Privacy and Personal Data Processing Policy

The use and handling of such data are carried out under strict standards of responsibility, which include respect for due process and the protection of information.

We collect data from platform users—including information about companies, administrators, and individual users—as well as business information relevant to the commercial relationship, such as company name, industry, company size, job title, needs, interests, interaction history, and the status of the commercial process. Depending on the nature of the relationship, the authorizations granted, and the applicable legal basis, this information may be used for commercial profiling, opportunity management, marketing, the distribution of information, customer support, service, and the enhancement of the customer experience.

The general purposes of commercial profiling, marketing, advertising, and the recovery of abandoned shopping carts do not apply to user data obtained via Google APIs, except where a specific purpose constitutes a visible function of PIYION that has been expressly requested by the user and is permitted under Google’s policies. The specific processing of data received from Google is governed by the section titled “Specific processing of data obtained via Google APIs” within this Policy.

Data contained in conversations between administrators or advisors and users is collected in order to maintain and display interaction history, provide support, address requests, ensure continuity in the business relationship, and improve the customer experience. This information will not be used for PIYION INC’s own promotional campaigns unless there is explicit authorization or an applicable legal basis.

The data recorded in our databases includes, but is not limited to: personal data such as first and last names, telephone numbers, email addresses, date of birth, age, identification documents, and other information specified in this policy. At any time, the data subject may revoke their consent and exercise their right to the deletion of personal data—as established under Law 1581 of 2012—as well as the rights to cancel or object to the processing of their personal data, in accordance with the parameters set forth in the General Data Protection Regulation (GDPR).

If you wish to access information or request the deletion of your personal data from our databases, please contact us within 30 days of the publication of this notice via email at [email protected], or by phone at (+57) 3013373550. If you choose not to take action, once the aforementioned period has elapsed, we will consider the processing of your personal data to be authorized. This is without prejudice to the data subject’s right, at any time, to consult, access, or update their personal data, or to request its deletion or rectification.

PIYION INC. may contain hyperlinks to other websites or social media networks, which may, in turn, have privacy policies that differ from those of PIYION INC.

For further information, please consult the Personal Data Processing Policy via the following available channels:

Website: Piyion website

Web application: Piyion web application

Android mobile application: Piyion on Google Play

iOS mobile application: Piyion on the App Store

PERSONAL DATA PROCESSING POLICY

This is the Privacy and Personal Data Processing Policy of PIYION INC., applicable to the application PIYION, its websites, channels, integrations, and databases. PIYION INC. shall act as a Data Controller with respect to processing activities for which it determines the purposes and means, and shall act as a Data Processor when it processes data on behalf of and under the instructions of a client acting as a Data Controller. This document is prepared in compliance with Law 1581 of 2012, Decree 1377 of 2013, Regulation (EU) 2016/679, and other applicable regulations, with the objective of ensuring the proper processing of information and the effective exercise of the rights of the data subjects.

All information received by PIYION INC. through its various communication channels—whether in digital or printed format—that constitutes our databases, and which is obtained from clients, suppliers, employees, contractors, or other data subjects, is governed by the following usage policies. If your information is included in any of our databases, it is because you have had or currently maintain a business relationship with PIYION INC., because you have provided your data on our platform to access our services, or because you have voluntarily submitted your data during events or activities organized by PIYION INC., or directly at our office.

PIYION INC. is a company focused on the development of software and other cutting-edge technologies designed to enhance the productivity of both individuals and legal entities across various functional areas (such as communication, sales, marketing, finance, accounting, logistics, control, administration, human resources, planning, procurement, strategy, and/or production). Given this, we want you to be informed about what data we collect and how we use it. Our privacy policy applies to all information we collect about you.

Identification of PIYION INC and processing roles:

Legal name: PIYION INC.

Registered address: 5350 NW 84th Ave, Apt. 1607, Doral, FL 33166, United States

Telephone: +57 3013373550

Email address: [email protected]

Website: Piyion website

Web application: Piyion web application

Android mobile application: Piyion on Google Play

iOS mobile application: Piyion on the App Store

1. LEGAL FRAMEWORK AND SCOPE OF APPLICATION

This Personal Data Processing Policy has been drafted in accordance with the provisions of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013, Regulation (EU) 2016/679 of the European Parliament and of the Council, and any other provisions that may supplement, amend, or regulate it. It shall be applied by PIYION INC. hereinafter referred to as PIYION with respect to the collection, storage, use, circulation, deletion, and all other activities that constitute the processing of personal data. Any gaps in the aforementioned regulations shall be interpreted in accordance with the provisions of Colombian legislation in general, as well as in light of Articles 15 and 20 of the National Constitution of the Republic of Colombia and international law, while taking into account the provisions established in Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016. Accordingly, PIYION states that it guarantees the rights to privacy, personal intimacy, and a good reputation regarding the processing of personal data; consequently, all its actions shall be governed by the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security, and confidentiality. Any person who—in the course of various contractual, commercial, virtual, or other activities, whether on a permanent or occasional basis—provides PIYION with any type of information or personal data, shall have the right to access, update, and rectify such information or data.

2. DEFINITIONS

For the purposes of implementing this Policy and in accordance with legal regulations, the following definitions shall apply: a) Authorization: Prior, express, and informed consent given by the owner of the information and personal data, allowing PIYION to carry out activities that involve the processing of said personal data; b) Privacy Notice: A physical or electronic document—or one in any other format—generated by the Data Controller and made available to the data owner regarding the processing of their personal data. The Privacy Notice informs the data owner about the existence of the Information Processing Policy applicable to them, how to access it, and the purpose for which the personal data is intended to be processed; c) Database: An organized set of personal data that is subject to processing by PIYION ; d) Personal data: Any information linked to, or that can be associated with, one or more specific or identifiable natural persons; e) Public data: Data classified as such under the mandates of the law or the Political Constitution, and which is not classified as semi-private, private, or sensitive. Public data includes, among other things, information regarding a person’s civil status, profession or trade, status as a merchant or public servant, and any information that can be obtained without any restrictions. By their nature, public data may be contained in, for example, public registries, public documents, official gazettes and bulletins, as well as in final judicial rulings that are not subject to confidentiality requirements under express legal provisions; f) Private data: Data that, due to its intimate or confidential nature, is relevant only to the data subject; g) Sensitive data: Data that affects the privacy of the data subject or whose misuse could lead to discrimination. This includes information revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in labor unions, social organizations, or human rights groups—or organizations that promote the interests of any political party or safeguard the rights and guarantees of opposition political parties—as well as data concerning health, sexual orientation, and biometric data. Because such information may affect an individual’s privacy, all reasonable security measures have been adopted to protect it, and the necessary authorizations have been obtained to carry out the relevant activities. Furthermore, clients, applicants, current and former employees, and suppliers have been informed about how their data is processed, the purpose of such processing, and the duration for which their information is retained in our databases. h) Data Processor: A natural or legal person, whether public or private, who, either independently or in association with others, carries out the processing of personal data on behalf of the Data Controller; i) Data Controller: A natural or legal person, whether public or private, who, either independently or in association with others, makes decisions regarding the database and/or the processing of the data; j) Data Subject: A natural person whose personal data is subject to processing; k) Processing: Any operation or set of operations performed on personal data, such as the collection, storage, use, dissemination, or deletion thereof; l) Transfer: A data transfer occurs when the Data Controller and/or Data Processor—located in Colombia—sends information or personal data to a recipient (who is also a Data Controller) located either within or outside the country; m) Transmission: A transmission is a form of processing involving the communication of information and personal data—either within or outside the territory of the Republic of Colombia—for the purpose of having a Data Processor carry out processing activities on behalf of the Data Controller; n) National Database Registry: A public directory of personal databases subject to processing activities within the country, administered by the Superintendency of Industry and Commerce, which serves as the primary administrative authority for the oversight and control of personal data processing and habeas data; ñ) Data security incident: A breach of security protocols, or the loss, theft, and/or unauthorized access to personal data processed by the Data Controller or Data Processor. Incident management refers to the documentation of corrective and preventive steps to be taken in the event of potential incidents; this process must define timelines, roles, and responsibilities; o) Social engineering: techniques used by criminals to deceive users of information and communication technology (ICT) systems/services in order to obtain data such as credentials, information about the systems they use, and installed services, among other things; p) Demonstrated accountability: the manner in which an entity must comply (in practice) with personal data protection regulations, and how it must demonstrate that the measures implemented are useful, relevant, and efficient; q) Malware: a term derived from the combination of the English words “malicious” and “software.” The purpose of malware is to damage or infiltrate an information system without the owner’s consent. Examples include viruses, worms, Trojans, backdoors, and spyware. r) Cookie: a file downloaded to a user’s device when accessing certain web pages; it collects information about the user’s browsing experience, which helps in understanding such experiences and establishing necessary improvements to provide a more efficient and secure service. Cookies are not spam, computer worms, or viruses capable of damaging a user’s browser or device.

3. PURPOSE FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA, AND THE INFORMATION COLLECTED:

Data is collected from users of the Application—whether they are companies, clients, administrators, advisors, or end users. This includes account information, contact details, conversations, activity, analytics, and metrics, as well as business information used to identify needs, create commercial profiles of clients and prospects, provide support, address requests, and improve the customer experience. The use of conversations for promotional purposes PIYION INC. will require authorization or an applicable legal basis.

PIYION may use personal data to: i) Review and address requests for services made by the Data Subject at any time; ii) Exercise its right to gain a sufficient understanding of the client/affiliate/user with whom it intends to establish a relationship or provide services, and to assess the current or future risks associated with such relationships and services; iii) Offer—either jointly with third parties, separately, or on behalf of third parties—financial, commercial, and related services, as well as conduct promotional, marketing, advertising, charitable, or social service campaigns, whether independently or in collaboration with third parties. This is done in light of their mutual synergies and their combined capacity to provide more favorable service conditions to their clients. Consequently, for the purposes described, PIYION may: i) Access, store, and process all information provided by the Data Subject in one or more databases, in whatever format it deems most appropriate; ii) Organize, catalog, classify, divide, or separate the information provided by the Data Subject; iii) Verify, corroborate, confirm, validate, investigate, or compare the information provided by the Data Subject against any information it may legitimately possess, including information held by its parent companies, subsidiaries, affiliates, or any other related company. PIYION. iv) To access, consult, compare, and evaluate all information concerning the Data Subject that is stored in the databases of any credit, financial, judicial, or security-related risk bureau—whether public or private, domestic or foreign—or any commercial or service-related database, in order to establish a comprehensive and historically complete record of the Data Subject’s conduct in their capacity as a debtor, user, client, guarantor, endorser, affiliate, beneficiary, subscriber, taxpayer, and/or holder of financial, commercial, or other types of services. v) To analyze, process, evaluate, handle, or compare the information provided by the Data Subject. The data resulting from such analysis, processing, evaluation, handling, or comparison shall be subject to the same authorizations granted by the Data Subject in the Authorization Form regarding the information originally provided. vi) To study, analyze, customize, and use the information provided by the Data Subject for the purpose of monitoring, developing, and/or improving—both on an individual and general level—service conditions, administration, security, or customer support, as well as for implementing marketing plans, campaigns, special benefits, and promotions. PIYION may share the results of the aforementioned studies, analyses, customizations, and uses—as well as all information and personal data provided by the Data Subject—with its shareholders, parent companies, subsidiaries, related entities, affiliates, or other companies within the same corporate group, or with business partners who agree to abide by the terms of this authorization. vii) To report, communicate, or grant access to the information provided by the Data Subject—or any other information held regarding the Data Subject—to legally established credit, financial, commercial, or service-related risk bureaus, and to financial institutions, in accordance with applicable regulations.

Furthermore, PIYION it may use the personal data and information of its clients to:

a) Maintain a record of individuals who complete or review forms, surveys, or other virtual tools used by PIYION. b) Understand, observe, and analyze the tastes, preferences, needs, and interests of clients, prospects, and potential business partners. c) Provide the services and products offered by PIYION and requested by its users. d) Provide information regarding new products, services, or changes thereto. e) Evaluate service quality, manage support requests, and improve the customer experience. f) Conduct internal studies on consumption and usage habits. g) Send information—via physical or digital means—regarding products or services offered by PIYION or third parties, provided there is authorization or an applicable legal basis. h) Retain data concerning transactions, orders, billing, and payment status when necessary—noting that PIYION does not intend to store full payment card credentials. i) Provide business references upon the data subject’s request. j) Track sales, accounts receivable, and business opportunities. k) Customize software services and technologies according to client needs. l) Analyze system performance and effectiveness to enhance productivity and user experience. m) Identify opportunities for business process optimization. n) Comply with applicable data protection regulations. o) Create commercial profiles of clients and prospects based on their business information, interactions, interests, needs, and stage within the commercial process. p) Provide support, document cases, resolve issues, and measure customer satisfaction and experience. q) Manage reminders and communications regarding abandoned shopping carts, subject to the data subject’s authorization and communication preferences.

Purpose for collecting information on potential clients (natural or legal persons): To maintain a database of potential clients interested in our services with whom we may establish a business relationship.

Purpose of processing information regarding registered users (natural or legal persons): To authenticate the client upon accessing the platform, provide purchased services, analyze information, identify areas for improvement, understand user needs and interests based on their activity on the website, and thereby offer a better service experience, provide access to offers, market products, and keep users informed about new developments.

Purpose of processing data regarding applicants, current employees, and former employees of PIYION INC.: Personal information of applicants, current employees, and former employees—including their immediate family members—is collected for the purpose of fulfilling obligations arising from their respective employment relationships. Such obligations include, among others: payroll processing, granting benefits, performance evaluations, improving training processes, handling requests, issuing certificates and official statements, enrolling individuals in Social Protection System entities, conducting workplace well-being activities, maintaining accounting records, submitting reports to regulatory and oversight authorities, communicating with employees, managing tax liabilities, and maintaining contact in the event of an absence. This falls under the scope of organizational performance management.

Furthermore, personal information may be collected from applicants participating in selection processes for the purpose of carrying out the necessary hiring procedures. Additionally, information provided by individuals participating in these processes may be stored indefinitely and used for future personnel selection processes.

Moreover, PIYION may record or capture audio, video, or photographs of employees during events, training sessions, or other activities. These audio recordings, videos, or photos may be used by PIYION in bulletins, reports, announcements, advertising, promotional materials, publications, and, in general, in any of the organization’s activities—even after the employee has left the organization.

Purpose for processing information regarding suppliers and contractors:

1. To access, update, and rectify personal data. 2. To invite companies that provide the requested types of services to submit price quotes, enter into contracts, and present work proposals as part of the relevant procurement process. 3. To monitor and track obligations arising from contracting processes, ensuring compliance with the established quality and safety parameters; this also applies to providers who, due to the nature of their work, are entrusted with a database belonging to PIYION—in which case they must fully comply with all data protection requirements and other legal provisions stipulated in the supplier contract. Otherwise, such information and personal data may be disclosed to national or international regulatory and supervisory authorities, in response to legal, administrative, or regulatory requirements; furthermore, such information and personal data may be used or disclosed to defend the property rights of PIYION and our clients, or for the detection or prevention of fraud, as well as for the apprehension or prosecution of criminal acts. 4. To compile a database of potential suppliers for the company’s future product and service requirements. 5. To carry out processes related to the evaluation of proposals, payments, consolidation, organization, updating, quality assurance, accreditation, statistics, reporting, interaction, auditing, surveys, legal defense, and the management of the company’s operations, information, and activities. 6. To verify whether a supplier appears on any restricted lists—such as those concerning money laundering or terrorist financing—or any other list that would preclude the establishment of a contractual relationship. 7. To grant access to information and personal data to auditors or third parties engaged for internal or external audit processes related to our business operations. 8. Evaluate the capability and suitability of a potential supplier—including the individuals under their coordination—to meet supplier selection requirements by verifying the supporting documentation submitted during the process, such as résumés, proof of experience, and academic credentials, among others. 9. Request from the supplier or distributor—as well as from the personnel assigned to perform the contracted service or work—the relevant documentation confirming their enrollment in the general social security system.

If personal data is provided, such information shall be used solely for the purposes specified herein; therefore, PIYION it shall not be sold, licensed, transmitted, or disclosed, except when: (i) the data subject has provided express authorization; (ii) it is necessary to enable contractors or agents to perform the assigned services; (iii) it is necessary for the provision of our services and/or products; (iv) it is necessary to disclose such information to entities that provide marketing services on behalf of PIYION or to other entities with which there are joint marketing agreements; (v) the information relates to a merger, consolidation, acquisition, divestiture, or other corporate restructuring process; or (vi) such disclosure is required or permitted by law.

PIYION Third parties may be engaged as subcontractors to process specific functions or information. In cases where the processing of personal data is subcontracted to third parties, or where personal data is provided to third-party service providers, PIYION such third parties are instructed to protect the personal data using appropriate security measures; the use of this information for their own purposes is prohibited, and it must be limited to the purposes specified by PIYION; furthermore, they are required not to disclose the personal data to any other parties.

For the purposes mentioned above, PIYION third parties providing services to this company may be granted access to the collected information, provided that adequate data management is guaranteed and the identity and confidentiality of the data subjects are protected. To this end, PIYION appropriate precautionary measures will be taken prior to the transfer of such data. This includes requiring third parties to have in place proper data processing policies—applicable to recipients—as well as confidentiality agreements, where necessary. Furthermore, the right to collect, use, and share the provided data is secured based on the user’s prior, informed consent, as granted through the authorization for the processing of personal data.

3.1. DATA ANALYSIS

Regarding the processing of data—which, for PIYION, serves the purposes of product promotion and the management of personnel and suppliers—it is important to note that PIYION is a software development company. Consequently, data may be used to personalize the user experience by offering services and products tailored to each client’s individual preferences. It may also be used to conduct internal analyses to better understand how clients interact with our services, identify areas for improvement in internal processes, and optimize the operational efficiency of PIYION, as well as to identify opportunities for innovation in our products and services, anticipate future market needs, and develop advanced technological solutions.

We wish to emphasize that the security of your data is our highest priority. Therefore, under no circumstances will your personal data (such as document type, document number, first and last names, phone number, or email address) be used in the creation of reports on consumer habits. For these purposes, personal data will be disassociated—anonymized—so that the resulting insights cannot be linked to any specific individual.

Considering that PIYION it will collect data from individuals belonging to member countries of the European Union, PIYION states that the collected data offers an adequate level of protection under the framework of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, providing appropriate safeguards for the personal data of this population. Such data is collected in an appropriate and lawful manner, in line with the needs of the users who provide their personal data, while respecting their general interests.

International data transfers that may arise PIYION will be carried out in accordance with the provisions of the GDPR. Therefore, by signing the authorization for the processing of personal data, you are authorizing PIYION to use this information in line with its objectives and approach, as set out in this policy. PIYION will respect the rights of the data subjects and ensure an adequate level of protection. Such transfers of personal data are made solely for the purpose of fulfilling the legitimate interests for which the data subject provides their personal data to PIYION. Furthermore, such transfers are not repetitive and will only concern the data subjects, whose rights and interests take precedence.

Website: Web analytics tools are used to obtain aggregated information on traffic to websites—covering audience, acquisition, behavior, and conversions occurring on the site. This service is provided by an intermediary that supplies information on how to improve the website’s service, but under no circumstances does it provide personal information.

Data of potential clients (individuals or legal entities): Data collected via our website and our sales agents is processed using an in-house or third-party email marketing platform. This platform enables the management of contacts and the scheduling of marketing activities aimed at converting potential clients into registered clients, or offering services to non-registered individuals (such as providing service quotes).

Data of registered users (individuals or legal entities): This data is managed within our platform, where we analyze user behavior on our webpages. Such data is provided directly by our users, allowing us to understand their tastes and preferences. This information also helps us organize promotional efforts and service delivery, ensuring an excellent user experience. Consequently, we maintain digital records that allow us to analyze, calculate, and develop statistical data—information we deem relevant to the operation and marketing of our services, as well as to maintaining long-term commercial relationships with our clients.

Data of job applicants, current employees, and former employees: PIYIONWe maintain digital files containing resumes and all information requested from job applicants, current employees, and former employees. This allows us to access the data as needed to carry out the processes described in the stated purpose for this type of database. These digital files are stored on our servers and on computers located within the department assigned to handle these processes.

Suppliers and contractors: Information is processed via a series of digital files containing data on suppliers, proposals submitted, PIYION and performance analyses—that is, our experience working with each supplier. These digital files are organized into categories, and the data is stored on our servers and the computers of the relevant department. Contractors and suppliers may also provide their information in person by completing supplier registration forms at our facilities.

3.2. DATA SUBJECTS

Users: This category includes anyone who accesses our website—whether an individual or someone visiting on behalf of a company to learn about PIYION.

These individuals do not register on our website; therefore, we consider them anonymous.

Potential clients: individuals who are interested in receiving notifications and commercial information from PIYION and who, for this purpose, provide us with their details to receive such information—whether digitally, in physical form, or through a sales representative. This type of client is categorized as follows:

Individuals: persons interested in our services or who wish to obtain commercial information via our website, social media, or sales representatives, and who provide us with their name, email address, and phone number.

Companies: individuals who, on behalf of a company, provide us with their details (company name, contact person’s name and job title, email, phone number, and address) for the purpose of receiving commercial information about our services—whether via our website, social media, or sales representatives.

Registered users: individuals who, in order to use our services, complete the registration process in our system—either through our website or via a sales representative.

Registered individuals: persons who register by providing their national identification number, full name, phone number, address, email, and age. Through our web portal, they are assigned a password—which they must then customize—to access our services, which are focused on the promotion and marketing of vehicles.

Registered companies: entities that register by providing their official identification number, company name, address, the full name of a contact person for the legal entity, and an email address.

Applicants, current employees, and former employees: individuals who provide us with information relevant to selection processes and the fulfillment of obligations arising from employment relationships.

Suppliers and contractors: These are the individuals or legal entities that provide PIYION INC. with the products and services necessary to fulfill its objectives; for this reason, we consider our suppliers to be strategic partners in the success of our operations.

3.3. INFORMATION COLLECTED

The information that may be collected PIYION includes: user or company name; age; gender; address; official identification; email addresses; phone numbers; profile information; date of birth; country, state/department, and city; the company for which the individual works; job title; academic, professional, family, social security, payroll, and banking information (when necessary for an employment or contractual relationship); and other information described in this Policy. For purposes of commercial profiling and customer management, business-related information may also be collected, such as the legal business name, sector or industry, company size, location and market, website, products or services, business model, needs, interests, purchase intent, sales stage, interaction history, CRM notes, support requests and cases, and experience or satisfaction ratings. Through e-commerce integrations, information may also be processed regarding products viewed, cart content and value, abandoned cart status, orders, discounts, shipping and billing details, and transaction status.

Data concerning users, administrators, and companies is used to: (i) manage accounts and provide the service; (ii) send promotional information about products and services, where applicable; (iii) track the sales process; (iv) compile statistics; (v) conduct commercial profiling of customers and prospects; (vi) provide support, document requests, and improve the customer experience; and (vii) manage communications regarding abandoned carts. Clients of PIYION may store data belonging to their end users in order to carry out their business processes; in this context, the client acts as the Data Controller and PIYION acts as the Data Processor, unless a specific activity dictates a different designation in accordance with the law and the applicable contract.

Documents that data subjects are requested to complete and provide: i) A completed Supplier Registration Form; ii) A copy of the identity document (for individuals) or a copy of the legal representative’s identity document (for legal entities); iii) A current Chamber of Commerce certificate for the principal place of business and any branch office(s) (if applicable); iv) An updated Unified Tax Registry (RUT); v) The income tax return for the immediately preceding year; vi) Financial statements as of December 31 of the immediately preceding year, including the balance sheet and income statement with notes; vii) Current quality management certificates (if held); viii) Operating authorizations (where applicable, e.g., for security firms, transport companies, customs agencies, accredited laboratories, telecommunications providers, prepaid medical service companies, etc.); ix) A portfolio of products and/or services; x) A current document certifying the existence and legal representation of the entity in its country of principal domicile, issued no more than 60 days prior. This document must be duly legalized in accordance with applicable regulations—meaning it must include an official translation (if in a language other than Spanish) and a chain of authentication (comprising the notary and consulate in the country of origin, followed by the Ministry of Foreign Affairs in Colombia); xi) A document certifying registration in the equivalent of a tax registry (such as the RUT) in the country of principal domicile, duly apostilled; xii) Operating authorizations, licenses, or permits (where applicable—e.g., for transport companies, customs agencies, accredited laboratories, or telecommunications providers—duly apostilled).

3.3.1. Specific information collected based on the category and type of Data Subject

a) Website: You may be a User, a potential client (individual or legal entity), or a registered client (individual or legal entity). The following procedures, carried out on our website, apply to all these types of clients. Piyion website

The content or information collected includes: internet browser, computer or operating system, online identifiers (such as IP address), connection speed, geographic location, the point of entry to our website, or the sites from which you connected to our website. Furthermore, we analyze the time spent and behavioral patterns on the site to improve our service. Information is collected directly from the data subject via the website, including personally identifiable information such as: name, identification number, telephone number, employer (company), email address, location, residential address, and economic, cultural, or mental health-related information, among other required data.

b) Potential clients: Potential clients are subdivided as described in this policy.

c) Individual (natural person) users: This category consists of clients who register in our database by providing the following information: type of identification document, identification number, full name, email address, contact telephone number, department/state, city, address, password, and age. Additionally, PIYION users may post testimonials on our website, which may contain personal information such as their name, residential address, and details regarding the services they wish to market.

d) Corporate users: These are entities that contract for the services of PIYION for the supply of products offered by PIYION. The information they provide—whether through the web portal or a sales representative—includes their legal business name, tax identification number (NIT), the legal representative’s identification, address, email, telephone number, and residency information.

e) Data regarding applicants, current employees, and former employees of PIYION INC: This database contains information on our applicants, current employees, and former employees, and is managed by the Human Resources department.

f) Suppliers and contractors: These are the natural or legal persons that supply PIYION with the products and services necessary to meet its objectives; for this reason, we consider our suppliers to be strategic partners in the execution of our operations.

Suppliers and contractors selected through our procurement processes will be evaluated periodically to assess their performance during the execution of their contracts. This allows us to define objectives for continuous improvement, ensuring that the supply of goods or services meets high standards of quality and efficiency.

g) Payment methods: PIYION INC. We primarily use Stripe as a technology provider for payment processing. When a data subject makes a payment via this service, the information required to process the transaction may be collected or received directly by Stripe, in accordance with its own terms, conditions, and privacy policy.

PIYION INC. We may receive and retain information related to the transaction, such as the payer’s identification, email address, payment purpose, amount, currency, date, payment status, receipts, and—where applicable—limited details regarding the payment method used, such as the card brand and the last four digits of the card number. PIYION INC. We do not store full card numbers, CVV security codes, or complete payment credentials.

Authorization for the processing of payment-related data may be obtained through contractual clauses, electronic mechanisms, or the clear, unambiguous actions of the data subject, provided that they have been previously furnished with sufficient information regarding such processing and that PIYION INC. we are able to retain evidence of the mechanism used. Making a payment does not constitute authorization for commercial purposes other than those previously disclosed.

In exceptional cases, PIYION INC. we may accept other payment methods, subject to internal authorization by our President, provided that these are documented in the relevant subscription contract, commercial agreement, or equivalent document. In these cases, only the data necessary to execute, verify, reconcile, and validate payments, prevent fraud, manage the contractual relationship, and comply with applicable legal, tax, and accounting obligations will be processed and shared.

Financial providers or payment processors may process certain data in accordance with their own legal obligations and privacy policies. The Data Subject may consult Stripe’s privacy policy at Stripe Privacy Policy.

3.4. HOW INFORMATION IS COLLECTED

Information may be provided directly by Data Subjects via email, telephone, in-person interaction, websites, applications, social media, WhatsApp, virtual platforms, commercial agents, events, forms, and registration processes; it may also be received through integrations, APIs, webhooks, cookies, and similar technologies, in accordance with the settings authorized by the client and the Data Subject.

3.4.1. Websites and automatic data collection

Our websites use a technology known as “cookies”—files that can be downloaded to your device via the websites. These tools play an essential role in the provision of many information society services. Among other functions, they allow a website to store and retrieve information about a user’s browsing habits or their device; depending on the information obtained, they can be used to recognize the user and improve the service provided. Information is also collected directly from the Data Subject through the completion of forms.

Information may be collected or synchronized by PIYION INC. through the platform and active channels and integrations, including Google, TikTok, WhatsApp, Instagram, Facebook Messenger, LinkedIn, iMessage, Meta Business, email, websites, contact forms, WooCommerce, Shopify, Zoho CRM, and Zapier. It can also be received via phone calls, online or physical forms, and direct contact with the individual.

Information from digital channels and partners may be transmitted via APIs, webhooks, and pre-configured automations. The scope of the data depends on the enabled integration, the permissions granted, the client’s configuration, and the provider’s terms. PIYION will limit data processing to the purposes described in this Policy, the instructions provided by the client (when PIYION acts as a data processor), and the applicable agreements with providers and sub-processors.

3.4.2. Third-party integrations and e-commerce

Depending on the integrations enabled by each client, PIYION INC. the platform can connect directly with Meta and its services (Facebook, Instagram, Messenger, and the WhatsApp API), Telegram, TikTok, Google, WooCommerce, Shopify, Zoho CRM, Zapier, contact forms (including those managed via “Contact Form” or similar tools), as well as the client’s own APIs or systems for which a specific, documented integration has been requested. It may also connect with other channels and platforms that might be integrated as the platform PIYION evolves over time.

The mention of these platforms does not imply that all integrations are available to every client. Their availability and scope depend on the service plan, the configuration applied, the features offered by each provider, and the permissions granted by the client.

These integrations allow the client to access and utilize PIYION specific features inherent to the connected platforms. Depending on the integration enabled, PIYION the client may receive, view, transmit, or synchronize account and profile identifiers; data regarding contacts, customers, and leads; messages and interactions; forms; campaigns and audiences; as well as information related to products, browsing activity, shopping carts, orders, discounts, shipping, invoicing, and transaction statuses. CRM opportunities, activities, notes, and cases; files; metadata; technical logs; and any other fields specifically authorized by the client.

In the case of a client’s proprietary APIs or specific systems, the scope of the connection shall be defined in the request, contract, technical annex, or other applicable document. Such a document may identify the data involved, the permitted purposes, the responsibilities of the parties, the conditions for access, and the corresponding security measures. The client must possess the necessary authorizations, permissions, and authority to allow for the access, transmission, or synchronization of the information included in the integration.

The activation and maintenance of integrations are carried out using the official or documented mechanisms provided by each platform, including their respective processes for authorization, verification, permission assignment, and technical validation. Where applicable, PIYION internal technical and legal reviews are conducted to verify the requested scope and ensure that the connection is configured in a direct, legitimate, and secure manner.

PIYION Personal credentials used by the client to log in to connected platforms—such as usernames, passwords, or one-time verification codes—are neither requested nor stored, provided that authentication takes place within the environment of the respective provider.

To establish and maintain the connection, PIYION essential technical information may be processed, such as account or business identifiers, connection addresses, granted permissions, access tokens, API keys, webhook secrets, integration status, and technical logs. These elements are used solely for the purpose of configuring, operating, verifying, maintaining, and securing the integration, and are subject to internal access controls and applicable security measures.

When PIYION processes personal data through an integration on behalf of and under the instructions of the client, it shall act as a Data Processor, while the client shall retain the status of Data Controller. This is without prejudice to any operations in which PIYION it acts as a Data Controller by directly determining the purposes and means of processing. Each third-party provider may also process information in accordance with its own terms, privacy policies, and legal obligations.

Data obtained through these integrations may be used to provide and automate the service; manage communications, contacts, and opportunities; perform commercial profiling; provide support; personalize and improve the customer experience; measure results; maintain security; prevent fraud; execute authorized automations; and manage the recovery of abandoned carts through reminders or authorized communications.

The aforementioned purposes apply depending on the platform, the permissions granted, and the relevant legal relationship. In the case of data obtained via Google APIs, only the purposes, restrictions, and conditions set forth in the following section shall apply; these shall take precedence over any incompatible general purpose contained in this Policy.

3.4.3. Specific processing of data obtained via Google APIs

This section specifically describes how PIYION INC. it accesses, uses, stores, protects, shares, and deletes information received via Google APIs. For the purposes of this section, “Google user data” refers to information obtained directly from a Google account or service through permissions authorized by the user.

Connection and authorization method: The connection is established using Google’s official OAuth 2.0 authorization system. Before the integration is activated, Google displays the requested permissions to the user. PIYION INC. It will only request the permissions necessary to enable the features selected by the user or the client organization. PIYION INC. It does not request, have access to, or store the user’s Google account password or personal verification codes.

The user may choose not to grant the requested permissions or may revoke them at a later time. In such cases, features that rely on integration with Google will no longer be available, without affecting any functionality PIYION that does not require such a connection.

Google data that PIYION may access: Depending on the enabled features and the permissions displayed on the consent screen, PIYION INC. it may access the following categories of information:

• Basic Google account information: Name, email address, unique account identifier, and profile picture (when included in the authorized permissions). This information is used to identify the user, link the Google account to their account, PIYION and manage the authorized connection.
• Google Calendar: Calendar identifiers and names; event titles, descriptions, dates, times, durations, and time zones; locations; participants; confirmation status; video conferencing links; reminders; and other information associated with the event. Depending on the permissions granted, PIYION it may view, create, update, or delete events only when requested by the user or when the action is part of an automation configured by the client.
• Google Sheets: Spreadsheet identifiers and names; tab names; ranges; cell values; and the headers, rows, columns, and metadata necessary to identify and update the connected spreadsheet. This information is used to import, export, query, or update data within processes configured by the client.
• Google Forms: form identifier and name; questions and structure; responses; date and time of submission; contact details requested in the form; and technical metadata necessary to synchronize the responses. This information is used to record and manage contacts, requests, opportunities, or cases within PIYION, in accordance with the configuration defined by the client.

PIYION INC. will not access other categories of Google data without the user first authorizing the corresponding permissions, and without this Policy being updated if such new access entails a substantial change in how the data is processed.

Permitted purposes: Google user data is used exclusively to authenticate and associate the connected account; enable features requested by the user; synchronize calendars, forms, and spreadsheets; create, retrieve, or update information at the user’s request; execute automations configured by the client; display within PIYION the information necessary to provide the connected functionality; offer technical support; prevent fraud, abuse, or unauthorized access; and comply with applicable legal obligations.

Limited Use of Google data: The use and transfer by PIYION INC. of information received via Google APIs shall comply with the Google API Services User Data Policy, including its “Limited Use” requirements.

Data received via Google APIs shall not be used, transferred, or sold for the purpose of:

• selling or providing it to data brokers, information resellers, or advertising platforms;
• displaying targeted, personalized, interest-based, or retargeted advertising;
• perform general commercial profiling unrelated to the function requested by the user;
• determine creditworthiness or make decisions regarding loans or financing;
• create databases for purposes other than the visible and authorized functionalities of PIYION;
• develop, train, or improve general, foundational, or non-personalized artificial intelligence or machine learning models; or
• carry out any processing that is incompatible with the authorization granted or with Google’s policies.

In particular, PIYION INC. user data obtained through Google APIs is not used to develop, improve, or train general or non-personalized artificial intelligence or machine learning models.

Human access: Personnel of PIYION INC. shall not manually read or access content obtained through Google APIs, except when: (i) the user requests support and expressly authorizes the review of specific information; (ii) it is necessary to investigate fraud, abuse, a security incident, or a technical error; (iii) it is necessary to comply with a legal obligation; or (iv) aggregated or anonymized information is used for permitted internal operations, without identifying the user. Access shall be limited to personnel who need to know the information to address the relevant purpose.

Disclosure and transfer: PIYION INC. Google user data is not sold. Such information may only be disclosed to the client organization and its authorized users; to technology providers or sub-processors necessary for hosting, protecting, maintaining, or providing the requested functionality; for the purpose of investigating and preventing fraud, abuse, or security incidents; or to comply with a legal obligation or a valid order from a competent authority; or as part of a merger, acquisition, or sale of assets, where applicable and subject to obtaining the prior consent required by Google and by applicable law. Providers with access will be subject to obligations regarding confidentiality, security, limited processing, and data deletion.

Storage and protection: PIYION INC. implements technical and organizational measures that are reasonable and proportionate to the risk in order to protect Google user data. These include: access controls based on roles and responsibilities; restricted access limited to authorized personnel; protection of tokens and integration secrets; logging and monitoring of technical events; logical separation of customer information; incident management procedures; and the use of secure connections during data transmission. Tokens and other technical authorization elements are used solely to maintain the requested connection and not to gain any access beyond what has been authorized by the user.

Retention and Deletion: Google user data will be retained only for as long as necessary to maintain the requested functionality, comply with customer instructions, provide the contracted service, resolve requests or incidents, and fulfill legal or contractual obligations. When a user disconnects the integration, revokes permissions, or requests deletion, PIYION INC. will cease making new requests to Google APIs and will delete or anonymize any stored copies that are no longer required, in accordance with its secure deletion procedures and applicable legal obligations.

Revoking access via Google prevents PIYION INC. the acquisition of new information, but it does not automatically delete previously stored data. To request the deletion of such data, the user may write to [email protected] with the subject line “Google Data Deletion Request.” PIYION INC. may request reasonable information to verify the identity of the requester and prevent unauthorized deletions.

The user may also revoke the connection via the integration settings PIYION or through the third-party app connections section of their Google account, available at Google Account connections.

The Data Subject may withdraw their consent or object to commercial communications through the channels specified in this Policy, without prejudice to any processing activities necessary for providing the service or fulfilling legal or contractual obligations.

PIYION does not forward or share a client’s chat information with another client. Furthermore, it commits to not discriminating against individuals—or suggesting arbitrary preferences or exclusions—based on characteristics protected by law, such as race, ethnicity, religion, gender, or sexual orientation. It also commits to not including offensive content, nudity, or sexually explicit material in its messages, and to complying with all applicable regulations and the usage policies of the integrated platforms, including services provided by Meta, WhatsApp, Instagram, Facebook, Messenger, Telegram, TikTok, Google, and other enabled providers.

3.4.4. Processing and specific integrations with Meta

PIYION’s status as a Meta Business Partner: As of the date this Policy was updated, PIYION INC. has been accepted into the Meta Business Partner program. This status confirms that PIYION has met the applicable processes and requirements for participation in the program, enabling it to provide specialized support for the implementation of Meta’s business solutions. This partnership status is subject to its ongoing validity, periodic verifications, and the program rules established by Meta. It does not imply that Meta manages PIYION, approves individual messages or campaigns created by its clients, or guarantees the uninterrupted functionality of the connected platforms.

Integrated channels and functionalities: Depending on the service contracted and the permissions granted by the client, PIYION may integrate functionalities from the WhatsApp Business Platform—including the WhatsApp Business API or Cloud API—as well as Facebook Messenger, Instagram Messaging (or Instagram Inbox), Facebook pages, professional Instagram accounts, Meta Business accounts and assets, lead forms, message templates, webhooks, metrics, and other business functionalities made available by Meta through its official interfaces.

These integrations allow for the centralization within PIYION of message receipt and transmission, support provided by human agents or authorized automated systems, conversation assignment and tracking, contact management, customer support, sales follow-up, the use of approved templates, the monitoring of delivery and read statuses, and the measurement of operational performance. The availability of each feature depends on the channel, country, account type, granted permissions, application review status, and Meta’s current policies.

Official, secure, and verified connection: PIYION establishes connections with Meta’s services using the APIs, registration mechanisms, onboarding processes, authorizations, permissions, reviews, and official validation procedures provided by Meta. Where applicable, the client logs in and grants permissions directly within environments controlled by Meta. PIYION does not request or store personal passwords for Facebook, Instagram, or WhatsApp, nor does it store personal two-factor authentication codes or verification codes used to access those accounts.

To facilitate the integration, PIYION may process access tokens, technical identifiers, business and WhatsApp Business account identifiers, business phone numbers, Facebook page and Instagram account identifiers, granted permissions, webhook secrets, connection statuses, and technical logs. These elements are used exclusively for configuring, authenticating, operating, monitoring, and securing the integration, and are subject to access controls, confidentiality protocols, technical logging, and other applicable security measures.

Information processed via Meta channels: Depending on the integration and the permissions granted, PIYION may receive, access, store, transmit, or synchronize user and contact names and identifiers; phone numbers; and photographs or profile information made available by Meta through its APIs. messages sent and received; attached files, images, audio, video, and documents; dates and times; conversation identifiers; status updates (sent, delivered, read, or error); responses to advertisements or forms; template data; assignment and support-handling data; metrics; billing or usage information associated with the service; and technical logs necessary to provide the requested functionality.

PIYION will use this information to provide the functionalities visible to and requested by the client, maintain a history of interactions, route and assign conversations, execute authorized automations, provide support, conduct commercial follow-ups, generate operational metrics, prevent fraud or abuse, diagnose errors, and comply with applicable legal or contractual obligations. PIYION will not share one client’s conversations with another client, nor will it use the information for purposes incompatible with this Policy, the client’s instructions, or Meta’s policies.

When PIYION processes data obtained from Meta channels on behalf of and under the instructions of a client, PIYION acts as a Data Processor, and the client acts as the Data Controller. PIYION may act as a Data Controller regarding data and processing activities for which it directly determines the purposes and means—such as contractual administration, billing, security, internal support, and legal compliance. Meta processes information in accordance with its own terms, policies, and applicable legal roles.

Transparency regarding charges for WhatsApp and other Meta services: Charges for the use of the WhatsApp Business Platform are determined by Meta and may depend on factors including, but not limited to, the recipient’s country or market, the message category, the number of messages delivered, volume, currency, taxes, promotional or free periods, and any changes implemented by Meta. Categories may include marketing, utility, authentication, and service messages. Rates, categories, time windows, and terms are subject to change at Meta’s discretion.

PIYION will clearly inform the client which items correspond to Meta’s charges, distinguishing them from PIYION’s own fees for licensing, implementation, support, guidance, or other services, in accordance with the applicable contract or plan. Where relevant, PIYION will provide access to usage data, reports, account statements, invoices, or supporting documentation that allow the client to understand the origin and breakdown of the amounts charged. Estimated or projected figures may differ from the final charges due to the classification, delivery, and settlement processes applied by Meta, as well as applicable taxes, exchange rates, or changes to official rates.

The client may review the current rates and terms published by Meta on its official WhatsApp Business Platform pricing page. PIYION does not control the rates set by Meta and cannot guarantee that they will remain unchanged.

Message templates: Initiating certain types of communications on WhatsApp may require the use of templates that have been submitted to Meta for approval. The client is responsible for ensuring that the content provided is truthful, lawful, relevant, and consistent with the declared category and purpose, and for obtaining all necessary authorizations and consents to contact the recipients. Meta retains the exclusive right to review, approve, reject, pause, disable, or reclassify templates, and to modify its criteria for doing so.

While PIYION may provide tools, technical guidance, and support for the creation, submission, management, and monitoring of templates, it cannot guarantee their approval, classification, continuous availability, cost, reach, or performance. The initial approval of a template does not preclude Meta from subsequently reviewing, pausing, or rejecting it.

Client responsibility for the health of their accounts and lines: The client is responsible for maintaining the quality and health of their accounts, pages, profiles, business portfolios, WhatsApp Business accounts, phone numbers, and templates connected to PIYION. To this end, the client must, among other obligations:

• obtain and retain the required consents before sending communications;
• contact only those individuals who would reasonably expect to receive the messages;
• clearly identify the sending business and keep their business profile information up to date;
• immediately honor requests for opt-outs, blocking, or cancellation;
• avoid misleading messages, prohibited content, spam, abusive practices, and unauthorized mass messaging;
• use templates solely for the approved purpose and category;
• secure access to their accounts, users, administrators, and devices;
• monitor quality, reports, blocks, errors, limits, and notifications provided by Meta or PIYION; and
• comply with the terms of service, as well as the messaging, commerce, advertising, community, and privacy policies—and any other applicable rules—set forth by Meta, WhatsApp, Facebook, and Instagram.

Meta may limit messaging volume, reduce limits, pause or disable templates, restrict functionality, suspend accounts, or block phone numbers if it detects low quality, negative feedback, reports, unusual activity, security risks, or potential non-compliance. Such decisions are made by Meta in accordance with its own systems, reviews, and policies, and may occur even while an account is technically connected to PIYION.

Scope of support provided by PIYION: PIYION provides the technology platform and may offer guidance, monitoring, technical support, best practices, configuration assistance, and help with submitting review or appeal requests whenever Meta makes such mechanisms available. However, PIYION does not control Meta’s decisions and cannot guarantee that a line, account, template, page, or profile will not be restricted, suspended, disconnected, or blocked. Furthermore, PIYION cannot guarantee the approval of an appeal, the reinstatement of an account, or any specific response time from Meta.

The client must promptly inform PIYION of any alerts, restrictions, or incidents related to their connected assets and cooperate by providing the information necessary for support. PIYION’s assistance does not replace the client’s direct and ongoing obligation to comply with Meta’s requirements, nor does it shift responsibility to PIYION for the content, audiences, consents, campaigns, or messaging practices defined by the client.

To review the applicable rules, the client may consult the WhatsApp Business messaging policy and other official terms and policies published by Meta for each channel.

3.4.5. Data delivery to the client

In the event that a client PIYION requires the export of the contact database collected on the platform, PIYION, PIYION arrangements can be made for the download and delivery of such data. This delivery will be carried out using a secure format accessible to the client.

Data delivery procedure:

1.The client PIYION must submit a formal request through the channel designated by PIYION, specifying the data required and the purpose of the request.

2.PIYION will verify the identity of the requesting client to ensure that the request is legitimate and originates from the data subject.

3.PIYION and the client will agree upon the format and delivery method for the requested data.

4.PIYION will proceed to download and deliver the data in the agreed-upon format, ensuring that all security and confidentiality requirements are met.

5.A detailed record of the request, identity verification, delivery agreement, and confirmation of the completed delivery will be maintained.

3.5. COOKIE POLICY

This Cookie Policy applies to the Digital Service offered by PIYION and is part of this personal data protection policy, which describes our practices regarding the use of cookies.

Within the Digital Services used by PIYION INC., various technologies are employed, including cookies (“Cookies and Similar Technologies”).

We encourage you to continue reading to learn about the types of cookies we may use, why we use them, and how you can make choices regarding these cookies and similar technologies.

COOKIES

These are small text files downloaded to the computer or mobile device that a user employs to access a specific webpage; they serve as a means of identification. Cookies—along with other similar technologies such as pixels and local storage—are necessary to enable and optimize the functioning of digital services and to collect information that helps tailor a website’s content to the interests of its visitors.

Cookies may remain on a computer for varying lengths of time, depending on their type. Persistent cookies remain on the computer until they are deleted, while session cookies remain on the device until the computer (or browser) is closed.

Purpose of web analytics and cookies: a) to drive continuous improvement of the online experience for users, potential customers, and registered clients, b) to help measure the results of traffic-generation campaigns, c) …estimating how traffic to a website changes following the launch of a new advertising campaign. Web analytics provide information on the number of website visitors and page views. This helps in measuring traffic and popularity trends—useful for market research—as well as remembering previous visits, determining whether a page has been visited before (to inform subsequent actions, such as displaying specific content), or recognizing a returning user. When a user enters their username and password, a cookie is stored so that they do not need to re-enter these credentials for every page on the server.

Types of cookies: Depending on the entity that manages the domain from which the cookies are sent and processes the data obtained, two types can be distinguished:

• First-party cookies: those sent to the user’s terminal device from a computer or domain managed by the publisher itself—the same entity providing the service requested by the user.

• Third-party cookies: those sent to the user’s terminal device from a computer or domain that is not managed by the publisher, but rather by another entity that processes the data obtained through these cookies.

If cookies are installed from a computer or domain managed by the publisher, but the information collected through them is managed by a third party, they cannot be considered first-party cookies.

There is also a second classification based on the length of time they remain stored in the client’s browser, which can be categorized as follows:

• Session cookies: designed to collect and store data while the user is accessing a webpage. They are typically used to store information that only needs to be kept for the duration of the specific service requested by the user (for example, a list of purchased products).

• Persistent cookies: data remains stored on the device and can be accessed and processed for a period defined by the party responsible for the cookie, which may range from a few minutes to several years.

Finally, there is another classification consisting of six types of cookies, based on the purpose for which the collected data is processed:

• Technical cookies: these allow the user to navigate through a website, platform, or application and use the various options or services available therein—for example, controlling traffic and data communication, identifying a session, accessing restricted areas, remembering items in an order, completing the purchase process for an order, submitting an application or registration for an event, using security features during navigation, storing content for the playback of video or audio, or sharing content via social media.

• Personalization cookies: these allow the user to access a service with certain predefined general characteristics based on specific criteria on the user’s device, such as language, the type of browser used to access the service, the regional settings from which the service is accessed, etc.

• Analytics cookies: these allow the party responsible for them to track and analyze the behavior of users on the websites to which they are linked. The information collected through these types of cookies is used to measure activity on websites, applications, or platforms, and to create browsing profiles for users of such sites, applications, and platforms, with the aim of making improvements based on the analysis of how users interact with the service.

• Advertising cookies: these allow for the management of advertising space in the most effective way possible.

• Behavioral advertising cookies: these store information about user behavior obtained through the continuous observation of their browsing habits, which allows for the development of a specific profile used to display targeted advertising.

• External social media cookies: these are used to allow visitors to interact with content from various social platforms (Facebook, YouTube, Twitter, LinkedIn, etc.) and are generated exclusively for users of those social networks. The terms governing the use of these cookies and the information collected are subject to the privacy policy of the respective social platform.

3.6. DATA COLLECTION BASED ON DATA SUBJECT TYPE

3.6.1. Potential clients (prospects), whether individuals or legal entities

Data collection for potential clients takes place in two ways: through our websites and via our commercial agents.

a) Data collection via our website occurs when an individual interested in our services provides their contact details to get in touch with us, or when someone requests information from our site and provides their contact details so that we may send it to them.

b) Data collection by our commercial agents occurs during the course of a business relationship, at which point contact information is exchanged.

3.6.2. Registered users, whether individuals or legal entities

a) Individual user: This process involves completing a form on our website when requesting a service; PIYIONregistration can also be facilitated through our commercial agents.

b) Business user: This involves completing a client registration form on our website, following the conclusion of a commercial engagement with one of our commercial agents.

3.6.3. Data of applicants, active employees, and former employees of PIYION INC.

Data collection takes place during the selection process, which includes requesting resumes and other information relevant to the process, and concludes with the hiring of the suitable individual(s) for the position.

3.6.4. Suppliers and contractors

When a need for suppliers or contractors arises, the company searches for and registers candidates interested in submitting proposals. This involves evaluating their technical and organizational capacity, experience, and subject-matter expertise, as well as addressing the legal requirements necessary for the supplier contracting process.

4. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

PIYION INC., in its capacity as the party responsible for the processing of personal data, declares that this Personal Data Processing Policy complies with the legal provisions set forth in Law 1581 of 2012 and the Single Regulatory Decree 1074 of 2015. Consequently, in the course of processing activities, the implementation of this policy, and its interpretation—based on the aforementioned regulations—the following principles shall be applied in a harmonious manner::

a) Principle of purpose: The processing of collected personal data must serve a legitimate purpose, which must be disclosed to the data subject; b) Principle of consent (freedom): Processing may only be carried out with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives the requirement for consent; c) Principle of veracity or quality: Information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. Data that is partial, incomplete, fragmented, or misleading shall not be processed; d) Principle of transparency: In the processing of data, the right of the data subject to obtain— PIYION INC. at any time and without restrictions—information regarding the existence of data concerning them must be guaranteed; e) Principle of access and restricted circulation: Processing is subject to the limits derived from the nature of the personal data, the provisions of this Law, and the Constitution. Personal data—excluding public information and data subject to the terms of an authorization granted by the data subject—may not be made available on the Internet or through other mass media or communication channels, unless access can be technically controlled to restrict availability solely to the data subjects themselves or to authorized third parties. f) Principle of security: Information subject to processing by PIYION INC. must be protected through the implementation of necessary technical, human, and administrative measures to ensure the security of the records, preventing their alteration, loss, or unauthorized or fraudulent consultation, use, or access. g) Principle of confidentiality: All individuals involved in the processing of personal data are obligated to maintain the confidentiality of the information, even after their involvement in any of the tasks related to such processing has concluded. h) General principle regarding transfers: Personal data that are being processed—or are intended to be processed following their transfer to a third country or international organization—may only be transferred if such transfer is conducted in a lawful, legal, and transparent manner, and provided that the data controller and the data processor comply with the conditions established in this chapter. This includes requirements concerning any subsequent transfers of personal data from that third country or international organization to another third country or international organization. All provisions of this chapter shall apply to ensure that the level of protection for natural persons guaranteed by this Regulation is not undermined.

FIRST PARAGRAPH: In the event that sensitive personal data is collected, the Data Subject may refuse to authorize its processing.

5. RIGHTS OF DATA SUBJECTS WHOSE PERSONAL DATA IS PROCESSED BY PIYION INC.

Data subjects—either personally, through a representative and/or authorized agent, or via a successor—may exercise the following rights regarding personal data that is being processed by: PIYION:

a) Right of access: Under which the data subject may access personal data that is under the control of: PIYION INC. , for the purpose of consulting such data free of charge at least once per calendar month, and whenever there are substantial changes to the Information Processing Policies that warrant further consultation; b) Right to update, rectify, and erase: Under which the data subject may request the updating, rectification, and/or erasure of personal data being processed, in order to fulfill the purposes of the processing. This right may be exercised, among other instances, in relation to data that is partial, inaccurate, incomplete, fragmented, or misleading, or in relation to data whose processing is expressly prohibited by law or has not been authorized by the data subject; c) Right to request proof of authorization: except in cases where, under applicable legal regulations, authorization is not required for processing; d) Right to be informed regarding the use of the personal data; e) The right to file complaints with the Superintendency of Industry and Commerce regarding violations of the provisions set forth in current regulations concerning the processing of personal data; f) The right to demand compliance with orders issued by the Superintendency of Industry and Commerce; g) The right to revoke the authorization granted to PIYION INC., in the event that the processing of personal data PIYION fails to uphold the principles, rights, and guarantees established by the Constitution and the law.

FIRST PARAGRAPH: In order to exercise the rights described above, both the data subject and their representative must provide proof of their identity and, where applicable, evidence of the capacity in which they represent the data subject.

SECOND PARAGRAPH: Revocation and/or deletion shall apply when the Superintendency of Industry and Commerce has determined that, in the course of data processing, the Data Controller or Data Processor has engaged in conduct contrary to this law and the Constitution..

THIRD PARAGRAPH: The rights of minors shall be exercised by the persons authorized to represent them.

6. PIYION’S DUTIES

All those obligated to comply with this policy must bear in mind that PIYION the entity is required to fulfill the duties imposed by law in this regard. Consequently, the following obligations must be met:

6.1. Duties when acting as a Data Controller:

(i) To request and retain, under the conditions set forth in this policy, a copy of the authorization granted by the data subject. (ii) To clearly and sufficiently inform the data subject of the purpose of the data collection and the rights they hold by virtue of the authorization granted. (iii) To provide information, upon the data subject’s request, regarding the use made of their personal data. (iv) To process inquiries and complaints in accordance with the terms specified in this policy. (v) To ensure compliance with the principles of accuracy, quality, security, and confidentiality, as established in this policy. (vi) To store information under the necessary security conditions to prevent its alteration, loss, or unauthorized or fraudulent consultation, use, or access. (vii) Update information whenever necessary. (viii) Rectify personal data whenever appropriate.

6.2. Duties when acting as a Data Processor.

If you process data on behalf of another entity or organization (the Data Controller), you must fulfill the following duties: (i) Verify that the Data Controller is authorized to provide the personal data that you will process in your capacity as a Data Processor. (ii) Ensure that the data subject can fully and effectively exercise the right of habeas data at all times. (iii) To store information under the necessary security conditions to prevent its alteration, loss, or unauthorized or fraudulent consultation, use, or access. (iv) Update, rectify, or delete data in a timely manner. (v) Update information reported by Data Controllers within five (5) business days of its receipt. (vi) Process inquiries and complaints submitted by data subjects in accordance with the terms set forth in this policy. (vii) Record the notation “complaint in progress” (“reclamo en trámite”) in the database, as established in this policy. (viii) Insert the notation “information under judicial dispute” (“información en discusión judicial”) into the database upon being notified by a competent authority regarding legal proceedings concerning the quality of the personal data. (ix) Refrain from circulating information that is being contested by the data subject and for which the Superintendency of Industry and Commerce has ordered a block. (x) Grant access to information only to individuals authorized by the data subject or empowered by law to access such information. (xi) Notify the Superintendency of Industry and Commerce when violations of security codes occur and risks exist regarding the management of data subjects’ information. (xii) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

6.3. Duties when carrying out data processing through a Processor:

(i) Provide the Processor only with personal data for which processing has been previously authorized. For the purposes of national or international data transmission, a personal data transmission agreement must be signed, or contractual clauses must be established in accordance with the provisions of Article 25 of Decree 1377 of 2013.(ii) Ensure that the information provided to the Processor is truthful, complete, accurate, up-to-date, verifiable, and understandable. (iii) Promptly notify the Data Processor of any changes regarding the data previously provided, and take any other necessary measures to ensure that the information supplied remains up to date. (iv) Promptly inform the Data Processor of any rectifications made to personal data so that the Processor may carry out the necessary adjustments. (v) Require the Data Processor, at all times, to comply with the security and privacy conditions applicable to the data subject’s information. (vi) Notify the Data Processor whenever specific information is being contested by the data subject—that is, once a formal complaint has been filed and the corresponding resolution process is still ongoing.

6.4. Obligations regarding the Superintendency of Industry and Commerce:

(i) Notify the Superintendency of any potential breaches of security protocols or risks identified in the management of data subjects’ information. (ii) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

6.5. Obligations regarding the processing of information concerning minors:

PIYION Acknowledge and adhere to the prohibition established in Article 7 of Law 1581 of 2012 concerning the processing of data belonging to minors, except in cases where such data is considered to be of a public nature.

In light of the above, PIYION the organization shall uphold and respect the best interests of minors, ensuring absolute respect for their fundamental rights. Furthermore, it shall refrain from processing such data without the express authorization of the legal representative of the minor to whom the information belongs—in accordance with applicable law and this Data Protection Policy—while also ensuring that the minor is given the opportunity to be heard, taking into account their capacity to comprehend the terms of the authorization granted by their legal representatives.

7. REQUEST FOR AUTHORIZATION FROM THE DATA SUBJECT

Prior to and/or at the time of collecting personal data, PIYION INC. the data subject shall be asked for their authorization to collect and process such data, with the purpose for which the data is requested being specified. This request shall be made using automated technical, written, or oral means that allow for the retention of proof of the authorization and/or the unequivocal conduct described in Article 7 of Decree 1377 of 2013 and Article 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council. Such authorization shall be requested for a period that is reasonable and necessary to satisfy the needs that gave rise to the data request, and, in any event, in compliance with the legal provisions governing the matter.

7.1. SPECIFIC METHODS OF ACCEPTANCE

a) Website and acceptance of the Cookie Policy: PIYION On our website, Piyion website it is assumed that you accept the use of cookies if your internet browser is not configured to block them. Furthermore, information regarding our Cookie Policy can be found at the bottom of our webpage via a link that describes this privacy policy.

b) Cookie notice: We also provide a notice that informs our users about the use of cookies on our website and allows them to choose whether to accept them.

c) WhatsApp and other channels: By engaging in a conversation with PIYION via WhatsApp, Instagram, Facebook Messenger, Google, TikTok, LinkedIn, or other channels, you accept/consent to our personal data processing policy and terms and conditions. You also agree to receive marketing messages, useful updates, and broadcast messages directly through WhatsApp or other channels. This also includes email communications. These messages may contain information regarding our products, services, promotions, or other aspects relevant to our business relationship. If you do not wish to receive such messages, we recommend that you discontinue the conversation and/or request the removal of your personal data from our database.

d) Disabling and deleting cookies: You have the option to allow, block, or delete cookies installed on your device by adjusting the settings in your browser. If you disable cookies, some available services may cease to function. The method for disabling cookies varies by browser, but it can typically be done via the “Tools” or “Options” menu. You may also consult your browser’s “Help” menu for specific instructions. At any time, users may choose which cookies they wish to have active on this website.

e) Potential clients (individuals or legal entities): Authorization is provided by the potential client at the time they enter their details to access the application for PIYION or when completing forms provided on the website to establish a business contact or to receive information from PIYION. These forms include a checkbox that the client must select to indicate their agreement with the privacy policies of PIYION.

This checkbox serves as evidence that the user, by providing their personal data, has given express consent for the processing of said data.

This authorization will be included in all forms found on the website, whether for contact or subscription purposes.

Data collected by commercial agents will require the signing of a form authorizing the processing of personal data.

f) Registered users, natural persons: The form that individuals complete when acquiring a product from PIYIONshall include a checkbox for the customer to indicate their agreement to the privacy policies and terms of service of PIYION.

This checkbox serves as evidence that the user, by providing their personal data, has given express consent for the processing of said data.

Data collected by commercial agents will require the signing of a form authorizing the processing of personal data.

g) Corporate registered users: The signing of a commercial contract and a personal data processing agreement by PIYION and the company contracting the services—following an assessment of said agreement—serves as evidence of authorization. In this, both parties mutually acknowledge that they possess the legal capacity to enter into this personal data processing agreement and to be bound by it in the capacity in which they respectively act, under the terms agreed upon therein. If registration is completed via the website, the processing must be expressly authorized by checking the authorization box.

h) Data regarding applicants, current employees, and former employees of PIYION INC: It is understood that any individual who submits their resume to PIYION by any means, or who signs an employment contract with this organization, understands and authorizes the processing of their personal data. During the selection process, the applicant shall sign an authorization for the processing of personal data; employment contracts and internal regulations shall likewise include such authorization.

i) Suppliers and distributors: When a supplier and/or distributor registers as a potential supplier and/or distributor for PIYION, they provide their free and express consent for the handling of both their personal and business-related data. Furthermore, an authorization for the processing of personal data shall be signed by such parties at the time they complete the registration form for suppliers and/or distributors.

8. TEMPORAL LIMITATIONS ON THE PROCESSING OF PERSONAL DATA

PIYION INC. Personal data may only be collected, stored, used, or circulated for a period that is reasonable and necessary, in accordance with the purposes that justified the processing, and in compliance with applicable provisions—including those concerning administrative, accounting, tax, legal, and historical aspects of the information. Once the purpose(s) of the processing have been fulfilled, and without prejudice to any legal requirements to the contrary, the personal data in one’s possession shall be deleted. Notwithstanding the foregoing, personal data must be retained when required for the fulfillment of a legal or contractual obligation.

9. PROCEDURE FOR THE EXERCISE OF RIGHTS BY PERSONAL DATA SUBJECTS

Data subjects may exercise their rights through the channels established for this purpose.

Via email at: [email protected]

The data subject—or their authorized representative—may submit a request, complaint, or claim, Monday through Friday, from 8:00 a.m. to 5:00 p.m., using the telephone numbers or addresses listed below:

The request, complaint, or claim must include the data subject’s identification, a description of the facts giving rise to the claim, an address, and any supporting documentation. If the claim is incomplete, the interested party will be asked to address the deficiencies within five (5) days of the claim’s receipt. If two (2) months pass from the date of this request without the applicant providing the required information, it will be deemed that they have withdrawn the claim. If the party receiving the claim is not the appropriate entity to resolve it, they shall forward it to the relevant party within a maximum of two (2) business days and notify the interested party accordingly. Once a complete claim is received, a notation stating “claim in progress”—along with the reason for the claim—will be added to the database within no more than two (2) business days. This notation must remain in place until the claim has been resolved. The maximum period for addressing a claim shall be fifteen (15) business days, calculated from the day following the date of its receipt. If it is not possible to address the claim within this period, the interested party shall be informed of the reasons for the delay and the date by which the claim will be addressed; this date may, in no case, exceed eight (8) business days following the expiration of the initial period.

Likewise, through the same communication channel, requests may be made for information regarding the personal data of the Data Subject contained in any of the databases. Such requests shall be addressed within a maximum period of ten (10) business days, calculated from the date of receipt. If it is not possible to address the request within this period, the interested party shall be informed of the reasons for the delay and the date by which the request will be addressed; this date may, in no case, exceed five (5) business days following the expiration of the initial period.

10. SECURITY MEASURES

In accordance with the security principle established in Law 1581 of 2012 and the General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679, PIYION INC implements technical, human, contractual, and administrative measures that are reasonable and proportionate to the level of risk, in order to prevent the alteration, loss, unauthorized or fraudulent consultation, use, disclosure, or access to personal data. Access is restricted to personnel and service providers who require it for the performance of their duties, and is subject to confidentiality obligations and applicable internal protocols. These measures are periodically reviewed and updated to reflect technological, operational, and regulatory changes.

PIYION INC. uses cloud infrastructure services, including Google Cloud, to support the storage and processing of information. These services are subject to the terms, service level agreements, and security measures provided by the vendor. PIYION INC. evaluates its relationships with vendors and implements access controls and incident management in accordance with its internal processes. The description of specific measures may be updated upon completion of a technical review or the adoption of new controls, provided that the level of protection required by applicable regulations is not diminished.

11. VALIDITY

This Privacy and Personal Data Processing Policy of PIYION INC. This policy has been in effect since April 18, 2022, and was last updated on October 18, 2026. It shall remain in effect indefinitely for as long as contractual, commercial, employment, or informational relationships with the Data Subjects continue, without prejudice to the right to request the revocation of authorization or the deletion of data, where applicable.

In any event, and even if a request is made to revoke the authorization for data processing, PIYION please be advised that personal data will be retained whenever required to fulfill a legal or contractual obligation that has arisen between the company and the respective Data Subject.

PIYION The company reserves the right to adjust the content of this Data Protection Policy if the processing activities and/or the purposes for which personal data and information are processed change, or if regulatory changes in this area warrant such adjustments. In all cases, such changes will be duly communicated to the Data Subjects through effective communication channels—those commonly used in the ordinary course of the commercial or promotional relationships maintained with them.

Sincerely,

PIYION INC.

ANNEX 1. ADDITIONAL PROTOCOL FOR THE HANDLING OF PERSONAL INFORMATION BY PIYION INC.

Outlined below are specific parameters regarding the handling of personal information that govern the activities carried out by PIYION INC., hereinafter referred to as PIYION INC. This document has been developed in compliance with Law 1581 of 2012, “Establishing general provisions for the protection of personal data,” and the General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679. Under these regulations, all public or private entities that handle personal data must adopt an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, to guarantee the effective exercise of the rights of the data subjects. All information received by PIYION INC. through its various communication channels—whether in digital or printed format—which forms part of our databases and is obtained from clients, suppliers, employees, contractors, or other data subjects, is governed by the following usage policies.

A. Security measures: Personal data is stored and managed with access restricted to authorized users, utilizing individual credentials. PIYION INC. employs reasonable and appropriate security measures—proportional to the level of risk—to prevent data leaks, loss, alteration, or unauthorized access, in accordance with current internal protocols and applicable legal obligations.

B. Destruction Policy: In accordance with the principle of purpose limitation, information is considered temporary in nature; therefore, PIYION INC. assumes the responsibility to diligently delete all information from its databases five years after its last use. This does not preclude the data subject from requesting the deletion of their information at any time. To this end, the party responsible for data processing shall conduct an annual review to identify information that has reached the retention period stipulated herein and, consequently, must be deleted. Once a list of the information to be destroyed has been compiled, the existence of any physical or digital copies shall be verified to ensure complete deletion, followed by its removal from the centralized digital database.

C. Incident and Data Breach Policy: In the event that the loss, unauthorized disclosure, or unauthorized manipulation of information is detected, the party responsible for data processing or the company’s legal representative must report the incident to the Superintendency of Industry and Commerce (Superintendencia de Industria y Comercio) via its website, specifically through the Office of the Delegate for Personal Data Protection. Furthermore, where applicable, a formal complaint regarding the loss of information must be filed with the competent law enforcement authorities.

D. Provision of information to commercial partners: When providing information to commercial partners, the data controller must first request the personal data processing policy implemented by the third-party recipient and clarify the purpose for which the information is being transmitted. Furthermore, PIYION INC. the controller must ensure that the transfer of any information has been duly authorized by the data subject prior to the transmission.

E. Prevention against hackers and data leaks: General recommendations: Keep your password secure. If you forget it, PIYION INC. a new one can be generated upon your request and sent to your email address.

We offer the following recommendations for creating a password:

• Use a password with a minimum length of 8 characters. Additional characters make a password more robust.
• Use alphanumeric combinations. These are more difficult to guess, given the vast number of possible character combinations.
• Use a different password for each service. This way, if one password is compromised, it will be more difficult for an attacker to access the user’s other platforms.
• Avoid common words. Those with technical knowledge can crack a password in a matter of seconds.
• Exercise extra caution when selecting the “secret question” requested by some platforms. Much of the personal information shared on social media becomes public and could be used to figure out the answer.
• Be careful when accessing services from public spaces. Certain programs can facilitate interference with platforms and may even record your keystrokes.
• Change passwords periodically. This increases the security level of your credentials.
• Replace vowels with numbers. For example, “Mi Clave es segura” (My password is secure) becomes: M3 Cl1v2 2s s2g5r1.
• Use mnemonic devices, such as taking the first letter of each word in an easy-to-remember phrase. For example, “Mi Clave es segura” becomes: MCe10vs.
• Create passwords based on a consistent pattern. For example, append the initials of each social network to the end: MCe10vFB (Facebook), MCe10vTR (Twitter), MCe10vsGM (Gmail).

Techniques used by hackers to access information.

Phishing: A form of social engineering in which a scammer—posing as a trusted company or individual via a webpage or email—requests a password from a user, who, out of misplaced trust, provides the information.

Tabnapping: A user unknowingly visits a webpage that closely resembles one they frequently use; failing to notice that the web address (URL) is different, they end up providing their information to a fraudulent site.

Website-based theft: Many websites have significant security vulnerabilities—such as storing usernames and passwords in plain text (unencrypted)—which hackers know exactly how to exploit.

Brute force: This refers to obtaining passwords through trial and error, much like attempting every possible combination to open a lock.

The most well-known form of a brute-force attack involves software designed to crack passwords, which methodically tests millions of potential passwords against a given username. A weak password can be compromised in a matter of hours.

Eavesdropping: Many people believe they are 100% secure because they only visit safe, reputable websites; however, they may be unaware that malicious JavaScript can be present in any browser, on any system.

Keystroke logging is one function of such scripts, capturing all usernames and passwords entered while a session is active.

F. Backup of video recordings: Video recordings may be stored on an external third-party server; information regarding this must be made available to the public in a visible location. Furthermore, the party responsible for data processing must, in advance, request from the third party—who will receive the information—the Personal Data Processing Policy implemented by the entity that will manage the recordings.

G. User Management: Access to the centralized database is restricted to specific personnel, limited to staff in accounting, product activation, management, administrative roles, and sales. Each individual is assigned a unique user account and password, which is for their exclusive personal use and may not be shared under any circumstances.

Information regarding the party responsible for data processing:

PIYION INC.

ANNEX 2. AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA

1.By means of this document, I provide my prior, express, and informed consent to PIYION INC.—hereinafter referred to as “PIYION”—for the processing of information linked or potentially associable with me (“Personal Data”), including, but not limited to, email address, telephone number, physical address, banking information, name, and age. PIYION INC shall act as the “Data Controller” (Responsible Party) with respect to the purposes and means it determines directly, and as a “Data Processor” (Entity in Charge) when processing data on behalf of and under the instructions of a client who acts as the Data Controller. Personal Data may be subject to collection, storage, use, circulation, transmission, transfer, or deletion for the purposes of obtaining commercial offers, receiving information about products or promotions, providing requested services, managing purchases, offering support, enhancing the customer experience, conducting commercial profiling, and carrying out the corporate objectives of PIYION, in accordance with the terms of the Data Processing Policy, which is available upon request via email at [email protected].

2.This authorization is granted for Personal Data that will be processed in the future, as well as for Personal Data that has been processed by PIYION INC. in the past—a situation that is hereby ratified through this document.

3.PIYION will carry out the processing of data to fulfill all or some of the following purposes:

• To make transactions conducted with PIYION.

• more effective and secure; to offer users services and features tailored to their individual preferences and interests.

• To allow third parties that provide services to PIYION —or are otherwise affiliated with it—to access this information, provided that a legitimate purpose is ensured and that the data is managed appropriately and confidentially.

• To send information or messages regarding new products and/or services, display current advertisements or promotions, banners, news about PIYION and any other information deemed appropriate.

• To provide Personal Data to entities responsible for managing payments for products or services purchased by users.

4.Furthermore, I provide my express, free, and informed consent to PIYION to transfer, transmit, move, share, deliver, and/or disclose Personal Data—both domestically and internationally—whenever necessary to fulfill the purposes mentioned above.

5.The details of the Data Controller are as follows:

PIYION INC.

6.I declare and accept that PIYION, in compliance with the provisions of personal data protection regulations—specifically Law 1581 of 2012, Regulation (EU) 2016/679 of the European Parliament and of the Council, and Decree 1377 of 2013—I have been informed of my rights as the data subject (the individual to whom the personal data relates), namely:

• To access, update, and rectify personal data through the Data Controller or the Data Processor.

• To request proof of the authorization granted to the Data Controller—except in cases where such authorization is expressly exempted by law—as a requirement for the processing of data.

• To be informed, upon request, by the Data Controller or the Data Processor regarding how my personal data has been used.

• To lodge complaints with the competent authority regarding violations of data protection regulations.

• To revoke authorization and/or request the deletion of data when the processing does not comply with constitutional and legal principles, rights, and guarantees, subject to verification by the competent authority.

• To access, free of charge, the personal data that has been subject to processing.

If, within a period of thirty (30) business days from the date of this publication, the aforementioned data subjects have not expressed an objection or requested the deletion of their information—through any of the channels provided for in accordance with the terms established in Section 4 of Article 10 of Decree 1377 of 2014, including by sending a notification to the email address [email protected]— PIYION INC. will consider itself authorized by the data subjects and may continue processing personal data.

• Any other rights enshrined in the Policy of PIYION INC.

I authorize,

Signature: ______________________________________________