Personal Data Processing Policy

Ecometri S.A.S (hereinafter "Ecometri" or the "Company") is a company legally incorporated under Colombian law, identified with NIT 901754149. We provide comprehensive technology solutions designed to facilitate, manage, administer, and carry out transactions through virtual means and e-commerce platforms, through the development of activities in the IT and technology sector.

The personal data processing policy (the "Policy") described below shall be applicable to the collection, use, national or international Transmission and/or Transfer, or any other type of processing of Personal Data carried out by Ecometri, as Data Controller, of the Personal Data of Users of our platforms and website.

In order to comply with current data protection legislation, particularly Law No. 1581 of 2012 and Decree No. 1377 of 2013, we hereby inform you of the relevant aspects regarding the collection, use, Transmission, and Transfer of Personal Data.

In this Policy you will find the corporate and legal guidelines under which the Company processes your data, the purposes, your rights as Data Subject, as well as internal and external procedures for exercising those rights.

In accordance with Article 15 of the Colombian Constitution and applicable legislation, we have a clear privacy and personal data protection policy: we do not obtain personal information from third parties unless they have voluntarily provided it through their prior, express, and informed consent, unless the personal data is of a public nature.

Buyer: Any natural or legal person who accepted the T&C of Ecometri's digital platforms for the purpose of using Ecometri Services to connect and create orders for goods and/or services.

Merchants: Legal entities that have previously partnered with Ecometri through a contract for the processing and management of payments for goods and/or services they offer to consumers.

User: Any natural or legal person who receives Ecometri services from the Company under a contractual/obligational relationship, in this case Buyers and Merchants.

Personal Data: Any information linked or that may be associated with one or more identified or identifiable natural persons.

Sensitive Data: Data that affects the privacy of the Data Subject or whose misuse may generate discrimination.

Data Processor: Natural or legal person, public or private, that by itself or in association with others, processes Personal Data on behalf of the Company as Data Controller.

Processing Policy: Refers to this document, as the Personal Data processing policy applied by the Company in accordance with current legislation.

Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Processing of data. For purposes of this Policy, the Company shall act as Controller.

Data Subject: Natural person whose Personal Data is subject to Processing, in this case the Users of Ecometri's digital e-commerce platforms.

Transfer: Refers to the sending by the Company as Data Controller of Personal Data to a third-party agent or person, within or outside national territory for the effective processing of Personal Data.

Transmission: Refers to the communication of personal data by the Controller to the Processor, located within or outside national territory, so that the Processor processes the transmitted personal data.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

Ecometri Services: The system that Ecometri makes available to you with all its present and future developments to generate orders in the merchants subscribed to the Ecometri platform.

The Company recognizes that as the Data Subject of Personal Data subject to Processing, you have the right to the protection of your personal data. As Data Subject, you expressly authorize us to process your Personal Data, including but not limited to collection, storage, use, circulation, or deletion, in accordance with this Policy.

By accepting this Policy and granting your authorization through the "acceptance click," you authorize us to consult, supplement, and update your Personal Data at any time.

Ecometri will retain your Personal Data for up to 5 years from the last processing, or for the time necessary to fulfill the purposes set forth in this Policy.

Once the need for processing your data ceases, it may be deleted from the Company's databases or archived under secure terms.

Ecometri may subcontract third parties for the processing of certain functions or information. To learn who acts as Processors or Responsible Recipients, you may contact the Company at: protecciondedatos@ecometri.com.

The Company may transfer or transmit your Personal Data to other companies abroad, for reasons of security, administrative efficiency, and better service. For international Transmissions, Ecometri will execute the relevant contracts pursuant to Decree No. 1377 of 2013.

• Create, activate, and maintain your Ecometri User account.
• Fulfill obligations undertaken with the Data Subject.
• Provide information about changes in Ecometri services.
• Evaluate service quality, conduct market research, and perform statistical analysis.
• Send commercial, advertising, or promotional information about our services or events or those of our Merchants.
• Conduct general surveys and polls regarding goods or services.
• Improve our services and platforms.
• Prevent fraud against you and against Ecometri.
• Provide technical support and resolve inquiries, requests, complaints, and claims from Data Subjects or regulatory bodies.
• Allow companies affiliated with Ecometri to contact the Data Subject to offer goods or services.
• Any other activity of a similar, related, and/or complementary nature to those described above.
• Use the various services corresponding to websites, including content downloads and formats.
• Report on substantial changes to the Policy adopted by Ecometri.
• Establish and manage the pre-contractual and contractual commercial, labor, civil, and other relationships.
• Validate the Data Subject's information to create a bank account on the Ecometri payment platform.
• Process and analyze user information for promotional purposes of events and new services.
• Transfer or transmit your Personal Data to judicial and/or administrative entities and/or authorities, when required.

If you provide us with Personal Data, you authorize us to use this information for the stated purposes, and we will not transfer or disclose it outside our databases unless:

• You authorize us to do so.
• It is necessary to allow our contractors, suppliers, or agents to provide the services we have engaged them to perform.
• We or third parties use it to provide our services.
• It is delivered to entities providing marketing services on our behalf or with joint marketing agreements.
• It relates to a merger, consolidation, acquisition, divestiture, or other restructuring process.
• We implement a Personal Data Transmission contract pursuant to Decree No. 1377 of 2013.
• As required or permitted by law or for the purposes developed in this Policy.

Within the use of the Technology Platform, the Merchant will use Ecometri's progressive web application, a tool that adds value to the services offered.

How does Ecometri operate within e-commerce?

Ecometri is a WPA (Web Progressive App) that generates a personalized link for each merchant. The merchant can share this link with anyone, allowing their customers to browse products and/or services offered, as well as place orders and ask questions directly to the merchant.

The Merchant can access the platform's administrative zone to edit and update information related to their account, such as store name, products, posts, images, business hours, owner's personal data, among others.

For the processing and purposes described, we may collect the following personal information from our platform Users:

• Full names
• Identification number
• Phone number
• City and home address
• Economic segment
• Salary
• Financial products or payment method information (card number, expiration date, bank, etc.)
• Email address
• IP address
• Transaction history through Ecometri services

We may also collect your personal information through cookies, web beacons, or other technologies, including:

• Domain name
• Browser type and operating system
• Web pages visited
• Links selected
• Visit duration
• Referring URL
• Website activities
• Device identification
• Installations and uninstallations
• Transaction details and history
• Platform visit duration

In the course of our commercial activities, Ecometri processes Sensitive Data for specific purposes.

Ecometri will only process Sensitive Personal Data when previously authorized by the respective Data Subject and will process them under security and confidentiality standards appropriate to their nature.

The collection of Sensitive Personal Data is always optional and does not constitute a condition for accessing any of our services, unless strictly necessary or required by law.

The Company does not collect Personal Data from minors, as Ecometri Services are exclusively directed at adults (over 18 years of age). If you have any questions, please contact protecciondedatos@ecometri.com.

In accordance with Article 8 of Law No. 1581 of 2012, as a Personal Data Subject, you have the right to:

• Know, update, and rectify your Personal Data with Ecometri.
• Request proof of the authorization granted to Ecometri.
• Be informed by Ecometri, upon request, regarding the use given to your Personal Data.
• File complaints with the Superintendence of Industry and Commerce for violations of Law 1581 of 2012, after exhausting the consultation or claim process with Ecometri.
• Revoke the authorization and/or request data deletion when constitutional and legal principles, rights, and guarantees are not respected.
• Access your Personal Data that has been subject to Processing free of charge.

These rights may be exercised by the Data Subject, their successors, representative, or agent.

As the Data Subject of Personal Data processed by Ecometri, you have the right to access your Personal Data and Processing details, as well as to rectify, update, or request their deletion.

Consultations

The Data Subject may consult their Personal Data free of charge at least once per calendar month, through the channels provided by Ecometri.

The request will be handled within a maximum term of ten (10) business days. When it is not possible to respond within that term, the applicant will be informed of the reasons for the delay, not exceeding five (5) additional business days.

Claims

When the Data Subject considers that the information should be corrected, updated, or deleted, they may submit a request to Ecometri, proving their identity.

The request must contain: name and address of the Data Subject, identity documents, and a clear and precise description of the Personal Data regarding which they seek to exercise any of their rights.

The maximum term to process this request shall be fifteen (15) business days. When it is not possible, the interested party will be informed, not exceeding eight (8) additional business days.

The area responsible for handling requests, consultations, or claims regarding the processing of your Personal Data is our data processing department:

protecciondedatos@ecometri.com

Ecometri has adopted the necessary technical, human, and administrative measures to protect the security of Personal and Sensitive Data subject to processing, in order to prevent their alteration, loss, unauthorized or fraudulent consultation, use, or access.

In the context of relationships with third parties involving the processing of Personal Data, such relationships will be covered by a confidentiality, integrity, and privacy agreement. Third parties must commit to having standards equal to or higher than Ecometri's in terms of information security.

This Processing Policy takes effect as of February 2020. In any case, we may modify or update this Policy, disseminating the new terms through the website or the application.