Personal Data Processing Policy

1. Introduction

At Eclectic Estudio de Estrategia S.A.S., identified by Colombian tax identification number (NIT) 902.099.052-0 (hereinafter, “Eclectic” or “we”), we take the protection of your information seriously. We have therefore adopted this Personal Data Processing Policy (the “Policy”) in accordance with Article 15 of the Colombian Constitution, Law 1581 of 2012, Single Regulatory Decree 1074 of 2015, Title V of the Consolidated Circular issued by the Superintendence of Industry and Commerce, and all other provisions governing Personal Data protection in Colombia.

Eclectic is a law firm. To provide our services, we need to process the Personal Data of clients, prospective clients, independent professionals, and other people with whom we interact. This Policy explains, clearly and simply, what we will do with your information, how we will use it, and how you can exercise your rights.

This Policy applies when Eclectic acts as a Data Controller, meaning when we decide why and how your Personal Data is processed.

2. Purpose

This Policy explains how we will process your information, what rights you have, the channels and procedures available for exercising those rights, and the principles and rules we follow at Eclectic when processing your Personal Data.

3. Definitions

To ensure a common understanding, the capitalised terms in this Policy have the following meanings, unless otherwise indicated:

• Authorisation: The prior, express, informed and freely given consent that you, as the Data Subject, provide to Eclectic to process your Personal Data.
• Database: An organised collection of Personal Data, in physical or digital form, which we process at Eclectic for specific purposes.
• Counterparties: Natural or legal persons with whom Eclectic has a contractual, commercial or de facto relationship. These include:
  • Clients: Natural or legal persons (including individuals acting as their points of contact) who engage, or are interested in engaging, Eclectic’s legal services on a recurring or occasional basis, including prospective clients.
  • Suppliers: Natural or legal persons (including individuals acting as their representatives, workers or points of contact) who supply goods or services for Eclectic’s operations.
  • Independent Professionals: Individuals who provide services to Eclectic under services agreements, consultancy agreements or other arrangements that do not constitute an employment relationship.
  • Employees: Individuals engaged by Eclectic under an employment contract.
• Personal Data: Any information that can directly or indirectly identify an individual, such as their name, identification number, email address, telephone number or address, among other information.
• Public Personal Data: Personal Data that, by its nature or pursuant to a legal or judicial requirement, may be accessed by anyone and whose Processing does not require the Data Subject’s prior Authorisation. Examples include data concerning a person’s marital status, profession or occupation, and status as a merchant or public servant.
• Sensitive Personal Data: A special category of Personal Data that, by its nature, may affect the Data Subject’s privacy or give rise to discrimination, such as health data, ethnic origin, religious beliefs, sexual orientation or biometric information.
• Data Processor or Processor: A natural or legal person who processes Personal Data on behalf of the Controller and in accordance with its instructions.
• Personal Data Processing Policy or Policy: This document, which explains the rules we follow at Eclectic when processing Personal Data as a Controller.
• Data Controller or Controller: A natural or legal person who determines the means and purposes or uses of Personal Data, as well as the contents of Databases. For the purposes of this Policy, Eclectic acts as the Controller.
• Superintendence of Industry and Commerce or SIC: Colombia’s Personal Data protection authority.
• Data Subject: An individual whose Personal Data is processed. If we process your information, you are the Data Subject.
• Transfer: The disclosure of Personal Data to a third party that will act as a Controller, with full autonomy to determine the use and purpose of that data. This flow of information takes place between two Controllers and may occur within or outside Colombia.
• Transmission: The communication of Personal Data between a Controller and a Processor so that the latter processes the data on the Controller’s behalf, without acquiring ownership of, or autonomy over, the Personal Data. It may occur within or outside Colombia.
• Processing: Any operation performed on Personal Data, including collection, storage, use, circulation, updating or deletion.

4. Identification of the data controller

The Controller of your Personal Data is:

• Legal name: Eclectic Estudio de Estrategia S.A.S.
• Tax identification number (NIT): 902.099.052-0
• Email: privacidad@eclecticlegal.co

5. Purposes and processing of personal data

Depending on your relationship with Eclectic, we will process your Personal Data (including collecting, storing, using, transmitting, transferring, updating, rectifying and deleting it) for the purposes described below. These purposes apply only to Processing that we carry out as a Controller.

5.1. General purposes

Regardless of your relationship with us, we will process your Personal Data to:

• Record your Personal Data in our Databases.
• Verify your identity.
• Support internal or external audits and retain supporting records.
• Transmit or transfer your Personal Data to third parties that support our operations (such as technology, accounting or cloud storage providers) and to partners with whom we work on your matters.
• Provide information to public authorities that request it in the exercise of their functions, in order to comply with our legal obligations.
• Defend Eclectic’s interests in judicial, pre-litigation and administrative proceedings.
• Respond to the requests, enquiries, claims and complaints you submit through any of our channels.
• Send you information we consider relevant to your relationship with Eclectic by email, SMS, WhatsApp, social media, telephone or any other channel you have provided.
• Check sanctions and restricted-party lists and background databases, whether public or private, domestic or foreign, to prevent money laundering, terrorist financing and similar risks.
• Prevent fraud and identity theft.
• Fulfil any other purpose inherent in your relationship with Eclectic or authorised by you.

5.2. Specific purposes applicable to Clients and prospective clients

In addition to the general purposes of this Policy, if you are a Client or prospective client, we will process your Personal Data to:

• Offer our services, invite you to events and training sessions, and send you Eclectic’s legal or commercial content by email or WhatsApp.
• Prepare service proposals, enter into, perform and manage our legal services agreement with you, and handle the matters you entrust to us.
• Invoice and collect our fees and expenses, and carry out other administrative procedures arising from the services we provide to you.
• Check for conflicts of interest before accepting a new matter.
• Comply with our accounting, tax and administrative obligations.
• Retain a record of our relationship and the matters handled as evidence of our professional work.
• Send you documents relating to our services, such as payment requests, electronic invoices, progress reports and communications about your matters, through any contact channel you provide (email or WhatsApp).
• Take photographs and/or videos at events and training sessions we organise, for evidentiary and publicity purposes, which may involve publication on our website and social media.

5.3. Specific purposes applicable to Suppliers

In addition to the general purposes of this Policy, if you supply goods or services to us, or act as the representative, worker or point of contact of a company that does so, we will process your Personal Data to:

• Request quotations, and evaluate and select our Suppliers.
• Enter into, perform and manage our contract or commercial relationship with you or the company you represent.
• Communicate with you about the goods or services you supply to us.
• Make payments and comply with our accounting and tax obligations.
• Retain a record of our commercial relationship.

5.4. Specific purposes applicable to Independent Professionals

In addition to the general purposes of this Policy, if you are part of our team of independent professionals or are in the process of joining us, we will process your personal data to:

• Assess your profile, experience and suitability to decide whether to engage you, including verifying your academic, employment and professional references.
• Retain your information for consideration in future engagement opportunities.
• Include your Personal Data in the services and confidentiality agreement, its amendments, and other documents necessary to manage our relationship.
• Properly manage our contractual relationship.
• Comply with our obligations as the contracting party, including paying your fees and verifying your social security contributions.
• Issue withholding tax certificates and certifications of the services you provide to us.
• Give you access to corporate email, systems or Databases. Please note that Eclectic may retain information held in them for record-keeping, operational, monitoring and litigation defence purposes, even after our relationship ends.
• Identify and manage potential conflicts of interest, and safeguard the confidentiality of our clients’ information.

5.5. Specific purposes applicable to Employees

In addition to the general purposes of this Policy, if you work at Eclectic under an employment contract or are participating in one of our recruitment processes, we will process your Personal Data to:

• Conduct recruitment processes, including scheduling interviews, checking your references and, where applicable, carrying out pre-employment medical examinations.
• Enter into, perform and manage your employment contract and its amendments.
• Pay your salary and statutory employment benefits, and make deductions permitted by law or authorised by you.
• Register you and your beneficiaries with the social security system and the family compensation fund.
• Manage sickness absences, leave, holidays and time-off requests.
• Comply with our occupational health and safety obligations.
• Contact your relatives or emergency contacts when necessary.
• Provide you with work tools, such as corporate email or access to systems and Databases. Please note that Eclectic may retain information held in them for record-keeping, operational, monitoring and litigation defence purposes, even after our relationship ends.
• Offer training and wellbeing activities, and assess your performance.
• Issue employment certificates and income and withholding tax certificates, and retain your employment records for the period required by law.

6. Exercise of data subjects’ rights

6.1. Data Subjects’ rights

At Eclectic, we guarantee the full exercise of your habeas data rights under Law 1581 of 2012. As a Data Subject, you have the right to:

• Access, update and rectify your Personal Data held by Eclectic or its Data Processors.
• Request evidence of the Authorisation you have granted us, except where the law does not require it (Article 10 of Law 1581 of 2012), as is the case with Public Personal Data (for example, data relating to a profession or occupation, such as corporate email addresses and telephone numbers).
• Be informed by Eclectic or its Processors, upon request, of the use we have made of your Personal Data.
• Lodge complaints with the SIC concerning breaches of Law 1581 of 2012 and other applicable provisions.
• Revoke your Authorisation and/or request the deletion of your Personal Data when constitutional or statutory principles, rights or safeguards are not respected, or whenever you decide to do so. This will not apply where a legal or contractual obligation requires us to retain the data or where Processing is necessary for our legal relationship with you.
• Access your Personal Data that has been processed, free of charge.
• Decline to answer questions concerning Sensitive Personal Data or the data of children and adolescents, as answering such questions is optional.

Exercising these rights is free of charge and will always be subject to applicable Personal Data protection legislation.

6.2. Department responsible for enquiries and claims, and contact channels

Eclectic’s Personal Data Protection Department is responsible for handling your enquiries, claims and any other matters relating to the Processing of your Personal Data. You may contact this department at privacidad@eclecticlegal.co.

7. Procedure for handling enquiries and claims

7.1. Enquiries

You, as the Data Subject, or the persons entitled to exercise your rights under Section 7.4, may submit enquiries to access your Personal Data, learn how it has been processed or obtain evidence of the Authorisation you have granted us.

When submitting an enquiry as a Data Subject, please note the following:

• We will provide all the information you request or, if you do not specify, the information associated with your identification.
• Your request must include: (i) your identification; (ii) a description of your enquiry; and (iii) a physical or electronic address to which we can send our response.
• We may request additional information to verify your identity and your entitlement to submit the enquiry under Section 7.4.
• We will disclose Personal Data only to the persons indicated in Section 7.5.
• We will respond to your enquiry within a maximum of ten (10) business days from the date we receive it.
• If we cannot respond within that period, we will inform you of the reasons for the delay and the date on which we will respond, which may not be more than five (5) business days after the original deadline.

7.2. Claims

If you consider that information held about you in our Databases should be corrected, updated or deleted, if you identify a possible breach of the law or this Policy, or if you wish to revoke your Authorisation, you or the persons entitled to act under Section 7.4 may submit a claim. When submitting a claim as a Data Subject, please note the following:

• Your claim must include: (i) your identification; (ii) a clear description of the facts; (iii) a physical or electronic address to which we can send our response; and (iv) documents supporting your request.
• If your claim is incomplete, we will ask you to complete it within five (5) business days of receipt. If two (2) months pass without you completing it, we will consider the claim withdrawn.
• Once we receive your complete claim, we will add a “claim under review” notation and the reason for the claim to our Database within a maximum of two (2) business days. We will retain this notation until the claim is resolved.
• We will respond to your claim within a maximum of fifteen (15) business days starting on the day after receipt. If we cannot respond within that period, we will inform you of the reasons for the delay and the revised response date, which may not be more than eight (8) business days after the original deadline.

7.3. Revocation of Authorisation and requests for deletion of Personal Data

You, or the persons entitled to act under Section 7.4, may ask us at any time to revoke your Authorisation or delete your Personal Data. However, we cannot do so where you have a legal or contractual obligation to remain in our Database; in that case, we will explain this in our response.

7.4. Persons entitled to exercise rights

Enquiries and claims may be submitted by:

• You, as the Data Subject, upon verifying your identity through the means we specify when handling your enquiry or claim.
• Your successors in title, upon providing evidence of that capacity.
• Your legal representative or attorney-in-fact, upon providing evidence of their representation or power of attorney.
• Third parties acting for or on behalf of another person, as permitted by law.

7.5. Persons to whom information may be disclosed

In all cases, we will disclose Personal Data or permit access to it only to:

• Data Subjects, their successors in title or their legal representatives.
• Public or administrative bodies solely in the exercise of their statutory functions, or pursuant to a court order.
• Third parties authorised by the Data Subject or by law.

7.6. Complaints to the Data Protection Authority

If you remain dissatisfied after completing the enquiry or claims procedure with Eclectic, you or the persons entitled to act may lodge a complaint with the Superintendence of Industry and Commerce.

8. Retention of personal data in databases

We will process your Personal Data for as long as necessary to fulfil the purposes of this Policy and, where necessary, the Authorisation you have granted us. Once those purposes have been fulfilled, and provided there is no legal or contractual obligation to retain the data, we will delete it from our Databases.

9. Updates to the policy

We may update this Policy whenever we consider it necessary. If we make a material change that may affect your Authorisation, we will notify you before implementing it. If the purposes of Processing change, we will request a new Authorisation before applying the change, where obtaining such Authorisation is required by law.

10. Effective date of this policy

This version of the Policy took effect on 25 September 2026.

11. Version history