This Personal Data Processing Policy (hereinafter the “Data Policy”) regulates how FLEXCENTER S.A.S., a Colombian company, identified with NIT 901742433 – 8, domiciled in Cali and headquartered at Avenida 3 Bis # 24 N – 59 in the city of Cali, (hereinafter “FC” or the “Company”) collects, gathers, stores, processes, manages, administers, transfers, transmits, or shares the information and data that You (hereinafter the “Holder”) provide or may provide in any way to FC, or that the Company collects and/or manages about the Holder in any way and by any means.

Please read the following information about our Data Policy, as when you agree to provide us with your Personal Data, you accept that they will be processed in accordance with this policy. Furthermore, when you provide us with your Personal Data, it is understood that you are granting your express and voluntary authorization for FC to process them. For the purposes of this Data Policy, the term “Personal Data” and any other term not expressly defined in this document shall have the meaning conferred by Law 1581 of 2012 and other applicable regulations in Colombia. Rights and Responsibilities: The Holder, as the owner or subject of Personal Data or as the subject to which such information refers, shall have the rights granted by the respective applicable legislation. In Colombia, holders of Personal Data shall have the rights established in Law 1581 of 2012, Law 1266 of 2008, and any other regulations that amend, replace, or supplement them, in particular, but not limited to Decree 1377 of 2013, such as: o 1.1 Know, update, rectify, and correct their Personal Data with the Company. This right may be exercised, among others, in relation to partial, inaccurate, incomplete, divided, misleading information, or information whose processing is prohibited or not authorized. o 1.2 Require proof of the consent granted to the Company for the collection and processing of their Personal Data, have access to their Personal Data that is being processed by the Company, and, in general, be informed by FC about the processing of their Personal Data. o 1.3 Revoke the authorization granted to FC and/or request the deletion of their Personal Data when you believe that the Company is not respecting constitutional and legal principles, rights, and guarantees. o 1.4 Access your own Personal Data that the Company has collected and processed. o 1.5 Object at any time to the processing of your personal data. o 1.6 Request the limitation of processing when: (i) the Holder challenges the accuracy of the personal data, for a period that allows the data controller to verify their accuracy, (ii) the processing is unlawful, and the Holder opposes the deletion of the personal data and requests instead the restriction of their use, (iii) the Company no longer needs the personal data for the purposes of processing, but the Holder needs them for the formulation, exercise, or defense of legal claims, or (iv) the Holder has objected to the processing of their data. o 1.7 If you are not satisfied with the way the Company processes your Personal Data or have any complaints or claims, you can submit a communication to FC’s data protection officer at the email address [email protected]. o 1.8 If FC’s data protection officer does not resolve your concerns or address your complaint, you may contact the Superintendence of Industry and Commerce to raise your concerns, complaints, or claims if you believe that FC has violated your data protection rights or the provisions of Law 1581 of 2012, Decree 1377 of 2013, and other regulations that amend, add, or complement them. The Holder may, optionally, decide whether or not to provide information to FC and what kind of information to provide. Furthermore, the Holder shall be responsible for the accuracy, authenticity, and timeliness of the Personal Data provided. Once the Personal Data have been provided or supplied in the terms and manner described in this Data Policy, the Holder expressly authorizes FC to administer and process such Personal Data. Sensitive Data: Sensitive Data refers to data that affects the privacy of the Holder or whose misuse may lead to discrimination, such as data that reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or that promote the interests of any political party or guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data. The Holder shall not be obliged to provide information related to Sensitive Data. Collection and Use of Data: The Personal Data that FC may collect from the Holder, or that the Holder may provide to FC, may include their name, age, identification number or citizenship card number, email address, IP address, place of residence, telephone number, Twitter and/or Facebook usernames or other social media usernames, geographical location, nationality, and place of domicile, employment history (work experience, employment history, professional references), education, academic performance, income and financial capacity, payment data (such as credit or debit card numbers), as well as any other information that the Company considers relevant and necessary for the purposes described herein or in the Privacy Notice, which is complementary to this Data Policy. FC may process Personal Data for the following purposes, which are not limited to, and which are described in greater detail in the Privacy Notice: o 3.1 To provide FC services and products. o 3.2 To manage, operate, maintain, and improve the Website, as well as to offer personalized content and other products and services. o 3.3 To conduct market research, data analysis, and statistical studies to design and implement improvements to the Company’s products and services. o 3.4 To send periodic newsletters, news, promotions, offers, and other commercial communications related to FC services and products, as well as third-party products, that may be of interest to the Holder. o 3.5 To respond to inquiries, requests, and comments from the Holder. o 3.6 To provide support and assistance to the Holder. o 3.7 To comply with applicable legal and regulatory requirements. o 3.8 To prevent and detect fraudulent or illegal activities, and to protect the security of FC and its customers. Personal Data of Children and Adolescents: FC does not knowingly collect Personal Data from children or adolescents under the age of 18. If FC becomes aware that it has collected Personal Data from a child or adolescent under the age of 18, the Company will take the necessary steps to delete that information as soon as possible. If you become aware that your child has provided FC with their Personal Data without your consent, please contact us at [email protected], and we will take the necessary steps to delete the information. Transfer and Sharing of Personal Data: FC may share Personal Data with third-party service providers and vendors who assist the Company in providing services and products, managing and improving the Website, conducting market research and data analysis, and sending newsletters and other commercial communications, among other purposes. Additionally, FC may share Personal Data with competent authorities and governmental or regulatory entities when required by law, regulation, or legal process, or when necessary to protect the rights, privacy, safety, or property of the Company, its customers, or the public. Furthermore, FC may share Personal Data with its affiliated companies for the purposes described in this Data Policy. International Transfer of Personal Data: FC may transfer Personal Data to countries other than the one in which the Holder resides. In these cases, FC shall take all necessary measures to ensure that the transfer complies with applicable data protection laws and that adequate protection is provided for the transferred Personal Data. Data Security: FC has implemented security measures to protect Personal Data from unauthorized access, disclosure, alteration, or destruction. However, no data transmission over the internet or information storage technology is entirely secure, so FC cannot guarantee the security of the Personal Data that the Holder transmits to the Company. Data Retention: FC will retain Personal Data for the period necessary to fulfill the purposes for which they were collected, as described in this Data Policy, unless a longer retention period is required or permitted by law. Changes to Data Policy: FC may update or modify this Data Policy from time to time, and any changes will be effective when they are posted on the Website. It is the Holder’s responsibility to review this Data Policy periodically to stay informed about how FC is processing Personal Data. Contact Information: If the Holder has any questions or concerns about this Data Policy or the processing of Personal Data by FC, they can contact us at [email protected]. This Data Policy was last updated on 28/09/23. By accepting this Data Policy, the Holder acknowledges and agrees to its terms and conditions and authorizes FC to process their Personal Data in accordance with the provisions of this Data Policy and the Privacy Notice.