Personal Data Processing and Information Management Policy

1. General Information About the Data Controller

Legal name

DBD Latam

Registered office

Miami, Florida

Address

3010 NE 6TH AVE, Suite 201, Miami, FL

Telephone

+57 301 703 3112

Email

fmartinez@dbdlatam.com

2. Purpose and Scope

DBD Latam, acting as the controller of personal data obtained in the course of providing its services and in accordance with Law 1581 of 2012 and Decree 1377 of 2013, hereby informs data subjects of this policy governing the processing and management of personal data.

This policy applies to all personal information held in the controller’s databases relating to employees, clients, suppliers and associated third parties.

3. Legal Framework

The processing of personal data is governed by the following provisions:

• Articles 15 and 20 of the Political Constitution of Colombia.
• Law 1581 of 2012.
• Decree 1377 of 2013.
• Any other provisions that amend or supplement the foregoing.

4. Processing of Personal Data

The personal data collected will be used for the following purposes, depending on the category of data subject:

4.1 Employees

• Compliance with legal and contractual obligations arising from the employment relationship.
• Administration, accounting and social security management.

4.2 Clients

• Provision of the contracted services.
• Compliance with contractual obligations.
• Distribution of legal, regulatory, legal commentary or institutional information.
• Provision of information about new services, partnerships or changes to existing services.
• Assessment of service quality.
• Marketing activities and institutional communications.
• Responses to requests from administrative or judicial authorities.

4.3 Suppliers

• Contract administration and payment of fees.
• Reporting required by law or contract.
• Handling of inquiries, requests or complaints.
• Monitoring of compliance with contractual obligations.

5. Definition of Personal Data

Personal data means any information linked to, or capable of being associated with, an identified or identifiable natural person or legal entity.

6. Rights of Data Subjects

Data subjects have the right to:

• Obtain information about, update and rectify their personal data.
• Request evidence of the consent they have provided.
• Be informed of how their personal data has been used.
• Withdraw their consent and/or request the deletion of their data.
• Access their personal data free of charge.

7. Consent to Data Processing

Personal data will be processed only after the data subject has given express, informed and freely given consent, except where an exemption applies under the law.

When consent is requested, the data subject will be informed of:

• The purpose of the processing.
• Their rights.
• The data controller’s contact details.
• The procedures for exercising their rights.

8. Procedure for Exercising Rights

Requests to access, update, rectify or delete personal data must include, at a minimum:

• The data subject’s full name.
• An identification document.
• Contact details.
• A clear description of the request.
• Supporting documents, where applicable.

Requests will be handled within the time limits established by law.

9. Responsible Department and Contact Details

Responsible department

Management

Address

3010 NE 6TH AVE, Suite 201, Miami, FL

Email

fmartinez@dbdlatam.com

Telephone

+57 301 703 3112

10. Changes to This Policy

Data subjects will be notified of any material changes to this policy through the usual communication channels.

11. Effective Date and Duration

This policy takes effect on October 1, 2026, and will remain in effect for as long as the purposes of the processing continue to apply.