PRIVACY AND PERSONAL DATA PROCESSING POLICY

Niucore Technology S.A.S.

Niucore Technology S.A.S., a company identified with NIT 901.967.332-9 ("NIUCORE"), respects the personal data provided by its current and potential clients, employees, candidates, business partners, suppliers and anyone interested in NIUCORE's services. It has therefore implemented this Privacy and Personal Data Processing Policy (the "Policy"), in which we tell you what Personal Data we process, what we process it for, what your rights are as a Data Subject and the mechanisms you have to exercise them.

Use of the Platform—the software as a service (SaaS) through which the Services are provided—and of NIUCORE's software and/or Services, the execution of employment contracts, business alliances or service agreements, and/or the express and unequivocal acceptance of the terms and conditions and of this Policy, implies that you accept that we process your Personal Data in accordance with this Policy.

How can you better understand this Policy?

1. DEFINITIONS

To help you understand the Policy, here is what each term we use in this document means.

"Active Anonymization": the Platform's mechanism that replaces certain information with placeholders before sending it to artificial intelligence models and restores it in the response the User receives.

"Authorization": the prior, express and informed consent you give us to process your Personal Data.

"Database": the organized set of Personal Data that is subject to Processing.

"Client": the organization that contracts NIUCORE's Services and enables its Users to use them.

"Inquiry": the request you make as a Data Subject to find out what information we hold about you in our Databases.

"Anonymized Data": data that does not identify you personally and that NIUCORE may use for statistical or aggregate analysis.

"Personal Data": any information that serves to identify you.

"Private Personal Data": data that, because of its intimate or reserved nature, is relevant only to you as Data Subject.

"Semi-private Personal Data": data that is not intimate, reserved or public in nature and whose knowledge or disclosure may be of interest not only to you (the Data Subject) but to a certain sector or group of people, or to society in general. For example, financial, credit, commercial activity, service or social security data.

"Public Data": data classified as such by law and all data that is not semi-private, private or sensitive.

"Sensitive Data": data that affects your privacy or whose misuse may lead to discrimination, for example data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, trade union membership, as well as data relating to health, sex life and biometric data such as fingerprints, among others.

"Data Processor" (Encargado del Tratamiento): the natural or legal person, public or private, that carries out the Processing of Personal Data on the instructions of the Data Controller. NIUCORE acts as Data Processor with respect to the information its Clients upload to or generate in the Platform. In turn, NIUCORE may engage certain people or companies to act as Data Processors of your Personal Data.

"Purpose": the purpose for which NIUCORE will process your Personal Data.

"Platform": the software as a service (SaaS) through which the Services are provided.

"Claim": the request you make to exercise your rights relating to your Personal Data.

"Data Controller" (Responsable del Tratamiento): the natural or legal person, public or private, that decides on the Processing of Personal Data. NIUCORE is the Data Controller of the Personal Data indicated in section 2.1. For the data indicated in section 2.2, the Data Controller is the Client.

"Procedural Requirement": the prior step you must take before filing a complaint with the Superintendence of Industry and Commerce.

"Services": NIUCORE is a service provided as Software as a Service (SaaS), accessible in the cloud through an internet connection.

"Data Subject": you, the individual whose Personal Data is subject to Processing.

"Processing": any operation we carry out on your Personal Data, such as collection, storage, processing, analysis, use, circulation, transfer, transmission, updating, correction or deletion of Personal Data, among others.

"Transmission": the delivery of Personal Data to a Data Processor so that it carries out Processing of the Personal Data in accordance with the instructions given by the Data Controller, within or outside the territory of the Republic of Colombia.

"Transfer": the delivery of Personal Data so that another Data Controller carries out Processing of the Personal Data autonomously, within or outside the territory of the Republic of Colombia.

"User": an individual linked to a Client who accesses the Platform at the Client's invitation.

2. SCOPE

This Policy applies to the Personal Data processed by NIUCORE, which may act in two capacities:

2.1. As Data Controller, with respect to the Personal Data of its Clients and of their Administrators and Users that is necessary to create and manage accounts, provide support and bill; of people who fill in forms on its website or contact NIUCORE; and of its employees, candidates, partners and suppliers.

2.2. As Data Processor, with respect to the Personal Data contained in the documents, conversations and other information that Clients and their Users upload to or generate in the Platform. For that data, the Data Controller is the Client, and NIUCORE processes it on the Client's behalf, in accordance with its instructions and with the data transmission agreement set out in the Service's terms and conditions. If you are a Data Subject of that data—for example, a client, patient or employee of an organization that uses NIUCORE—the processing policy that applies to you is that organization's.

3. PRINCIPLES OF PERSONAL DATA PROCESSING

We will process Personal Data in accordance with the principles set out in article 4 of Law 1581 of 2012 and article 4 of Law 1266 of 2008, summarized below: Purpose: Processing must have a lawful purpose under the Constitution and the law, which we must inform you of. Necessity and reasonableness: the Personal Data NIUCORE holds must be what is necessary to fulfill the purposes of the Processing. Time limitation: the period during which we process Personal Data must be what is necessary to achieve the purpose for which it was collected. Freedom: we may only process Personal Data with your prior, express and informed authorization. Truthfulness: information subject to Processing must be true, complete, accurate, up to date, verifiable and understandable. Transparency: we must guarantee your right to obtain from NIUCORE, at any time and without restriction, information about the existence of your Personal Data in NIUCORE's Databases. Restricted access and circulation: Personal Data that is not public will be processed only by the people who need to do so to fulfill the purpose. Security: the Data Controller and Data Processor must comply with all the technical, human and administrative measures necessary to keep Personal Data secure. Confidentiality: everyone involved in Processing Personal Data that is not public must guarantee the confidentiality of the information. Non-discrimination: we will not engage in any act of discrimination based on the Personal Data collected. Redress: it is our obligation to compensate for harm caused by possible failures in the Processing of Personal Data. Limitation on collection: we will collect only the Personal Data necessary to fulfill the purposes of the Processing.

4. WHEN DO WE COLLECT YOUR PERSONAL DATA AND WHAT PERSONAL DATA DO WE COLLECT?

4.1. Data collection

NIUCORE collects Data Subjects' Personal Data in the following cases: when data subjects acquire and use NIUCORE's service; when Platform users share data within it for their use; when a partner transfers Data Subjects' Personal Data to us; when Data Subjects provide Personal Data voluntarily, for example by filling in NIUCORE forms; when Data Subjects are interested in joining NIUCORE's team and send their résumé or take part in a selection process; when you are going to enter into a contract of any kind with NIUCORE, for example an employment, services, business alliance, partnership, supply or mandate contract, or any other.

Personal data is obtained through the following channels: when Data Subjects acquire and use NIUCORE's Service, whether as Clients or as Users enabled by them; when Data Subjects voluntarily provide their data when registering in NIUCORE, filling in forms or interacting with the platform; when Data Subjects fill in the contact form on NIUCORE's website; when the administrators designated by Clients provide Users' information, such as name and contact number, in order to enable access to the Service; when Users interact within NIUCORE, through its conversational features or in the course of their activities; when Users authorize NIUCORE to connect to third-party services, such as their email, calendar or file storage; when Data Subjects contact the Company through support channels such as email or chat. Payment data, such as credit cards, is not collected directly, as the payment gateway is integrated with third parties such as Mercado Pago, who are responsible for that collection.

4.2. Information collected

NIUCORE may ask you for or collect—subject to the exceptions relating to sensitive data and data of children and adolescents—the data necessary to fulfill the purpose, which includes, among others:

Data we collect from all Data Subjects: first and last names, nationality, age, identification number and photocopy of identity document, date and place of birth, mailing address and city of residence, contact telephone number, email address, and any other Personal Data necessary to achieve the purposes described in the Policy.

Data we collect from NIUCORE's employees, former employees and applicants: in addition to the above, we will also collect marital status, professional license, employment, clinical or health, academic and financial history, employment and personal references, occupational medical history, the Data Subject's place of work, position or profession, résumé, certificates of affiliation to health, pension and severance funds, bank account number and financial institution, emergency contact details including name and relationship, and family data.

Data we collect from our partners and suppliers: in addition to the above, we will also collect data on the legal representative, financial and commercial information, legal and corporate information, technical or platform information, and data on their employees or collaborators with whom NIUCORE has contact.

Data we collect from our clients and Platform users: in addition to the above, we will also collect: tax ID (NIT), name or company name, logos, address of premises, website, country, commercial contact details, legal representative details, commercial activity, number of employees, number of transactions, browsing history in the Platform, usage and consumption records, and information relating to operations.

Data we collect through the website's contact form: name, email address, company, job title, country, industry, expected number of users, reason for the inquiry and the message you decide to send us.

Sensitive data and its processing: NIUCORE does not request Sensitive Data for its own purposes and will only collect and process it as Data Controller in the cases permitted by law, informing you that you are not obliged to provide it. Clients may, under their own responsibility as Data Controllers, upload to the Platform information containing third parties' Sensitive Data, such as health-related data; in that case NIUCORE processes it as Data Processor, in accordance with section 4.3, and it is the Client's responsibility to have the Data Subjects' explicit authorization.

Personal data relating to minors: NIUCORE will use minors' data only to plan and carry out activities related to the personal and family well-being of its employees. Only adults may access NIUCORE's services.

Image data: by taking part in videoconferences or events sponsored by NIUCORE, you accept and authorize your names and images to appear in advertising and promotional materials for promotional or commercial purposes for a period of 50 years.

Payment data: NIUCORE does not store sensitive financial information such as credit or debit card numbers. Transactions are processed directly by the Mercado Pago platform, which acts as an independent provider and is responsible for processing that data in accordance with its own privacy policy.

4.3. Data we process on behalf of our Clients

When a Client or its Users upload documents, hold conversations, authorize connectors or schedule tasks in the Platform, that information may contain third parties' Personal Data. NIUCORE processes it exclusively to provide the Service to the Client, which includes storing it, indexing it, analyzing it, applying Active Anonymization to it, transmitting it to artificial intelligence model providers to generate responses, building each area's working memory, running the tasks scheduled by Users and generating usage metrics. NIUCORE does not use that information for its own purposes or to train artificial intelligence models.

5. WHAT DO WE COLLECT YOUR PERSONAL DATA FOR?

NIUCORE will process Personal Data in accordance with the conditions established by the Data Subject for the conduct of its business activity. In general, NIUCORE will collect, store, organize, circulate, use, transmit and transfer Personal Data to fulfill NIUCORE's corporate purpose; keep and manage information on Data Subjects' employment, civil or commercial relationship; comply with the legal, accounting, commercial and regulatory duties that apply to NIUCORE; control and preserve the security of NIUCORE's people, property and information; fulfill the purpose of the employment, commercial or civil relationship NIUCORE has with Data Subjects; manage NIUCORE's website; verify Data Subjects' references in Databases; prevent and establish the commission of crimes or criminal conduct; maintain direct communication with Data Subjects; and carry out statistical, commercial, financial, social, administrative or technical analysis, among other purposes.

In particular, with respect to Clients and Users of the Platform, Personal Data is processed to: (a) create and manage accounts, Licenses and permissions; (b) provide the Service and support; (c) bill and manage charges; (d) record each User's use and consumption and make it available to the Client; (e) handle inquiries received through the contact form and support channels; (f) ensure the security of the Platform; (g) analyze the history of operations and the conversations of each area's Users to build a working profile of the area, which is stored with sensitive information replaced and is specific to each area; (h) recommend next steps to each User based on that profile and on the context of their conversations; (i) run the recurring tasks Users schedule, with their identity and permissions; and (j) generate the analytics and dashboards Users request, with the data they have access to.

Transmission and Transfer of Personal Data: NIUCORE may transfer or transmit Personal Data to one or more Data Processors or Data Controllers located within or outside the territory of the Republic of Colombia when you authorize us to do so, or when the law or an administrative or judicial order requires it. By accepting this Policy you authorize us to transfer or transmit your Personal Data to our partners, suppliers, parent company if any, or cloud computing service providers solely for the Purposes set out in this Policy.

To provide the Service, NIUCORE transmits information to: (i) cloud infrastructure providers, currently Amazon Web Services and Microsoft Azure; (ii) artificial intelligence model providers, the current list of which is published on NIUCORE's website and currently includes OpenAI, Anthropic, Google, xAI, DeepSeek, Alibaba, Moonshot AI, Zhipu and ByteDance; and (iii) support, messaging and payment processing providers. These providers may be located outside Colombia, in particular in the United States of America, in Singapore and, in the case of some model providers, in the People's Republic of China; some providers may process information in other countries where they maintain infrastructure. NIUCORE's website states where each model provider processes information. Information is transmitted to model providers with Active Anonymization applied, and each Client may restrict the model providers its Users use.

6. WHAT HAPPENS WITH THE AUTHORIZATION YOU GIVE US TO PROCESS YOUR SENSITIVE DATA, OR IF WE ARE GOING TO USE YOUR PERSONAL DATA FOR ANOTHER PURPOSE?

Authorization to Process Sensitive Data: when NIUCORE collects Sensitive Data or minors' data, your Authorization must be explicit; we will inform you that you are not obliged to authorize the Processing of that information, and we will inform you explicitly and in advance which Sensitive Data we will process and the Purpose of the Processing.

Authorization for new uses or purposes: NIUCORE will request your Authorization for new uses of your Personal Data, by publishing the changes to the Policy in our Platform and notifying you of the change.

Refraining from collecting data on criminal records: NIUCORE will process your Personal Data relating to criminal records solely in order to ensure the legality of its operations and the security of NIUCORE and its stakeholders, and to prevent fraud and money laundering.

7. WHAT ARE "COOKIES" AND WHAT DO WE USE THEM FOR?

Cookies: a cookie is a harmless file downloaded to your device when you access certain web pages. Cookies allow us to store and retrieve information about the browsing habits and trends of a user or their computer. NIUCORE uses its own and third-party cookies.

Information stored by cookies: cookies store technical information, such as personal preferences, content personalization, information you have previously entered in a form so that you do not have to fill it in again, and your interactions with our Platform.

Purposes for which we use the information collected through cookies: NIUCORE uses cookies to provide you with a high value-added service, as they save your preferences and the way, time and manner in which you use our Platform, and to generate metrics and analytics about visitors. You can refuse the use of cookies through the appropriate settings in your browser.

8. WHAT ARE YOU STATING WHEN YOU CLICK "I AUTHORIZE THE PROCESSING OF MY PERSONAL DATA"?

When you voluntarily provide your Personal Data and/or click "I authorize the processing of my Personal Data," you state that: you voluntarily provide us with your Personal Data and expressly and unequivocally authorize us to collect it and carry out any other Processing of your Personal Data, in accordance with this Policy; you were informed and understand that Sensitive Data is data that affects the Data Subject's privacy or whose misuse may lead to discrimination; you were informed that, where Sensitive Data is collected, you have the right not to provide the data requested; you were informed of the purposes for which your Personal Data and Sensitive Data will be used, which are described in this Policy; you were informed of and understand the security measures NIUCORE implements to protect the Personal Data it collects; you were informed of your rights in relation to your Personal Data and the mechanisms to exercise them; if you are a client, you were informed that you will enter into or have a contract in force with NIUCORE, and that NIUCORE therefore needs to be in permanent contact with you; if you are a User, you were informed that your organization's administrators can view your conversations and your use of the Platform, under the terms of section 10.

9. FOR HOW LONG WILL WE PROCESS YOUR DATA?

Term of the Authorization: we will process your Personal Data from the time you grant us the Authorization until the purpose for which the Personal Data was collected has ended.

Archiving of your Personal Data: the Data Subject's Personal Data will be processed by the Company for as long as is reasonable and necessary to fulfill the purposes expressly authorized in this Policy. However, once that initial purpose has ended, the Company may keep the Personal Data in a secure archive for the term required by applicable law. Once the legal retention periods have elapsed, the Personal Data will be securely deleted.

10. HOW DO WE LOOK AFTER YOUR PERSONAL DATA?

Security measures: NIUCORE implements role- and profile-based access controls to its information systems, IT security tools such as antivirus software and firewalls, and confidentiality agreements. Clients' data will be stored on Amazon Web Services (AWS), using secure containers such as AWS S3, and on Microsoft Azure, using Azure Blobs as a scalable storage solution. Both platforms hold standards such as ISO/IEC 27001. Information hosted on our servers is encrypted both at rest and in transit. Each Client's information is kept separate from that of the others.

Documents uploaded to the Platform: when a Client adds a document to a library, NIUCORE does not keep the original file once it has been processed. It keeps, within its own infrastructure, the text extracted from the document, and a search index which, with Active Anonymization enabled, is generated with sensitive information already replaced. When a User consults from a conversation a file hosted in a third-party service they have connected, NIUCORE accesses the original and does not copy it.

Policy on the elimination and/or deletion of Personal Data: once the Purpose of the Processing of your Personal Data has been fulfilled, or when the Data Subject requests it directly from NIUCORE, NIUCORE will delete or eliminate your Personal Data, provided there is no contractual or legal duty or obligation preventing it. If the Client does not renew its subscription to the Platform, or a trial period ends without the Client contracting the Service, NIUCORE will delete the hosted information three (3) months after the effective termination of the contractual relationship or of the trial period, except for the anonymized usage records it keeps for statistical and product improvement purposes.

Confidentiality, fundamental rights and anonymization: NIUCORE will refrain from disclosing, in whole or in part, confidential information received to any person not previously authorized. NIUCORE will anonymize Data Subjects' Personal Data when it considers that it may affect their right to privacy, good name and honor. In addition, the Platform has an Active Anonymization mechanism, enabled by default for all Clients, which replaces certain information—such as names, contact details, identification numbers and terms defined by the Client—with placeholders before sending it to artificial intelligence models, and restores it in the response the User receives. This mechanism reduces the information transmitted to the providers of those models, but does not necessarily detect all personal data.

Processing through language models (AI): NIUCORE uses artificial intelligence (AI) language models supplied by the third parties indicated in section 5, which it accesses through their enterprise services or their application programming interfaces, and not through their free or consumer versions. NIUCORE does not train its own models with Users' data. NIUCORE contracts with model providers under terms that exclude the use of information to train or improve their models, where the provider's standard application programming interface terms provide for it; NIUCORE's website states, for each provider, whether its terms include that exclusion, and each Client may restrict, by area, the model providers its Users use. In every case information is sent with Active Anonymization applied: the sensitive data detected is replaced with placeholders before it is sent, and the mapping between each placeholder and the original data remains within NIUCORE's infrastructure and is not transmitted to the provider.

Access by your organization: if you are a User, the administrators of the Client you belong to, and the people to whom the Client grants the corresponding permission, can view your conversations, your contexts and your usage metrics in the Platform, including those you keep private from other Users. Your organization is responsible for informing you of that oversight.

Working memory by area: the working profile the Platform builds for each area is stored with sensitive information replaced, is specific to each area, is not shared with other Clients and may be deleted by the Client's administrator. Each User sees only their own recommendations.

11. WHAT ARE YOUR RIGHTS AS A DATA SUBJECT AND HOW CAN YOU EXERCISE THEM?

You have the right to access, update and rectify your information, and/or revoke the Authorization for the Processing of your Personal Data. In detail, you have the right to: access, update and rectify your Personal Data; request proof of the Authorization granted, except in the cases where authorization is not required under article 10 of Law 1581 of 2012; be informed, upon request, of the use that has been made of your Personal Data; file complaints with the Superintendence of Industry and Commerce for breaches of the law; revoke the authorization and/or request the deletion of your Personal Data; access free of charge your Personal Data that has been subject to Processing. A request to delete information or to revoke the Authorization will not proceed when you have a legal or contractual duty to remain in NIUCORE's Database.

To exercise your rights, you must send an email to privacy@niucore.com, which will be handled by NIUCORE's data protection team. The email must be addressed to Niucore Technology S.A.S. and must specify: (i) the name and identification of the Data Subject or the person entitled; (ii) a precise and complete description of the facts giving rise to the Claim; (iii) what is sought; (iv) a physical or electronic address to which the response should be sent; and (v) documents and any other relevant evidence you wish to rely on. NIUCORE will respond to an Inquiry within a maximum of ten (10) business days, and to Claims within a maximum of fifteen (15) business days from the day after the date of receipt.

When your request relates to Personal Data that NIUCORE processes as Data Processor on behalf of a Client (section 2.2), you must address it to that Client, which is the Data Controller. If NIUCORE receives it, it will forward it to the corresponding Client and inform you.

12. WHAT DUTIES DOES NIUCORE HAVE REGARDING THE PROCESSING OF YOUR PERSONAL DATA?

NIUCORE is obliged to comply with the duties imposed by law. It must therefore: guarantee you, at all times, the full and effective exercise of the rights mentioned in this Policy; process your Personal Data in accordance with the principles set out in this Policy; keep information under the security conditions necessary to prevent its alteration, loss, or unauthorized or fraudulent consultation, use or access; update information when necessary; rectify your Personal Data where appropriate; promptly inform the Data Processor of all developments regarding the Personal Data previously supplied to it; require the Data Processor at all times to respect the security and privacy conditions of your Personal Data; inform the Superintendence of Industry and Commerce when security codes are breached and there are risks in the management of Data Subjects' information; comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

When acting as Data Processor, NIUCORE must also: process the data in accordance with the Client's instructions; maintain confidentiality; forward Data Subjects' inquiries and claims to the Client; and inform the Client of security incidents affecting the data.

13. WHAT OTHER INFORMATION DO YOU NEED TO KNOW?

Contact: any question or request for additional information will be received and handled through the email address: privacy@niucore.com.

Changes to the Personal Data Processing and protection policy: we will inform you in a timely manner of any substantial change to the Policy by publishing the new version in our Platform, and we will request your authorization through the same means.

Language: this Policy is provided in English for convenience. In the event of any discrepancy between this version and the Spanish version, the Spanish version will prevail.

Last updated: this Policy was last updated on [PUBLICATION DATE].