Personal Data Processing Policy

I. Identification of the controller

En Línea Pagos ELP, hereinafter referred to as THE PLATFORM.

II. Address and direction

LA PLATFORMA is domiciled in the city of Medellín, Colombia, where its main headquarters are located.

III. Legal framework

Political Constitution of Colombia; Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013.

IV. Scope of application

This policy shall apply to personal data registered in any LA PLATFORMA database owned by a natural person.

V. Definitions

The following definitions shall be taken into account for the purposes of this policy and in accordance with the regulations in force concerning the protection of personal data:

Authorisation

Prior, express and informed consent of the Owner to carry out the processing of personal data.

Privacy Notice

Oral, electronic or written communication generated by the Data Controller, addressed to the Data Controller for the processing of his or her personal data, informing him or her of the existence of the information processing policies that will apply to him or her, the manner of accessing them and the purposes of the processing that is intended to give to the personal data.

Database

An organised collection of personal data that is processed.

Causahabiente

Person who has succeeded another because of the death of the latter (heir).

Dato personal

Any information linked to or which may be associated with one or more natural persons identified or identifiable.

Public data

It is the data that is not semi-private, private or sensitive. Public data are considered, among others, data relating to the civil status of persons, their profession or occupation and their status as merchant or public servant. By their nature, public data may be contained, inter alia, in public records, public documents, gazettes and official bulletins and duly enforceable judicial decisions that are not subject to reservation.

Sensitive data

Sensitive data are those that affect the privacy of the Owner or whose misuse may lead to discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.

Manager of Treatment

A natural or legal person, public or private, who himself or in association with others, carries out the processing of personal data on behalf of the Data Controller.

Responsible for Treatment

A natural or legal person, public or private, who himself or in association with others, decides on the basis of data and/or the processing of data.

Holder

Natural person whose personal data is subject to processing.

Treatment

Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Transferencia

The transfer of data takes place when the controller and/or controller of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the processing and is within or outside the country.

Transmission

Processing of personal data involving the communication of such data within or outside the territory of the Republic of Colombia when the purpose of the processing is to be carried out by the person in charge on behalf of the person responsible.

VI. Principles

In order to ensure the protection of personal data, THE PLATFORMA shall apply in a harmonious and comprehensive manner the following principles, in the light of which the processing, transfer and transmission of personal data shall be carried out:

Principle of legality in the area of data processing

Data processing is a regulated activity, which must be subject to the existing and applicable legal provisions governing the subject.

Purpose principle

The activity of the processing of personal data carried out by THE PLATFORMA or to which it has access shall be carried out for a legitimate purpose in accordance with the Political Constitution of Colombia, which shall be informed to the respective owner of the personal data.

Principle of freedom

The processing of personal data can only be carried out with the consent, prior, express and informed of the Owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory or judicial mandate to withdraw the consent.

Principle of veracity or quality

Information subject to processing of personal data must be truthful, complete, accurate, up-to-date, verifiable and understandable. Processing of partial, incomplete, fractional or misleading data is prohibited.

Principle of transparency

In the processing of personal data, THE PLATFORMA will guarantee the Owner his right to obtain at any time and without restrictions, information about the existence of any information or personal data that is of its interest or ownership.

Principle of access and restricted movement

The processing of personal data is subject to the limits deriving from the nature of the personal data, from the provisions of the law and the Constitution. Consequently, processing can only be done by persons authorized by the holder and/or by persons provided for by law. Personal data, except public information, may not be made available on the Internet or other means of mass dissemination or communication, unless access is technically controllable to provide restricted knowledge only to holders or third parties authorized in accordance with the law. For these purposes the obligation of THE PLATFORMA shall be media.

Security principle

Information subject to processing by THE PLATFORM must be handled with the technical, human and administrative measures necessary to provide security to the records by preventing their adulteration, loss, consultation, unauthorized or fraudulent use or access.

Principle of confidentiality

All persons who in LA PLATFORMA manage, manage, update or have access to information of any kind that is in Databases are obliged to guarantee the reservation of the information, so they undertake to keep and keep strictly confidential and not to disclose to third parties all information that they become aware of in the execution and exercise of their functions, except in the case of activities expressly authorized by the Data Protection Act. This obligation persists and will be maintained even after its relationship with one of the tasks covered by the Treatment has been completed.

VII. Rights of the information holder

In accordance with the provisions of the applicable data protection regulations, the following are the data subject rights:

• Access, know, update and rectify This right may be exercised, inter alia, against partial, inaccurate, incomplete, fractional, misleading data, or those whose processing is expressly prohibited or has not been authorized. Request proof of the authorisation granted to THE PLATFORM for the processing of data, by any valid means, except in cases where authorisation is not necessary.
• Be informed by THE PLATFORM, upon request, regarding the use you have given to your personal data.
• Present to the Superintendency of Industry and Trade, or the entity that does its times, complaints for violations of the provisions of Law 1581 of 2012 and other rules that modify, add or supplement it, after consultation or request to LA PLATFORMA.
• Revocation of authorisation and/or request the deletion of the data when the Treatment does not respect constitutional and legal principles, rights and guarantees.
• Access free of charge to your personal data that has been processed, at least once every calendar month, and whenever there are substantial changes to this policy that prompt further consultations.

These rights may be exercised by:

• The holder, who must prove his identity sufficiently by the various means made available to him by the PLATFORM.
• The holder's successors, who must prove such quality.
• The representative and/or proxy of the holder, after accreditation of the representative or proxy.
• Another in favour or for which the holder has stipulated.

VIII. Duties of PLATFORMA as controller and processor

THE PLATAFORMA recognizes the ownership of personal data held by individuals and consequently they may, in an exclusive manner, decide on them. Therefore, THE PLATAFORMA will use personal data for the fulfilment of the purposes expressly authorized by the holder or by the rules in force.

In the processing and protection of personal data, THE PLATAFORMA shall have the following duties, without prejudice to other duties provided for in the provisions governing or even regulating this matter:

• Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.
• Request and keep a copy of the respective authorisation granted by the holder for the processing of personal data.
• To inform the holder accordingly of the purpose of the collection and the rights enjoyed by him by virtue of the authorization granted.
• Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
• Ensure that information is truthful, complete, accurate, up-to-date, verifiable and understandable.
• To update the information in a timely manner, taking into account all new developments regarding the data of the holder. Additionally, all necessary measures must be implemented to keep the information up to date.
• Rectify the information when it is incorrect and communicate the relevant information.
• Respect the security and privacy conditions of the owner's information.
• To process the consultations and complaints formulated in the terms specified by law.
• Identify when certain information is under discussion by the holder.
• Report at the request of the holder on the use given to his data.
• Inform the data protection authority when violations of the security codes occur and there are risks in the management of the information of the data subjects.
• To comply with the requirements and instructions given by the Superintendency of Industry and Trade on the particular subject.
• Use only data the processing of which is previously authorized in accordance with Act No. 1581 of 2012.
• Ensure the proper use of the personal data of children and adolescents, in cases where the processing of their data is authorized.
• Register in the database the legend "reclamation in progress" in the manner regulated by the law.
• Insert in the database the legend "information in judicial discussion" after notification by the competent authority of judicial proceedings related to the quality of personal data.
• Refrain from circulating information which is being contested by the holder and whose blocking has been ordered by the Superintendency of Industry and Commerce.
• Allow access to information only to persons who may have access to it.
• Use the personal data of the holder only for those purposes for which he is duly authorized and respecting in any case the current regulations on the protection of personal data.

IX. Authorization and consent of the holder

THE PLATFORM requires the free, prior, express and informed consent of the owner of the personal data for the processing of the personal data, except in the cases expressly authorized by law, namely:

• Information required by a public or administrative entity in the exercise of its legal functions or by court order.
• Data of a public nature.
• Cases of medical or health emergency.
• Treatment of information authorized by law for historical, statistical or scientific purposes.
• Data relating to the Civil Registry of Persons.

Manifestation of authorisation

The authorisation to THE PLATFORM for the processing of personal data shall be granted by:

• The holder, who must prove his identity sufficiently by the various means made available to him by the PLATFORM.
• The holder's successors, who must prove such quality.
• The representative and/or proxy of the holder, after accreditation of the representative or proxy.
• Another in favour or for which the holder has stipulated.

Means of granting authorisation

The PLATFORMA will obtain the authorization by different means, including the physical document, electronic document, data message, Internet, websites, IVR telephone, SMS or in any other format that in any case allows the obtaining of consent by means of unequivocal conduct through which it is concluded that if the same was not obtained by the holder or the person entitled to do so, the data would not have been stored or captured in the database. The authorisation shall be requested by THE PLATFORM prior to the processing of personal data.

Proof of authorisation

THE PLATFORM shall retain the proof of the authorisation granted by the holders of the personal data for their processing, for which purpose it shall use the mechanisms available to it at present as well as take the necessary actions to maintain the record of the form and date on which it obtained it. Therefore, PLATFORMA may establish physical files or electronic repositories made directly or through third parties contracted for that purpose.

Revocation of authorisation

Holders of personal data may at any time revoke the authorisation granted to THE PLATFORMA for the processing of their personal data or request the deletion of their personal data, provided that a legal or contractual provision does not prevent it. THE PLATFORM shall establish simple and free mechanisms that allow the holder to revoke his authorization or request the deletion of his personal data, at least by the same means by which he granted it. For the above, it should be borne in mind that the revocation of consent may be expressed, on the one hand, totally in relation to the authorized purposes, and therefore PLATFORMA must cease any activity of data processing; and, on the other, partially in relation to certain types of processing, in which case they shall be those on which the processing activities will cease, as well as for advertising purposes, among others. In the latter case, THE PLATFORMA may continue to process personal data for those purposes in relation to which the holder has not revoked his consent.

X. Processing to which the data will be submitted and the purpose of the data

The processing of personal data of any person with whom THE PLATFORMA has established or establishes a relationship, permanent or occasional, shall be done within the legal framework that regulates the matter and by virtue of its status as a payment gateway, and shall be all necessary for the fulfilment of the corporate mission. In any case, personal data may be collected and processed for:

• Develop the mission of THE PLATFORM in accordance with its statutes.
• To comply with the provisions of Colombian labour and social security law, inter alia, applicable to former employees, current employees and candidates for future employment.
• Conduct surveys related to LA PLATFORMA services or goods.
• Develop programmes in accordance with its statutes.
• Keep in touch.
• To inform about job opportunities, fairs, seminars or other studies at local and international level.
• Encourage research in all fields including the scientist.
• Comply with all its contractual commitments.

Sensitive data

In the case of sensitive personal data, THE PLATFORMA may make use of and process them when:

• The holder has given his explicit authorization, except in cases where such authorization is not required by law.
• The treatment is necessary to safeguard the vital interest of the Owner and he or she is physically or legally incapacitated. In these events, legal representatives must grant his or her authorization.

XI. Privacy notice

The Privacy Notice is the physical document, electronic or in any other format, made available to the holder to inform him about the processing of his personal data. This document communicates to the holder the information related to the existence of the information processing policies of THE PLATFORM and which will apply to him, the way to access them and the characteristics of the processing that is intended to give to the personal data. The privacy notice must contain at least the following information:

• The identity, address and contact details of the controller.
• The type of processing to which the data will be subjected and the purpose of the data.
• The data subject rights.
• The general mechanisms put in place by the controller to ensure that the holder is aware of the information processing policy and of any substantial changes to it. In all cases, he/she should inform the holder of how to access or consult the information processing policy.
• The optional nature of the response concerning sensitive data questions.

XII. Claims, updating and deletion

Reclamos

The Owner or his successors who consider that the information contained in a database must be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the law, may file a complaint with LA PLATFORMA, which will be processed under the following rules:

1. The claim of the Owner will be formulated by request addressed to LA PLATFORMA to the e-mail , with the identification of the holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want to assert. If the claim is incomplete, the interested party will be required within five (5) days of the receipt of the claim to remedy the faults. After two (2) months from the date of the request, without the requested information being submitted by the applicant, it shall be deemed that he has withdrawn from the claim. If the person receiving the claim is not competent to resolve it, he shall transfer to the person concerned within a maximum of two (2) working days and shall inform the person concerned of the situation.
2. Once the full claim has been received, the claim will be labelled "reclamnant in process" and the reason for it, within no more than two (2) business days. This label will be maintained until the claim is decided.
3. The maximum time limit for dealing with the claim shall be fifteen (15) working days from the day following the date of receipt. If it is not possible to deal with the claim within that period, the person concerned shall be informed of the reasons for the delay and the date on which his claim will be dealt with, which in no case may exceed eight (8) working days following the expiry of the first term.

Request for updating and/or rectification

THE PLATFORM shall rectify and update, at the request of the holder, any information of the holder which appears to be incomplete or inaccurate, in accordance with the procedure and the above terms, for which account shall be taken of:

1. The holder shall submit the request to the e-mail address. indicating the update and/or rectification to be made and providing the documentation supporting your request.
2. THE PLATFORMA may enable mechanisms to facilitate the exercise of this right to the holder, provided that they benefit from it. Consequently, electronic or other means that it considers relevant may be enabled, which shall be informed in the privacy notice and made available to interested parties on the website.

Request for data deletion

The owner of the personal data has the right to request the PLATFORM to be deleted (delete) at any of the following events:

1. Consider that they are not being treated in accordance with the principles, duties and obligations provided for in the current regulations.
2. They are no longer necessary or relevant for the purpose for which they were collected.
3. The period necessary for the fulfilment of the purposes for which they were collected has been exceeded.

This deletion implies the total or partial deletion of personal information as requested by the holder in the records, files, databases or processing performed by THE PLATFORMA. However, this right of the holder is not absolute and consequently THE PLATFORMA may deny the exercise of this right when:

• The holder has a legal or contractual duty to remain in the database.
• The removal of data impedes judicial or administrative proceedings related to fiscal obligations, the investigation and prosecution of offences or the updating of administrative sanctions.
• The data are necessary to protect the legal interests of the holder; to take action according to the public interest; or to comply with an obligation legally acquired by the holder.

XIII. National Register of Databases

THE PLATFORM reserves, in the events referred to in the law and in its internal statutes and regulations, the power to maintain and catalogue certain information that rests on its databases or databases, as confidential in accordance with the rules in force, its statutes and regulations, all of the above and in accordance with the fundamental and constitutional right of each person.

THE PLATFORM will proceed in accordance with the regulations in force and the regulations issued by the National Government for this purpose, to carry out the registration of its databases before the National Register of Databases (RNBD), which will be administered by the Superintendency of Industry and Commerce. The GNID is the public directory of databases subject to processing operating in the country, which will be freely consulted by citizens, in accordance with the regulations issued by the National Government for this purpose.

XIV. Information security and security measures

In compliance with the principle of security established in the regulations in force, THE PLATFORMA shall adopt the technical, human and administrative measures necessary to grant security to the records by preventing their adulteration, loss, consultation, unauthorized or fraudulent use or access.

XV. Responsible and responsible for the processing of personal data

THE PLATFORM shall be responsible for the processing of personal data.

XVI. Validity

This policy is based on the 1 January 2025 and leaves without effect the special regulations or manuals that could have been adopted by administrative bodies in THE PLATFORM.

En Línea Pagos ELP S.A.S.