Data Treatment and Privacy Notice

8. Personal Data Subject to Treatment

Truora collects or receives information and Personal Data that falls into the following general categories.

Data from Minors: Truora´s websites and applications are not directed to minors or those under 18 years of age. Truora does not knowingly collect any personal information directly from anyone under the age of 18. If you believe that we have processed personal information relating to a minor inappropriately, we encourage you to contact Truora using the information provided in the "Contact Us" section below.

Data in publicly accessible sources: Truora obtains data through remote or local means of electronic, optical, and other communication technologies in publicly accessible sources, that is, stored in sources that anyone can access and that include telephone directories, newspapers, gazettes, official bulletins, and social communication media, all in accordance with the applicable regulations. Therefore, Truora does not require consent to obtain personal data from publicly accessible sources.

9. Purposes and uses of the information

The personal data that is supplied to Truora will be given a Treatment in accordance with the following purposes for the use of the information, as applicable to each Data Owner:

• The correct execution of the contract formalized between the Data Owner and Truora.

• Account creation for the access to the Truora Platform

• Verification of identity with any current official document that serves to prove identity.

• Facilitation of contact between Truora and the Data Owner.

• Improvement of Truora's commercial and promotional initiatives, as well as analysis of the pages visited and searches carried out, to improve Truora's offer of content and articles, and customization of said content, its presentation, and services.

• Development of measurement studies regarding the participation of different sectors of the population in Truora.

• Sending information or text messages to the supplied cell phone, email, about new services, changes in the service and rates, payment reminders, promotions, events, and information of interest to the Data Owners in general.

• Billing and other tax effects, in which case it will be shared with the State entities responsible of carrying out said work.

• Analysis of Personal Information by Truora, its shareholders, Affiliates and/or Related Parties and third parties contracted for the development and promotion of the sale of its services.

• Complete the profile information on the Truora Platform.

• Payment processing of services purchased.

• Identity validation

• Compilation of the services that the Data Owners use and the way in which they use them.

• Obtain information from other sources and combine it with the information Truora collects through the Truora Platform.

• Review of police, criminal, or sex offender listing history.

• Review of Fraud Detection and Security Issues.

• Receipt of criminal background check results or fraud warnings from identity verification services for purposes of Truora's fraud prevention and risk assessment efforts.

• Reception of information about the Data Owner, his activities inside and outside the Truora Platform through its partners or information about the experiences and interactions that the Data Owner has had through our network by associated advertisers.

• Other communications and activities related to the corporate purpose of Truora.

 10. Duties and rights of the Data Owners

The Data Owners of the Personal Data provided to Truora will have the following rights:

• The right to know, update and rectify your Personal Information free of charge.
• The right to request proof of the existence of the authorization granted to Truora, except when expressly except in the law as a requirement for Treatment.
• The right to be informed, upon request, regarding the use that has been given to your Personal Information.
• The right to present before the Superintendence of Industry and Commerce or the competent authority, complaints for violations of the provisions of the current Law and the other regulations that modify, add, or complement the same.
• The power to revoke the authorization and the request for the deletion of the data when it is not used in accordance with the authorized uses and purposes. The revocation and/or deletion will proceed when the Superintendency of Industry and Commerce or the competent authority has determined that in the Treatment, Truora has incurred in conduct contrary to the law.
• The right to submit queries and claims regarding Personal Data.
  

The Data Owners of the personal information provided to Truora will have the following duties:

• The duty to provide truthful information, which can be verified by Truora for control and validation purposes. Truora will have the power to deny requests when it is verified that the information provided by the Data Owner is false or has inconsistencies.
• The duty to keep the contact information up to date, in order to ensure a more efficient and timely provision of the service, in addition to allowing a direct communication and information channel between Truora and the Data Owner.

11. Confidentiality of Personal Data

Personal Data provided by the Data Owners will be used only by Truora, its shareholders Owners, Linked and/or Related Parties and authorized third parties for such purposes, in accordance with the provisions of this Privacy Policy. The Data will not be used, in any event, for purposes other than those for which they were provided, which is why Truora will protect the privacy of Personal Information and will make its best efforts to keep it under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access, as well as the respect for the rights of the Data Owners of the same.

If for any reason a competent authority requests the disclosure of Personal Information, which is in Truora's possession, and, consequently, it is its legal obligation to supply it, Truora will proceed to deliver said Information, a situation that the Data Owners accept and authorize Truora for this purpose, in any case the Data Owner of said information will be informed.

12.  Information Security

In compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (in the case of Mexico), Statutory Law 1581 of 2012 (in the case of Colombia), the Lei Geral de Proteção de Dados Pessoais (in the case of the case of Brazil), Law 19,628 (in the case of Chile), the "General Data Protection Regulation or GDPR, and other legislation, international treaties, decrees, circulars, manuals, recommendations and/or relative and applicable regulations on Protection and Privacy of Personal Data, Truora has implemented administrative security measures to establish at the organizational level, the management, support and review of the security of the Personal Data, the identification and classification of information, as well as the awareness, education and training of its personnel in matter of personal data protection. Likewise, Truora has established physical security measures using state-of-the-art technology to prevent unauthorized access, damage or interference to its physical facilities, critical areas, equipment, and information to protect mobile computing equipment from any unauthorized access and has also implemented technical security measures so that access to our databases is only made by authorized users. Therefore, in the event of a breach of your personal data, we will analyze the causes for which said breach occurred and we will implement the necessary corrective, preventive, and improvement actions to make the necessary security adjustments to reduce the risk of a new infringement.

Notwithstanding the foregoing and considering that the services provided by Truora are developed through the Internet and that personal information is collected in the same way, there may be illegal interceptions or violation of systems and databases by unscrupulous or unauthorized persons. In this event Truora is not responsible for the improper use of the information obtained by these means.

12.1.  Information retention

The files that are under the responsibility of Truora must comply with the protocols and procedures established by the information security policy regarding asset management and information classification, in addition to complying with the following specifications:

• • The data of the Data Owner will be stored in separate instances, with access controls for reading.

• • Consultation of the information by unauthorized personnel must be avoided.

• • All files are encrypted when they are stored in the designated repository.

• • Transfers of sensitive or restricted files must be made through reliable messaging systems, where possible, with information encryption.

13. Media handling

Truora will implement procedures for the management of removable media in accordance with the classification scheme adopted by Truora. In any case, said procedures will correspond to the duties established below:

• Truora will destroy the media on which it stores confidential information when it is no longer needed for business reasons, such that the information is unrecoverable.
• Controls will be defined and implemented to protect the means with information that must be transported.
• Internal or external distribution of all types of media on which confidential information is stored will be strictly controlled.
• A classification of the means will be carried out in order to determine the confidentiality of the Data.
• Ensure all media moves are approved before moving from a secure area (including when media is being distributed to individuals).
• A detailed record of the inventory of all media will be kept.
• The use of mobile devices must be explicitly authorized, and they must comply with all policies, regulations and security standards defined in Truora, in order not to introduce risks within the corporate network.

14.  Transfers and Referrals

Truora makes national and international referrals and transfers of your Personal Data under the terms of the comprehensive privacy notice and in compliance with applicable legal provisions, communications or referrals made between Truora and those responsible for data processing do not require consent. (Article 2, section IX of the LFPD Regulations) and some transfers that are made within the provisions of article 37 of the LFPD do not require it either, when any transfer requires your consent, said situation will be clearly indicated in our notice of comprehensive privacy policy, so we invite you to consult it in the link that appears at the end of our privacy policy.

14.1.  Exchange of Personal Data.

When formal information exchange agreements are signed with third parties, Personal Data transfer procedures and/or protocols must be established that include the following security conditions as a minimum requirement:

• •  Establish responsibilities for control, delivery, and reception.
  • Mechanisms to ensure tracking and non-repudiation.
  • Establish responsibilities and obligations in the event of information security incidents, such as data loss.
  • Establish contractual safeguards on the ownership of information, the care of personal data, respect for copyright, software licenses and similar legal considerations.
  • Establish formal confidentiality agreements with recipients of information.

14.2.  Collection of information in exchanges.

All information to be managed or processed by Truora and that is considered of high and medium confidentiality, or its equivalent, will be received in a format previously established for such transmission between Truora and its clients and/or suppliers, through secure and encrypted media, taking the following considerations:

• • The exchange medium must be encrypted and have an authentication system, in addition to a medium access log.
  • The transmission of the information must be done through a protocol that guarantees the encryption of the data at the moment of transmitting the information.
  • The exchange medium must have access control limited by IP address, and only IP addresses previously informed by written communication from the Data Owner to the Data Owner of the information must be enabled.
  • The deposited information must be stored in said means of exchange for a maximum of 24 hours. It is necessary to delete at least once a day all the information contained in the means of exchange.
  • In the event that the Data Owner is unable to provide an information exchange media with the characteristics described above, the Grupo Truora may provide said media, complying with all the parameters described above.
  • The use of the client´s or the supplier´s protocol that complies the highest level of security may be assessed.
  • When information reception mechanisms are established, Truora will establish controls to prevent the entry of viruses or malware into its data network.
  • The exchange of information via mail or instant messaging must be carried out in accordance with the guidelines and parameters established in this policy.
  • In the event that data and/or confidential information is shared through telephone calls or video meetings, collaborators are required to take special care of when, where and how the information is shared or commented, to prevent it from being heard by unauthorized people or by the general public. If necessary, private places will be sought to prevent the disclosure of said information. If for any reason it is necessary to transport and/or store physical information, the packaging or file must be strong enough to protect the contents from any damage that may arise, in accordance with the corresponding environmental specifications, for example, to avoid damage due to heat or humidity and prioritizing the security of physical media through keys and the use of good practices.

14.3. Information loading

Information received through exchanges is processed through extraction, transformation and loading processes, considering the following specifications:

• • Sensitive Data is previously encrypted before uploading the information to the Truora Group databases.
  • Customer data must be stored in different databases.
  • All databases are encrypted at rest.
  • The extraction, transformation and loading processes should be executed in different instances.
  • Validations of the integrity of the loaded data are carried out, considering the original base.

15. Cookies and other technological tools

Truora uses cookies and similar technologies to personalize and improve the customer experience, as well as to show you relevant online advertising. Cookies are small text files that contain a unique identifier that is stored on the computer or mobile device through which you access the website and/or mobile applications, so that they can be recognized each time you use the website and/or mobile applications. The Persona Data Owner can choose to disable some or all of the cookies we use at any time. However, this may restrict your use of the Sites and limit your experience of the Sites. The use of cookies does not contain or affect Personal Data and does not represent a virus hazard.

16. Consultation, Rectification and Claims Procedure

Truora has specific manuals designed for the procedure for queries, complaints and claims and for the Personal Data treatment procedure available here. Notwithstanding the foregoing, below is a brief summary of the procedures. 

16.1.  Query: 

The inquiries and requests of the Data Owners will be attended within a maximum term of ten (10) business days, counted from the date of receipt of the same. In the event that it is not possible to resolve the query within this term, the Data Owner will be informed of said situation at the notification address that has been included in the respective query, and the response term may be extended for up to five (5) days. The response to the queries or claims that the Data Owners present may be delivered by any physical or electronic means.

16.2.   Rectifications and Claims:

When the Data Owner considers that his information should be corrected, updated, or deleted, or when they notice an alleged breach by Truora of its duties regarding the Protection of Personal Data contained in the applicable legislation and in this Privacy Policy you may file a claim in the following ways:

• • A written request must be submitted in response to the specific requirement.
    
  • If the claim is incomplete, Truora will require the interested party to complete and correct the request, within five (5) days after receiving the request:
    • If two (2) months elapse from the date of the request without the applicant having responded, the claim will be understood to have been withdrawn.
      
      
    • If the person who receives the claim is not competent to resolve it, he will transfer it to the person who can solve it within a maximum term of two (2) business days and will inform the applicant of this fact.
      
      
  • If the claim is received in full or has been completed later, within the following two (2) business days, a "legend" must be included in the database that indicates "CLAM IN PROCESS".
    
  • Truora will resolve the claim within a maximum term of fifteen (15) business days counted from the day following its receipt. In the event that it is not possible to resolve the query within this term, the Data Owner will be informed of the delay, the reasons, and the date of response to the address of notification included in the respective claim. In any case, the response term may not exceed eight (8) business days following the expiration of the first term. The response to the claims that the Data Owners present may be made by any physical or electronic means.

17. Data Protection Contact

Truora has created an area exclusively designated for the handling of Personal Data called Privacy Truora as responsible for the protection of your data, in the event of any doubt or concern about this Privacy Policy or the Treatment and use of Personal Information please Direct your queries, requests, complaints or claims to:

18. Deletion of Information

Any information storage device, which by definition of the Data Owner of said information, has lost its validity or has been withdrawn, must be safely eliminated in the terms established in the Manual of Procedures for Collection, Storage, Use, and Deletion. Information and the following aspects:

18.1. Removal Procedure

• • The files will be stored for as long as the Data Owner requests it, being previously communicated by written communication addressed to the information security committee.
  • In an extraordinary way, the partial or total elimination of the information of the Data Owner may be requested, which will affect both the files received, as well as all the data subsequently generated as a result of the management and Treatment carried out by Truora. For this, it is necessary to send a request to the Truora Privacy area, which will analyze if there is any legislation that does not allow its elimination or conservation for a period of time. In case of proceeding, the Truora Privacy area will request the OSI to eliminate the information from Truora´s databases.
    
  • When proceeding to the elimination or destruction of personal information, the elimination act must be drawn up, with the signature of the areas present and involved in the process and detailing the fields that were proceeded for its destruction, in any case, Truora will keep the Personal Data of a public nature, for purposes of traceability of the information.
    
  • Magnetic (electronic) media must be destroyed before disposal, ensuring that they cannot be read by third parties.
    
  • In the case of decommissioned computers, their hard drive must be formatted or destroyed, so that the information stored, and the installed software are logically and physically removed from the equipment.
    
  • Documents to be eliminated must be destroyed by means of paper shredding equipment, which must be enabled in suitable locations inside the Truora offices.

18.2. Destruction of backup media

• • Physical Media: These types of media are physical representations of data, usually associated with hard copies (either handwritten or printed), plastic payment cards, FAX, photos, tapes, drums, plates, and printing plates, as well as any other physical device that serves as support for the storage of logical data, among which are:
    • Magnetic media: floppy disks, hard drives, magnetic tapes, etc.
    • Optical media: CD, DVD, etc.
    • Magneto-optical media: Zip disks, Jaz disks, Super Disk, etc.
    • Electronic media: Flash memories, ROM and RAM memories, solid-state drives (SSD), etc.
  • Logical means: In this type of media, the logical representations of the data are stored in the form of bits and bytes and their corresponding structures (files, filesystems, units, etc.).

18.3. Deletion of Logic data

• • Redact: This technique is used to remove certain parts of a digital document to prevent the display of sensitive data during a declassification process, including the deletion of the metadata and the removal/truncation of images and text.
  • Delete: This technique simply performs a simple deletion of the reference to files at the operating system level (de-indexing), but their data remains on the storage medium and can be obtained again using forensic computing techniques.
  • Clean: This method uses logical (software-based) procedures to securely erase data in storage locations to prevent such data from being recovered using computer forensic techniques. Usually, such secure erase procedures are applied through standard read/write commands on the storage device using data overwriting with a new value in several passes or applying factory default values ​​(where overwriting is not supported). Use a secure erase tool that implements at least one overwrite pass.
  • Purge: This method uses physical or logical techniques to prevent the data on the storage device from being recovered using laboratory techniques (for example recovery through magnetic remanence), especially when said device will be reused, recycled, or discarded. It is recommended to use at least one degaussing or purging equipment.

18.4. Deletion of physical data

• • Redact: This action applies to written physical media and consists of sanitizing/truncating certain parts of a document in order to prevent potential disclosure of confidential information (declassification).
    
  • Destroy: This last method eliminates the data by physically destroying the medium that stores it, leaving this support unusable, using techniques such as disintegration, incineration, pulverization, grinding or melting. The NSA publishes a list of approved products for physical destruction. It is recommended to use at least a destruction device with security level 3 (DIN).

19. Modifications of the Privacy Policy

Truora is fully empowered to modify this Privacy Policy. Any changes will be published on our website and/or mobile applications. The granting of the Authorization, whatever its means, will be understood as an express manifestation of the acceptance of this Privacy Policy. It is the Data Owner's responsibility to frequently review these Privacy and Personal Data Protection Policies.

20. Validity

This Privacy Policy is effective as of June 1 of 2022 and will be reviewed periodically in the second week of March of each year.

21. Authority of issuance, revision, and publication

This Privacy Policy has been developed by our Privacy Truora area led by Gabriela Cala - Legal Counsel, this area is exclusively responsible of the protection of Personal Data and ensuring the exercise of the rights of the Data Owners. The Privacy Policy was approved by David Alejandro Cuadrado Cabrera - CTO/OSI.

Confidential June 2022