Personal data processing policy

1. Who is the controller of your data

In a nutshell: Arcetec Soluciones Tecnológicas S.A.S. decides how your data is processed and is accountable for it.

Legal name

Arcetec Soluciones Tecnológicas S.A.S.

NIT (tax ID)

900.557.979-0

Registered address

Bogotá D.C., Colombia

Data protection email

habeas-data@arcetec.com.co

Phone

+57 300 307 3994

Website

arcetec.com.co

In this policy, “Arcetec”, “we”, “us” and “our” refer to this company.

2. Who and what it applies to

In a nutshell: To all personal data that Arcetec processes as controller, whatever the channel through which it arrives.

This policy applies to the databases and files containing personal data that Arcetec processes as controller, regardless of the channel through which the data arrived: the arcetec.com.co website in any of its languages, forms and quote tools, the virtual assistant, WhatsApp, email, phone, meetings, events, open calls, social media and the contractual relationship. It protects these people (data subjects):

• Clients and their employees: contacts, users and administrators of our solutions.
• Prospects and website visitors.
• Attendees of events, webinars and courses, and participants in open calls.
• Suppliers, partners and contractors, and their representatives.
• Employees, former employees and candidates.

3. Legal framework

In a nutshell: This policy complies with Colombian personal data protection law.

• Political Constitution, Article 15: the right to privacy and to habeas data.
• Statutory Law 1581 of 2012: general personal data protection regime.
• Decree 1377 of 2013, compiled in Decree 1074 of 2015: authorization, processing policies and exercise of rights.
• Law 2300 of 2023: channels, hours and frequency of commercial communications.
• Single Circular (Circular Única) of the Superintendence of Industry and Commerce (SIC), Title V: instructions on personal data protection.

The Superintendence of Industry and Commerce, through its Office of the Deputy Superintendent for Personal Data Protection, is the authority that oversees compliance.

4. Definitions

In a nutshell: The legal terms used in this policy, explained.

Authorization

Prior, express and informed consent of the data subject for their data to be processed.

Privacy notice

Verbal or written communication that informs the data subject that this policy exists, how to consult it and the purposes for which their data will be processed.

Database

Organized set of personal data that is subject to processing.

Personal data

Any information linked or that can be associated with one or more identified or identifiable natural persons.

Public data

Data that is not semi-private, private or sensitive; for example, a person's profession or trade, their status as a merchant and data contained in public records.

Semi-private data

Data that is not intimate, confidential or public, and whose disclosure may be of interest to its data subject and to a certain sector, such as financial and credit data.

Private data

Data that, because of its intimate or confidential nature, is relevant only to its data subject.

Sensitive data

Data that affects the data subject's privacy or whose misuse may lead to discrimination: racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions or social organizations, health, sex life and biometric data.

Data processor

Natural or legal person that processes personal data on behalf of the controller.

Data controller

Natural or legal person that decides on the database and the processing of the data.

Data subject

Natural person whose personal data is subject to processing.

Processing

Any operation on personal data: collection, storage, use, circulation or deletion.

Transfer

Sending data to a recipient that is, in turn, a data controller, inside or outside Colombia.

Transmission

Communication of data to a processor, inside or outside Colombia, so that it processes the data on behalf of the controller.

5. Principles we follow

In a nutshell: We use your data only for what we tell you, with your authorization, securely and confidentially.

• Legality: Processing is subject to the law and to the regulations that implement it.
• Purpose: Each use serves a legitimate purpose that is disclosed to you.
• Freedom: We process your data only with your prior, express and informed authorization, except for the exceptions provided by law.
• Truthfulness or quality: Information must be truthful, complete, accurate, up to date and understandable.
• Transparency: You can find out at any time what data we hold about you.
• Restricted access and circulation: Only authorized people access your data, and we do not publish it on the internet without controls.
• Security: We protect your data with technical, human and administrative measures.
• Confidentiality: Those who process data keep it confidential, even after their relationship with Arcetec ends.

6. What data we process

In a nutshell: Identification and contact data, data about your company, your relationship with us and your browsing. We do not ask for sensitive data unless it is essential and you authorize it.

Sensitive data. Arcetec does not ask for it in its commercial forms. It processes it only when it is essential—for example, health data to enroll an employee in social security, or a dietary restriction for an event—and with explicit authorization. If we receive it without having asked for it, we delete it.

7. How we obtain your data

In a nutshell: The data you give us, the data generated when you use our channels and the data that comes from public sources.

• From you, directly: website forms, quote tools, subscriptions, the virtual assistant, WhatsApp, email, calls, meetings, events and open calls.
• When you use our channels: technical and browsing data, and cookies according to the preferences you choose.
• From public sources: the commercial registry (RUES), corporate websites, professional profiles that their owners made public, published job openings and public procurement (SECOP).
• From commercial information providers that operate under their own compliance frameworks.
• From third parties: your company, when it designates you as a contact, and people who refer you.

8. What we use your data for

In a nutshell: To assist you, provide our services, comply with contracts and the law, maintain security and, unless you object, keep you informed.

Clients and prospects

• Respond to requests for information, demonstrations, quotes and commercial contact.
• Prepare proposals; enter into and perform contracts; invoice, collect payment and provide support.
• Identify, based on public information, companies that our solutions can serve, and prioritize commercial contact.
• Send information about Arcetec's products, services, events, content and news, including the solutions of its technology partners that Arcetec sells.
• Measure satisfaction and conduct surveys and market research.

Website visitors and users of our channels

• Operate the website, remember your preferences (language, theme and cookies) and protect it against fraud and bots.
• Measure website usage and campaign effectiveness, with your consent for analytics and marketing cookies.
• Handle your conversations in the virtual assistant and on WhatsApp.

Event attendees and participants in open calls

• Manage registration, attendance, certificates and evaluation.
• Publish photographs and recordings of the event on our channels, when this is disclosed at registration.
• Evaluate applications and communicate the results.

Suppliers, partners and contractors

• Select, evaluate and register suppliers; enter into and perform contracts; and make payments.
• Check restrictive lists and background records, when required by law or by commercial prudence.

Employees and candidates

• Carry out recruitment processes.
• Manage the employment relationship: contract, payroll, social security, well-being, training, performance evaluation and occupational health and safety.
• Issue employment certificates, including after the relationship has ended.

For all data subjects

• Comply with legal, accounting and tax obligations, and respond to requests from authorities.
• Protect the security of information, of our systems and of people.
• Handle inquiries, claims and the exercise of your rights.
• Prepare internal statistics and reports with aggregated or anonymized data.
• Defend Arcetec's rights in judicial or administrative proceedings.

9. Your authorization

In a nutshell: We ask for your permission before processing your data, except in the cases exempted by law, and we keep proof of it.

Arcetec requests your prior, express and informed authorization no later than when it collects your data, and tells you what it will use the data for. You may give it in writing, electronically (for example, by checking a box on a form), orally or through unequivocal conduct—such as writing to us to request information—from which it can be concluded that you granted it. Silence is never construed as authorization. Arcetec keeps proof of each authorization.

Under Article 10 of Law 1581 of 2012, authorization is not required in the case of:

• Information requested by a public or administrative entity in the exercise of its legal functions, or by court order.
• Data of a public nature.
• Cases of medical or health emergency.
• Processing authorized by law for historical, statistical or scientific purposes.
• Data related to the civil registry of persons.

Commercial prospecting. When Arcetec contacts a company based on public information, it uses public data or professional contact data; in each communication it identifies itself, explains how to exercise your rights and offers a simple way to stop receiving messages. If you object, we stop contacting you.

You may revoke your authorization at any time, except when there is a legal or contractual duty to retain the data.

10. Sensitive data and data of children and adolescents

In a nutshell: Answering questions about sensitive data or about minors is always optional and never a condition for our services.

Sensitive data. When Arcetec needs a piece of sensitive data, it will inform you that you are not required to provide it, what the data is and what it will be used for, and it will ask for your explicit authorization. No activity is conditional on you providing sensitive data.

Children and adolescents. Our services are aimed at companies, and we do not knowingly collect data from people under 18. If it were necessary—for example, an employee's beneficiaries or an educational activity—the data will be processed with the authorization of their legal representative, respecting their best interests and fundamental rights and, where possible, taking their opinion into account according to their maturity.

11. Your rights

In a nutshell: You can access, update, correct and delete your data, revoke your authorization, object to commercial contact and turn to the SIC. Consulting your data is free.

• Know and access: Find out what data of yours we process and access it free of charge.
• Update and rectify: Correct data that is partial, inaccurate, incomplete or misleading.
• Request proof of authorization: Receive a copy of the authorization you gave us, except when the law does not require it.
• Know how we use it: Be informed, upon request, of how we have used your data.
• Delete and revoke: Ask us to delete your data or withdraw your authorization, if there is no legal or contractual duty to retain it.
• Object to commercial contact: Stop receiving commercial communications whenever you want, using the link in each email or by writing to us.
• Turn to the SIC: File complaints with the Superintendence of Industry and Commerce, after having first contacted Arcetec.

You may consult your data free of charge at least once every calendar month and whenever this policy changes substantially. If you request more frequent consultations, Arcetec may only charge the costs of shipping, reproduction and, where applicable, certification of documents.

Who may exercise them: you, upon proving your identity; your successors in title, upon proving that status; your representative or attorney-in-fact, upon proving the representation; and anyone designated by stipulation in favor of or on behalf of another. The rights of children and adolescents are exercised by those authorized to represent them.

12. How to exercise your rights

In a nutshell: Write to us through the form or by email. We commit to responding within 10 business days; the law sets maximums of 10 business days for inquiries and 15 for claims.

Responsible area. Arcetec's Personal Data Protection Area handles inquiries, claims and requests from data subjects through these channels:

• Form: arcetec.com.co/habeas-data. It gives you an identifier to track your case.
• Email: habeas-data@arcetec.com.co, with the subject line “Hábeas data”.
• In writing: at our registered address in Bogotá D.C., Colombia.

Every request requires proof of your identity (an identity document or demonstrable ownership of the email address you write from) or that of your representative.

• Inquiry: 10 business days (+5 extension). To find out what information we hold about you.
• Claim: 15 business days (+8 extension). To correct, update or delete data, revoke your authorization or report non-compliance.

What a claim must contain: your identification, a description of the facts giving rise to it, the address or email where you want to receive the response, and any documents you wish to rely on.

1. If the claim is incomplete, we will ask you to complete it within 5 business days of receiving it. If 2 months pass without you doing so, you will be deemed to have withdrawn it.
2. No later than 2 business days after receiving the complete claim, we will mark the data with the legend “claim in process” and its reason, until it is resolved.
3. If the claim does not concern Arcetec, we will forward it to the appropriate party within a maximum of 2 business days and inform you.
4. We will respond through the channel you indicated, with our decision and the actions taken.

Before turning to the SIC. To file a complaint with the Superintendence of Industry and Commerce, you must first have completed the inquiry or claim process with Arcetec (a procedural prerequisite under Article 16 of Law 1581 of 2012).

Deletion of data and revocation of authorization do not apply when you have a legal or contractual duty to remain in the database.

13. Who we share your data with

In a nutshell: With providers that help us operate, under contract and only for our purposes. Some are outside Colombia. We never sell your data.

Arcetec does not sell or rent personal data. It shares it only in these cases:

• Data processors: technology providers that process data on Arcetec's behalf, only for the purposes of this policy and under a contract that requires them to maintain confidentiality and security.
• Vendors and partners, such as Microsoft, when needed to prepare a quote, register an opportunity or activate licenses you requested.
• Authorities, when required by law or by court order.
• Corporate reorganizations (merger, spin-off or sale): whoever receives the data will assume the obligations of this policy.

Our main providers:

International transfers and transmissions. When your data leaves Colombia, Arcetec sends it to countries with an adequate level of protection according to the SIC or with equivalent contractual safeguards, and requires each provider to apply security measures equal to or stronger than its own. It also requires artificial intelligence providers not to use your data to train their models.

The list of providers may change; the current one is the one published here. If you would like to know more about any of them, write to us at habeas-data@arcetec.com.co.

14. Artificial intelligence and automated decisions

In a nutshell: We use artificial intelligence to respond and to prioritize, always with people in charge. No decision with effects on you is made by a machine alone.

• Website and WhatsApp virtual assistant: it responds using artificial intelligence and can hand the conversation over to a person on our team. Do not enter sensitive data in it.
• Commercial prioritization: we assign an interest score to companies and contacts based on public signals, such as job openings, posts or events. It is an internal tool for organizing the sales team's work: it does not produce legal effects for you or decide anything on its own.
• Writing and translation: artificial intelligence helps write and translate content; commercial communications are sent under the supervision of our team.

Artificial intelligence providers process data only to deliver each response, under enterprise terms of use that exclude using it to train their models.

15. Cookies and similar technologies

In a nutshell: Necessary cookies always work; analytics and marketing cookies work only if you accept them.

When you visit the website, the cookie notice lets you accept them, reject them or choose by type. Until you accept them, analytics and marketing cookies remain disabled. To change your choice, clear the website's cookies and data in your browser and the notice will appear again. If you block necessary cookies, some features may not work.

16. Commercial communications

In a nutshell: We write to you only through permitted channels, during the hours set by law, and you can unsubscribe with one click.

• Every commercial email includes a link to unsubscribe. The unsubscribe takes effect without delay and is recorded.
• We respect the channels, hours and frequency set by Law 2300 of 2023: Monday to Friday, from 7:00 a.m. to 7:00 p.m., and Saturdays, from 8:00 a.m. to 3:00 p.m. Never on Sundays or public holidays.
• Contact with prospects is made through corporate channels and stops as soon as you object.
• You will continue to receive only the messages necessary for a contract or a request in progress.

17. How we protect your data

In a nutshell: With encryption, restricted access, two-factor authentication, backups and an incident response plan.

• Encryption: In transit (TLS) for all communications, and at rest for credentials and secrets (AES-256-GCM).
• Permission-based access: Each person accesses only what their role requires, with multi-factor authentication for administrative staff.
• Auditing: We log access to and changes made to the data.
• Backups: Daily, with 30-day retention.
• Credential rotation: Service credentials are renewed periodically.
• People: Confidentiality commitments and data protection training for the team.
• Incident response: A documented procedure to contain, investigate and notify.

If an incident compromises your data, Arcetec will report it to the SIC within the time limits it sets and, where appropriate, to the affected data subjects, together with the measures taken.

18. How long we keep your data

In a nutshell: Only while it serves its purpose and the law requires it. After that, we delete or anonymize it.

Term of the databases. Arcetec's databases will remain in force for as long as the company carries out its corporate purpose and the purposes that justify the processing continue to exist.

19. Our duties

In a nutshell: The law requires us to guarantee your rights, protect your data, keep it up to date and respond to you on time. We also oversee our providers.

As data controller, Arcetec undertakes to:

• Guarantee you, at all times, the full and effective exercise of the right of habeas data.
• Request and keep a copy of your authorization, and inform you of the purpose of the processing and of your rights.
• Keep the information with the security necessary to prevent its alteration, loss, consultation, use or unauthorized or fraudulent access.
• Keep the information truthful, complete, accurate, up to date and understandable, and rectify it when it is incorrect.
• Provide its processors only with data whose processing is authorized, and require security and privacy from them at all times.
• Handle inquiries and claims within the terms set by law, and report when a piece of data is under dispute.
• Report security incidents to the SIC and comply with its instructions and requirements.

When it acts as processor—for example, within a client's tenant—Arcetec processes the data only on the controller's instructions, keeps it confidential, applies security measures, updates or deletes the data when the controller so indicates, and informs the controller of any incident.

When the law requires it, Arcetec registers its databases in the SIC's National Database Registry (Registro Nacional de Bases de Datos, RNBD) and keeps that registration up to date.

20. Effective date and changes to this policy

In a nutshell: This version is effective from November 6, 2026. If anything important changes, we will let you know in advance.

This version is effective from November 6, 2026 and updates the name of the solution cited as an example (CoworkOne). Version 2.1, of October 31, 2026, updated the registered address of version 2.0, of October 24, 2026, which replaced the policy published on September 27, 2021 and the privacy notice for commercial prospecting. The authorizations you granted remain valid for the purposes that were disclosed to you.

Substantial changes—regarding the identification of the controller or the purposes—will be communicated to you before they take effect, on this website, in the footer of commercial emails or directly. If the purposes change, we will ask you for a new authorization.

This policy is published in Spanish, English and Portuguese. If there are differences between the versions, the Spanish version prevails.