Privacy and Personal Data Processing Policy

1. Identity of the data controller

In compliance with Colombian Statutory Law 1581 of 2012, Decree 1074 of 2015 and related regulations, as well as with Regulation (EU) 2016/679 —the General Data Protection Regulation (hereinafter, "GDPR")— for data subjects resident in the European Economic Area, the controller of the personal data collected through this website is:

Any request, enquiry or complaint regarding the processing of personal data may be sent to the email address above, with the subject line "Personal Data Protection".

2. Definitions

For the purposes of this policy, the definitions in Article 3 of Law 1581 of 2012 and Article 4 of the GDPR apply:

• Authorisation: the data subject's prior, express and informed consent to the processing of their personal data.
• Database: an organised set of personal data subject to processing.
• Personal data: any information linked to, or that can be associated with, one or more identified or identifiable natural persons.
• Sensitive data: data affecting the data subject's privacy or whose misuse may lead to discrimination, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, data concerning sex life and biometric data.
• Processor: the natural or legal person that processes personal data on behalf of the controller.
• Controller: the natural or legal person that decides on the database and/or the processing of the data.
• Data subject: the natural person whose personal data is processed.
• Processing: any operation performed on personal data, such as collection, storage, use, circulation or deletion.
• Transmission: processing that involves communicating data within or outside the country so that a processor may process it on the controller's behalf.
• Transfer: sending data to a recipient that is itself a controller, located inside or outside the country.
• Privacy notice: the verbal or written communication addressed to the data subject informing them of the existence of this policy, how to access it and the purposes of the processing.

3. Scope and acceptance

This policy applies to all personal data recorded in ProBrokerSystems databases that is collected through this website and its versions in other languages, through the contact forms, email, messaging channels and the social media profiles associated with the brand.

Using this site and voluntarily submitting data through its forms implies that you are aware of and accept this policy. If you do not agree with it, please refrain from providing personal data through these channels.

This policy does not apply to personal data that our clients process on their own platforms using the software or services we provide to them. In those cases the client acts as the data controller and ProBrokerSystems acts as processor, under the terms of the contract and the data processing agreement signed between the parties.

4. Personal data we process

Depending on the channel used and your relationship with us, we may process the following categories of data:

• Identification and contact data: first and last name, email address, phone number, country or city of residence, the company you represent and your role.
• Commercial and professional data: type of business, services of interest, description of the project or need, estimated budget and any other information you choose to include in your messages.
• Technical and browsing data: IP address, browser type and version, operating system, language, device, pages visited, date and time of access and referring page. This data is generated automatically by the infrastructure supporting the site.
• Identifiers stored in your browser: preferences saved through local storage, as detailed in the Cookies Policy.
• Communications data: the content of emails and messages exchanged with us, as well as records of commercial meetings or calls.
• Candidate data: if you send us your CV, we will process the professional and academic information it contains.

Through this site we do not request or collect credit card data, passwords, access credentials to third-party platforms, or financial information about your end clients.

5. Purposes of the processing

The personal data collected will be processed for the following purposes:

• Handling and responding to requests for information, quotes, demonstrations and commercial enquiries.
• Assessing the feasibility of the projects enquired about and preparing commercial proposals.
• Carrying out the pre-contractual, contractual and post-contractual stages of the services and products offered by ProBrokerSystems.
• Sending commercial information, newsletters, product updates and invitations to events or webinars, where the data subject has authorised it or where an ongoing commercial relationship exists.
• Conducting satisfaction surveys and follow-up activities relating to the commercial relationship.
• Operating, maintaining, measuring and improving the functioning, usability and security of this website.
• Preventing, detecting and investigating fraud, abuse or security incidents.
• Complying with applicable legal, accounting, tax and regulatory obligations, and responding to requests from competent administrative or judicial authorities.
• Running recruitment processes, where the data subject has submitted their CV.

ProBrokerSystems does not make automated decisions producing legal effects concerning data subjects, nor does it carry out profiling with such effects. We do not sell, rent or trade personal data with third parties.

6. Authorisation and legal bases for processing

Colombian regime. Under Article 9 of Law 1581 of 2012, processing requires the data subject's prior, express and informed authorisation. That authorisation is obtained, among other means, through the voluntary completion and submission of the site's forms, express acceptance of this policy in the checkbox provided, or any unequivocal conduct from which it can reasonably be concluded that the data subject granted authorisation. ProBrokerSystems will keep evidence of the authorisation granted by the technical and documentary means available.

European regime. For data subjects resident in the European Economic Area, processing is based on the following legal grounds under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)) for sending commercial communications and for using non-essential technologies.
• Performance of a contract or pre-contractual measures (Art. 6(1)(b)) to handle requests, prepare proposals and deliver contracted services.
• Compliance with a legal obligation (Art. 6(1)(c)) in accounting, tax and document retention matters.
• Legitimate interest (Art. 6(1)(f)) to ensure the security of the site, prevent fraud and send communications about similar products to existing clients, following a balancing of rights.

You may revoke your authorisation or withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand, unless a legal or contractual duty requires you to remain in the database.

7. Sensitive data and children's data

ProBrokerSystems does not collect sensitive data through this website. Should it exceptionally be necessary to process data of this nature, the data subject will be expressly informed that they are not obliged to authorise its processing and which of the requested data is optional, in accordance with Article 6 of Law 1581 of 2012.

This site is not directed at minors and we do not knowingly request their personal data. Where processing of children's and adolescents' data occurs, it will be carried out respecting their best interests and fundamental rights, with the prior authorisation of their legal representative. If we identify that we have received a minor's data without such authorisation, we will delete it.

8. Rights of data subjects

Under Article 8 of Law 1581 of 2012, the data subject has the right to:

• Access, update and rectify their personal data held by ProBrokerSystems as controller. This right may be exercised, among other cases, in relation to partial, inaccurate, incomplete or fragmented data, data that is misleading, or data whose processing is expressly prohibited or has not been authorised.
• Request proof of the authorisation granted, except where the law exempts this requirement.
• Be informed, upon request, of the use made of their personal data.
• File complaints with the Colombian Superintendence of Industry and Commerce for breaches of Law 1581 of 2012 and any rules amending, supplementing or replacing it.
• Revoke the authorisation and/or request deletion of the data where the processing does not respect constitutional and legal principles, rights and guarantees, as determined by the competent authority.
• Access their processed personal data free of charge.

These rights may be exercised by the data subject, their successors, their representative or attorney-in-fact, and by stipulation in favour of or for another party, subject to due accreditation of that capacity.

9. Additional rights under the GDPR

If you reside in the European Economic Area or the United Kingdom, in addition to the rights above you also have the following:

• Access to your personal data and to information about its processing.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") where the data is no longer necessary for the purposes disclosed.
• Restriction of processing in the cases set out in Article 18 of the GDPR.
• Portability of the data you have provided to us, in a structured, commonly used and machine-readable format.
• Objection to processing based on legitimate interest and, at any time and without justification, to processing for direct marketing purposes.
• Withdrawal of consent at any time, without retroactive effect on processing already carried out.
• Lodging a complaint with the competent supervisory authority in your country of residence.

10. Procedure for enquiries and complaints

Enquiries and complaints must be sent to sr@arcat.co with the subject line "Personal Data Protection", and must include at least: the data subject's full name, type and number of identity document, a clear description of the facts and of the request, a notification address or email for the reply, and any supporting documents. ProBrokerSystems may request additional information to verify the requester's identity.

Enquiries. Enquiries will be answered within a maximum of ten (10) business days from the date of receipt. Where this is not possible, the interested party will be informed before that deadline expires, stating the reasons for the delay and the date on which the enquiry will be answered, which may in no case exceed five (5) business days after the expiry of the first period.

Complaints. If a complaint is incomplete, the interested party will be asked to remedy the deficiencies within five (5) days of receipt. If two (2) months pass from the date of that request without the applicant providing the required information, the complaint will be deemed withdrawn. Once a complete complaint is received, a note reading "complaint in progress" together with its subject matter will be added to the database within no more than two (2) business days. The maximum period to resolve the complaint is fifteen (15) business days from the day following receipt, extendable by a further eight (8) business days, informing the interested party of the reasons for the delay and the new response date.

If ProBrokerSystems is not competent to resolve the complaint, it will refer it to the appropriate party within a maximum of two (2) business days and will inform the interested party accordingly.

Prior exhaustion requirement. Under Article 16 of Law 1581 of 2012, the data subject may only file a complaint with the Superintendence of Industry and Commerce after having exhausted the enquiry or complaint procedure before ProBrokerSystems.

For data subjects covered by the GDPR, requests will be answered within one (1) month, extendable by two further months depending on the complexity and number of requests, with notice of the extension given within the first month.

11. Processors, third parties and international transfers

To operate the site and deliver our services, ProBrokerSystems relies on suppliers that act as processors and are contractually bound to process data solely in accordance with our instructions and to apply appropriate security measures. These categories of supplier include:

• Form processing: FormSubmit (formsubmit.co), the service that receives and forwards to our inboxes the messages sent from the site's forms.
• Site translation: GTranslate (cdn.gtranslate.net), a widget that loads resources from the provider's servers and may record technical connection data.
• Infrastructure, hosting and content delivery for the website.
• Corporate email, messaging and calendar services.
• Customer relationship management (CRM) tools and electronic document signature services.

In addition, data may be disclosed to legal, accounting and audit advisers bound by confidentiality duties, and to administrative or judicial authorities where there is a legal obligation to do so.

International transfers and transmissions. Some of these suppliers are located outside Colombia, so processing may involve international transfers or transmissions of data. Under Article 26 of Law 1581 of 2012, such operations will only be carried out to countries that the Superintendence of Industry and Commerce has declared to provide an adequate level of protection, or under one of the exceptions provided by law, including the data subject's express and unequivocal authorisation, which you grant by accepting this policy. Where applicable, personal data transmission agreements will be signed with processors under Decree 1074 of 2015.

For data subjects covered by the GDPR, transfers outside the European Economic Area are based on European Commission adequacy decisions or on standard contractual clauses, in accordance with Chapter V of the GDPR.

12. Retention periods

Personal data will be retained for as long as necessary to fulfil the disclosed purposes and, thereafter, for the periods required by law. In particular:

• Client data linked to commercial transactions will be retained for the duration of the contractual relationship and for the statutory period for retaining commercial records, which in Colombia is ten (10) years from the closing of operations under the Commercial Code.
• Data of commercial contacts that does not lead to a contractual relationship will be retained for a maximum of two (2) years from the last interaction, unless the authorisation is revoked earlier.
• CVs of unsuccessful candidates will be retained for a maximum of one (1) year, unless express authorisation is given for a longer period.
• Authorisations and evidence of their granting will be retained for the duration of the processing and for as long as necessary to demonstrate regulatory compliance.

Once these periods have elapsed, the data will be securely deleted, anonymised or blocked.

13. Security measures

ProBrokerSystems adopts reasonable technical, human and administrative measures to secure records and prevent their alteration, loss, or unauthorised or fraudulent consultation, use or access. These include: encryption of communications via HTTPS/TLS, access control based on the principle of least privilege, strong authentication on critical systems, periodic backups, access logging, confidentiality agreements with staff, and assessment of suppliers that access personal data.

No system is completely infallible. In the event of a personal data breach, ProBrokerSystems will inform the Superintendence of Industry and Commerce in accordance with Article 17(n) of Law 1581 of 2012 and, where the incident poses a risk to the rights and freedoms of data subjects covered by the GDPR, will notify the competent supervisory authority within 72 hours of becoming aware of it, and the affected data subjects without undue delay.

14. Cookies and similar technologies

This site uses browser storage technologies to remember your display preferences and your interaction with the privacy notice. Details of these technologies, their purpose, duration and how to disable them are set out in our Cookies Policy, which forms an integral part of this policy.

15. Third-party links and services

This site contains links to websites and social media profiles operated by third parties, including LinkedIn, Instagram, Facebook, Telegram and the sites of related companies. ProBrokerSystems does not control and is not responsible for the privacy practices of those third parties. We recommend reviewing each site's privacy policy before providing personal data.

16. Changes to this policy

ProBrokerSystems may amend this policy at any time to reflect regulatory or case-law developments or changes to its internal processes. The version in force will always be the one published on this page, showing its update date. Under Decree 1074 of 2015, any substantial change to the purposes of the processing will be communicated to data subjects before implementation, through the registered contact channels or by means of a prominent notice on this site. If the change requires fresh authorisation, it will be requested in good time.

17. Term

This policy is effective from 3 August 2026 and remains in force until amended or repealed. The databases managed by ProBrokerSystems will remain active for as long as is reasonable and necessary to fulfil the purposes described in this policy and the applicable retention periods.

18. Governing law and contact

This policy is governed by Colombian Statutory Law 1581 of 2012, Decree 1074 of 2015, Law 1266 of 2008 to the extent applicable, and other related Colombian regulations; and by Regulation (EU) 2016/679 in respect of data subjects resident in the European Economic Area.

To exercise your rights or resolve any question about the processing of your personal data, write to us at sr@arcat.co.