Policy on the Processing of Personal Data of Optimal Synergy Group SAS

Date of entry into force: June 25, 2025

In Optimal Synergy Group S. A. S., the trust and authenticity are fundamental pillars of our relationship with customers, suppliers and partners. We recognize the importance of protecting your privacy and the confidentiality of the personal information you entrust to us. This policy details the principles and procedures that govern the collection, storage, use, circulation and deletion of personal data, ensuring compliance with the colombian legislation in force and the highest standards of security and transparency.

1. Objective

This policy aims to ensure compliance with the current legislation regarding the protection of personal data, ensuring the rights of the owners at all stages of the treatment, and controlling the risks associated with the privacy and security of your personal information. Among the risks considered are:

• Unauthorized access.
• Loss of information.
• Unauthorized modification.
• Unauthorized disclosure.
• Use without consent.
• Non-compliance legal.

2. Responsible for the Treatment

The following information corresponds to the entity responsible for the processing of personal data under this policy:

• Social Reason: OPTIMAL SYNERGY GROUP SAS
• NIT: 901460720-6
• Address: Avenida Carrera 9 # 123-36, Office 603
• Phone: 9054604
• E-mail: info@optimalsinergia.com

3. Scope

This policy applies to all activities of collection, storage, use, circulation and deletion of personal data by OPTIMAL SYNERGY GROUP SAS. It will be mandatory for the company, its employees, collaborators and third parties acting on their behalf. All involved are required to maintain the confidentiality of the personal data, even after you terminate your employment or contractual relationship.

4. Definitions

For purposes of this policy, you understand the following concepts:

• Authorization: Prior, express and informed consent of the holder for the processing of your personal data.
• Privacy notice: Communication liable to the holder on the existence of policies to data processing and its purposes.
• Database: Structured set of personal data object of treatment.
• Personal data: Information that allows identifying or making identifiable to a natural person.
• Sensitive data: Data that affect the privacy of the holder of, or whose improper use can generate discrimination.
• The right to Habeas Data: The right of every person to know, update and rectify the personal information that rest in databases.
• In charge of the treatment: Person who carries out the processing of personal data on behalf of the responsible party.
• Responsible for the treatment: Person who decides on the basis of data and the treatment of the data.
• Owner: Natural person, whose personal data are processed.
• Treatment: Any operation on personal data, such as collection, storage, use, circulation or suppression.
• Transfer: Sending personal data to another responsible person, within or outside the country.
• Transmission: Communication of personal data to a commissioned for treatment.

5. Principles Applied to the Processing of Personal Data

The processing of personal data by the company shall be governed by the following principles:

1. Legality: The treatment will be carried out according to the colombian law.
2. Purpose: The data will be processed according to the purposes disclosed to the holder, which must be legitimate.
3. Freedom: Only you will be able to treat data with the authorization of the holder, unless a legal provision or court to the contrary.
4. Veracity, or quality: The information must be truthful, complete, accurate, up-to-date and verifiable.
5. Transparency: The holder may access information about your data at any time.
6. Access and restricted circulation: Will only be able to access the data:
   • The holder or its legal representatives.
   • Third parties authorized by the owner or by law.
   • Public entities with legal functions, or by court order.
7. Safety: Measures shall be taken of technical, human and administrative to avoid adulteration, loss, consultation, or unauthorized access.
8. Confidentiality: Every person involved in the processing of data shall ensure its confidentiality, even after their relationship with the company.

6. Authorization for the Processing of Personal Data and Privacy Notices

The company will obtain authorization from the owner to the processing of their data, except in the cases established by the law. This authorization is subject to the following conditions:

1. Informed consent: The treatment authorization required free, prior, express and informed.
2. Forms of authorization: May be given in writing, orally, or by conduct unequivocal. The silence is not considered as consent.
3. Proof of authorization: The company shall retain evidence of the authorization granted.
4. Exceptions to the authorization: Not required in the following cases:
   • Information requested by public entities, or judicial.
   • Public data.
   • Medical emergencies or health.
   • For historical, statistical or scientific authorized by law.
   • Data from the civil registry.
5. Authorization revocation and deletion of data: The holder may request the revocation of the authorization and/or deletion of their data, in accordance with the procedure laid down in article 15 of the Law 1581 of 2012 and title 8 of this policy.
6. Sensitive data: The company shall inform the holder is not obligated to authorize the processing of sensitive data, specifying clearly what they are and their purpose.
7. Privacy notice: Document that informs the owner about the policy on the processing, its purposes and the means to exercise their rights.

7. Rights of Holders

According to the article 8 of the Law 1581 of 2012, the owner has the right to:

1. Know, update and rectify your personal data.
2. Request proof of the authorization granted, unless legal exceptions.
3. Be informed about the use that has been given to their data.
4. To file complaints before the Superintendence of Industry and Commerce for violations of the act.
5. Revoke the authorization and/or request deletion of data when no respect for the constitutional and legal principles, unless there is a legal or contractual obligation to conserve them.
6. Free access to your personal data.