce for violations of the law and any rules that amend, supplement or complement it.
5. Revoke authorization or request deletion when processing fails to respect constitutional or legal principles, rights and guarantees. Under the source policy, revocation or deletion applies when the Superintendence of Industry and Commerce has determined that KSoft S.A.S. or its processor acted contrary to the law and the Constitution.
6. Access their personal or business data that has been processed free of charge.

KSoft S.A.S. obligations

The Company shall:

1. Guarantee the data subject's full and effective exercise of habeas data rights at all times.
2. Request and retain a copy of the data subject's authorization under the conditions established by law.
3. Inform the data subject of the purpose of collection and the rights granted by the authorization.
4. Keep information under security conditions that prevent alteration, loss, consultation, use or unauthorized or fraudulent access.
5. Ensure information supplied to a processor is truthful, complete, accurate, up to date, verifiable and understandable.
6. Update information and promptly notify the processor of changes so it remains current.
7. Correct inaccurate information and notify the processor.
8. Provide the processor only with data whose processing has been previously authorized, where applicable.
9. Require the processor to respect the security and privacy conditions applicable to the data subject's information.
10. Handle inquiries and complaints within the terms established by law.
11. Adopt an internal policy and procedures manual to ensure compliance with the law and address inquiries and complaints.
12. Notify the processor when a data subject has filed a complaint and the information is disputed, until the matter is resolved.
13. Inform the data subject, upon request, how their data has been used.
14. Notify the data protection authority of security-code violations that create risks in the management of data subjects' information.
15. Comply with instructions and requirements issued by the Superintendence of Industry and Commerce.

Inquiries and complaints

Requests, complaints or claims concerning personal data processing may be sent to:

The source policy sets a maximum of fifteen (15) business days to respond to a complaint, counted from the day following receipt. If it cannot be addressed within that period, the interested party will be informed of the reason for the delay and the response date, which may not exceed eight (8) business days after the initial period expires.

Procedural prerequisite: a data subject or successor in title may file a complaint with the Superintendence of Industry and Commerce after completing the inquiry or complaint process with KSoft. The source document also names privacidad@ksoftonline.com for this process.

Validity and retention

According to the source document, these personal information processing policies have been in force since November 30, 2014. KSoft S.A.S. reserves the right to amend them within the terms and limits established by law.

The Company will retain its databases while it carries out its corporate purpose and as long as needed to meet legal obligations, particularly employment and accounting obligations. Data may be deleted at the data subject's request, provided this does not conflict with a legal obligation of KSoft S.A.S. or an agreement between the Company and the data subject.