This English translation is provided for convenience only. In case of any discrepancy, the Spanish version prevails and is the legally binding text.

Personal Data Processing Policy (Habeas Data)

Last updated: June 27, 2026 · Effective from: June 27, 2026

In compliance with Law 1581 of 2012, Decree 1377 of 2013 and the other related regulations governing the protection of personal data in Colombia, RP CLOUD SERVICES SAS adopts this Personal Data Processing Policy, which is mandatory in all of its activities.

1. Data controller

Company name: RP CLOUD SERVICES SAS
NIT (Tax ID): 901.919.124
Trade name: Claria
Registered address: Bogotá D.C., Colombia
Email: hola@claria-co.com
Phone / WhatsApp: +57 321 277 8170

2. Definitions

• Data subject: the natural person whose personal data is processed.
• Personal data: any information linked or that may be associated with a specific or identifiable natural person.
• Sensitive data: data that affects the privacy of the data subject or whose misuse may lead to discrimination.
• Processing: any operation on personal data (collection, storage, use, circulation, deletion).
• Authorization: the prior, express and informed consent of the data subject to the processing.

3. Applicable principles

Claria’s processing of data is governed by the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality set out in article 4 of Law 1581 of 2012.

4. Types of data processed and purposes

Claria collects and processes identification, contact, socioeconomic (limited to what is necessary for invoicing) and browsing data, for the following purposes:

• Registering, authenticating and managing the user’s account.
• Handling diagnosis or quote requests and managing the business relationship.
• Managing the invoicing of services and complying with tax obligations.
• Providing the contracted services and offering support.
• Sending transactional communications and, with authorization, marketing communications.
• Responding to requests, complaints and claims.
• Complying with legal obligations and responding to requests from authorities.
• Carrying out statistical analysis and improving the experience on the platform.

Claria does not process sensitive data or data of minors. Should any be received by mistake, it will be deleted immediately.

5. Rights of the data subject

In accordance with article 8 of Law 1581 of 2012, as the data subject you have the right to:

• Access, update and correct your personal data.
• Request proof of the authorization you granted.
• Be informed, upon request, about the use made of your data.
• File complaints with the Superintendencia de Industria y Comercio (SIC) for violations of the regulations.
• Revoke the authorization and/or request deletion where there is no legal or contractual duty that justifies keeping the data.
• Access, free of charge, your personal data that has been processed.

6. Responsible area and service channels

The area responsible for handling petitions, inquiries and claims related to data processing is Claria’s Management. The official service channels are:

• Email: hola@claria-co.com
• WhatsApp: +57 321 277 8170
• Postal mail: Bogotá D.C., Colombia (address provided upon request).

7. Procedure for exercising rights

Inquiries. The request must include full name, identification number, a description of the inquiry and the preferred means of response. It will be answered within a maximum of 10 business days, extendable by 5 additional business days when the case justifies it, in which event the data subject will be informed of the reasons for the extension (art. 14, Law 1581/2012).

Claims. If the data subject considers that the information contained in our databases should be corrected, updated or deleted, or notices an alleged breach of the regulations, they may file a claim at the email indicated. The claim will be handled within a maximum of 15 business days, extendable by 8 additional business days with notice to the data subject (art. 15, Law 1581/2012).

If the claim is incomplete, we will ask the claimant to remedy the deficiencies within the following 5 days; if 2 months pass without a response, the claim will be deemed withdrawn.

8. Data subject authorization

Authorization for data processing is obtained at the time of registration on the platform, by ticking the corresponding box and expressly accepting this Policy. The authorization is kept as evidence through the system’s technical records (timestamps, IP address and means used).

9. Transfer and transmission of data

Claria may transmit personal data to processors located outside Colombia (Google LLC, Vercel Inc., Microsoft Corporation) for strictly operational purposes. These processors maintain security standards equivalent to or higher than those required by Colombian regulations and are located in countries with adequate levels of protection or covered by standard contractual clauses.

10. Security measures

Claria implements reasonable technical, human and administrative measures to protect personal data against loss, alteration, unauthorized access or fraudulent use, including encryption in transit and at rest, role-based access control, audit logs and backups.

11. Term

This Policy takes effect on June 27, 2026. The databases managed by Claria will remain in force for the time necessary to fulfill the purposes described and the applicable legal obligations. Substantial changes will be communicated to data subjects at least 10 business days before they take effect.

Base document aligned with Law 1581/2012 and Decree 1377/2013. Review by legal counsel is recommended, as is registering the personal databases with the SIC’s National Database Registry (RNBD) where required.