Privacy Policy and Data Processing Policy

1. Identification and contact information for the responsible party

The present Privacy and Data Processing Policy describes how ESTUDIOS ALCANOX S.A.S., operating commercially under the name AlcaNox, handles personal data within the context of its website, business communications, and provision of cybersecurity services.

2. Asset and scope

This policy applies to personal data that AlcaNox processes in relation to website visits, inquiries, quotation requests, commercial proposals, customer and supplier relations, contract management, communications, and privacy-related requests.

This policy does not replace service delivery contracts, confidentiality agreements, Work Statement (WS), technical scope documents, or Engagement Guidelines (EG). In security assessments, these documents must define, as appropriate, the authorized assets, scope, execution rules, access, evidence handling, retention, and removal of client information.

The application of each country's standards depends on the circumstances and specific handling. This policy distinguishes the requirements for Colombia and Chile without claiming that all provisions of both countries are identical.

Personal data is processed

Based on interaction and contracted services, AlcaNox may process the following categories of data, only when necessary for the respective purpose

• Identification and contact: name, last name, position, company, email address, phone number, and country.
• Commercial and contractual information: consultations, quotations, proposals, orders, contracts, invoicing and necessary background for managing business relationships.
• Communications: messages and emails sent to AlcaNox and related responses regarding the query or service
• Technical site data: IP address, access date and time, error logs and technical data generated by the infrastructure, when actually collected.
• Technical information from a security assessment: domains, IP addresses, configurations, logs, and evidence of findings. These data may or may not be personal data, depending on their content and context.

AlcaNox does not intend to collect sensitive data as a routine practice for its business operations. If a specific treatment requires sensitive data, it must be assessed in advance regarding its necessity, legal basis, protective measures, and, when applicable, obtaining authorization or consent required by applicable law. Do not send sensitive data to AlcaNox unless it is strictly necessary and a secure and appropriate channel has been agreed upon for transmission.

4. Purpose of the treatment

When applicable and there is a valid legal basis, AlcaNox may process personal data for:

• Answer queries and information requests.
• Prepare and send quotes and commercial proposals as requested.
• Manage relationships with customers, suppliers, and professional contacts.
• Prepare, celebrate, execute, and manage contracts.
• Coordinate and provide cybersecurity services within authorized scope.
• Manage billing, accounting, and legal obligations.
• Address inquiries regarding holder rights
• Protect the security of AlcaNox systems and manage incidents when necessary and lawful.
• Exercise or defend rights in administrative or judicial proceedings when appropriate.
• Perform technical investigations and develop or enhance defense systems, including detection rules, signatures, filters, firewall configurations, and security controls, always in an anonymized or aggregated manner, or when the customer has explicitly authorized it in the contract, SOW or ROE applicable.

The transmission of commercial non-solicited communications is not presumed authorized merely by a single visit to the website. When consent is required, AlcaNox will request it separately and will record authorization in accordance with applicable regulations.

5 Legal and Authorization Bases

AlcaNox will determine the applicable legal basis for each processing in accordance with jurisdiction, purpose, data type, and relationship to the data owner.

Colombia

The general rule established in Law 1581 of 2012 is prior authorization, expressed and informed, except for legal exceptions. This policy by itself does not constitute such authorization. When the processing is combined with an authorization, the holder will be informed about the purpose and their rights, and evidence of the authorization will be retained in accordance with applicable legal terms.

Chile

The treatment in Chile complies with Law No. 19.628 in effect until November 30, 2026, and, from December 1, 2026, in accordance with the provisions of Law No. 21.719. The treatment will be lawful when it has the free, explicit, and informed consent of the owner, or when any of the other legal grounds for legality outlined in the applicable law apply.

6. Handling of information during cybersecurity services

A security assessment can involve access to technical information or personal data present in the evaluated systems. AlcaNox will limit access and use of the information to the extent authorized by written agreement and the agreed purposes with the client.

The contract, SOW, technical scope and ROE should define, according to the service, the access, usage, storage, transmission, delivery, preservation, and disposal of evidence. The customer and AlcaNox must clarify their respective roles regarding personal data before initiating treatment when necessary.

Use of findings, vulnerabilities, and malware for research and development of defenses

AlcaNox will be able to utilize technical findings, identified vulnerabilities, malware samples, indicators of compromise (IoCs), attack patterns, and other evidence obtained during security assessments, exclusively for the following legitimate purposes:

• Investigation technical: analysis, study and documentation of attack techniques, vulnerabilities and malicious behaviors, with the goal of enhancing internal knowledge and improving AlcaNox's response capabilities.
• Development and enhancement of defense systems creation, update or enhancement of security controls for your own or your clients' security, such as detection rules, malware signatures, filters, blocklists, firewall configurations, intrusion prevention systems and other protective measures.

This usage will be carried out preferably in an anonymized or aggregated form, so that it is not possible to identify the customer or the holder of personal data. When the use of non-anonymized information is necessary, it will be done only if there is a valid legal basis and has been explicitly informed or agreed upon in the contract, SOW or ROE.

AlcaNox will not use data or evidence obtained during an assessment for purposes unrelated to the service or for malicious or unauthorized activities. In no case will client information be reused in a way that enables identification without prior consent or agreement.

7. Rights and exercise of requests

Individuals may exercise the rights recognized by applicable legislation relevant to their situation. To begin a request, write to the appropriate email address according to your country, describe the right you wish to exercise and include sufficient information to locate your details. AlcaNox may request additional reasonable information to verify your identity, avoiding the collection of unnecessary data.

7.1 Colombia

According to Law 1581 of 2012, owners may:

• Know, update and correct their personal data.
• Request proof of authorization when applicable.
• Know the purpose for which their data has been used.
• Present your queries and complaints.
• Request the revocation of authorization or the deletion of your data when appropriate.
• Submit complaints to the Superintendence of Industry and Commerce (SIC) once the prior procedure required by law has been exhausted.

Response timeframes:

• Consultations: Ten (10) working days from receipt of the request. You may be extended up to five (5) additional working days when the response cannot be provided within the initial timeframe. The reason for the delay will be communicated within the original deadline.
• Claims: Fifteen (15) working days from receipt of the request, with the legal extension applied when appropriate.

Contact Email: privacidad@alcanox.com
Authority of Control: Superintendencia de Industria y Comercio (SIC) — sic.gov.co

7.2 Chile

Legal applicable regime

Until November 30, 2026, the Law No. 19.628 on the Protection of Personal Data applies. Starting December 1, 2026, the provisions of Law No. 21.719, which regulates the Processing of Personal Data and establishes the Personal Data Protection Agency, come into effect.

Rights of individuals up to November 30, 2026 — Law 19.628

• Information: know if your data is being processed and the content of that data.
• Modification: Request correction of inaccurate or incomplete data.
• Deletion and blocking: request the deletion or blocking of your data when appropriate.
• Opposition: Resistance to treatment based on valid grounds.

Rights of individuals from December 1, 2026 — Law 21.719

• Access: confirm whether your data is being handled and obtain a copy, including its origin, purpose, and recipients.
• Correction: correct inaccurate, outdated, or incomplete data.
• Suppression: request to delete your data when you wish.
• Opposition: oppose treatment due to issues related to your particular situation.
• Portability: receive your data in a structured and commonly used format, or request its transmission to another responsible person when appropriate.
• temporary lock: request to suspend treatment while evaluating a request for correction, suppression, or objection.

response deadlines

Regulatory authority and claims procedures

Until November 30, 2026: if you do not receive a response within the legal timeframe or the response does not meet your request, you may resort to the Civil Judge of the responsible person's address, in accordance with Article 16 of Law 19.628. In matters related to consumption, you may also turn to the National Consumer Service — SERNAC.

From December 1, 2026, the regulatory authority is the Personal Data Protection Agency. They will be available for 30 working days from the date of response deadline or from the notification of the response to file a complaint with the Agency. Official source of the regulation: bcn.cl/leychile.

Email contact for Chile: privacidad@chile.alcanox.com

8 Privacy Notice for data collection

When AlcaNox requests personal data directly, it will provide the information required by applicable legislation at the time of collection, including the identity of the responsible party, the purposes, the holder's rights, the channels for inquiries, and the link to this policy. When authorization or consent is required, it will be obtained through a separate, prior and informed mechanism that allows preserving evidence of it.

• Colombia: This document does not replace the Privacy Notice that must be provided at the point of data collection, as required by Law 1581/2012 and its regulatory decrees.
• Chile: the information provided at the time of collecting personal data will contain the requirements specified in Article 4 of Law 19.628 and the provisions of Law 21.719 that apply.

Communication with vendors and third parties

AlcaNox may allow access or communicate personal data to technology providers, hosting services, email and communication services, professional advisors, or public authorities, when necessary to provide services, manage business relationships, fulfill legal obligations or exercise or defend rights, as applicable.

Access from suppliers will be strictly limited to what is necessary and will be subject to contractual obligations regarding confidentiality and appropriate data protection. The data may only be processed by the provider according to the instructions of the responsible party and for the agreed-upon purposes.

International transfers and processing

Due to the fact that AlcaNox is incorporated in Colombia and can provide services to clients in Colombia and Chile, some data may be processed or stored outside the country of the owner, depending on the location of the providers and the infrastructure actually used.

International transfers or transmissions will only be carried out when there is a valid legal basis and the requirements, restrictions, and guarantees correspond in each jurisdiction:

• Colombia: will be adapted to the requirements of Article 26 of Law 1581/2012 and the provisions of the Superintendence of Industry and Commerce.
• Chile: the strings will be adapted to match the requirements set forth in Article 13 of Law 19.628 and the accompanying rules.

International transfers will only be carried out to countries or territories that provide an appropriate level of protection, or, in the absence of such protection, with contractual guarantees or instruments authorized by the competent authority.

This policy does not claim that all countries or suppliers used offer automatically an adequate level of protection. Before making transfers, identify the destination countries, data category classifications, and applicable assurance mechanisms. If no international transfers occur in a concrete flow, it should not be assumed otherwise.

11. Preservation and deletion

AlcaNox will retain personal data during the necessary time to fulfill the stated purposes, manage the contractual relationship, address legal obligations, and exercise or defend rights. The duration will depend on the data category, purpose, and applicable obligations in each country.

• Colombia: according to what is established in Law 1581 of 2012 and complementary regulations, while the purpose that justified its handling and during the legal prescription periods of legal obligations.
• Chile: in accordance with Article 4° bis of Law 19.628, data will be retained solely for the duration necessary to fulfill the purpose for which they were collected; once fulfilled, they must be deleted or anonymized unless otherwise legally required.

The information obtained during security assessments will be retained in accordance with what is defined in the contract, SOW and ROE applicable, taking into account legal obligations and the documentation requirements of the service. When data is no longer needed and there is no legitimate obligation to retain it, it will be removed or anonymized using secure measures that prevent recovery.

Security and incident management

AlcaNox will implement appropriate technical, organizational, and administrative measures to the nature of the data, the purposes of the processing and the identified risks, in order to reduce the risk of unauthorized access, use, alteration, loss or disclosure. The best practices of the industry and applicable legal requirements are considered.

No security measure can be described as absolute assurance. If a security breach affecting personal data occurs, AlcaNox will handle it in accordance with current regulations.

• Colombia: will be communicated to the Superintendence of Industry and Commerce and, when appropriate, to the affected data holders, in accordance with Article 17 literal n) of the Law 1581 of 2012 and the instructions of the SIC Single Circular / National Database Registry, within the timeframe of fifteen (15) working days from incident detection.
• Chile: until November 30, 2026, it will be assessed in accordance with the security and confidentiality principles of Law 19.628. From December 1, 2026, the deadlines and notification obligations established by Law 21.719 will apply, including communication to the authority and data owners when the risk to their rights is likely and specific.

The concrete measures, the internal incident management procedure, and the designated responsible persons are documented internally and are consistent with the commitments of this policy.

13 Cookies and technical logs

The use of cookies, server logs, and similar technologies depends on the actual configuration of the website and integrated services. AlcaNox will clearly communicate the technologies it effectively uses, distinguishing between necessary cookies, analytics, and third-party cookies, and will request consent when required by applicable regulations:

• Colombia: will conform to the transparency and purpose principles of Law 1581/2012.
• Chile: The strings will be adjusted to comply with Law 19.628 and, when applicable, with the rules regarding data handling through digital devices. Consent must be obtained before activating cookies that are not strictly necessary for the requested service.

14. Minors

The AlcaNox services are primarily aimed at businesses, organizations, and professionals. AlcaNox does not intentionally collect personal data of minors for its commercial activities. If personal data of a minor is identified without authorization from the legal guardian or parent, immediate deletion will be carried out unless there is a legal obligation to retain it. If you believe we have collected data from a minor, please contact privacidad@alcanox.com to manage your data deletion

15. Links to third-party sites

The AlcaNox website may include links to third-party sites, applications, or content for your convenience or information. AlcaNox does not control or assume responsibility for the privacy practices, content, or policies of those third parties. We recommend that you review each provider's privacy policies before sharing personal data on external sites. The presence of a link does not constitute approval or endorsement from AlcaNox.

Updates and changes to this policy

AlcaNox may update this policy to reflect changes in their data handling practices, the services they provide, or applicable legal requirements. The version published on the website will clearly indicate its update date and effective date.

If changes substantially affect the purposes, legal bases or the scope of treatment, and a new authorization from the data owner is required, AlcaNox will proceed in accordance with applicable legislation and will communicate the changes in a reasonable time prior to their implementation.

Legal Requirement and Regulatory Bodies

18. Contact us

If you have questions, comments, or requests related to this Privacy Policy or the processing of your personal data, you can contact us at:

The data controller is ESTUDIOS ALCANOX S.A.S. — AlcaNox, identified with NIT 901.991.327-2, with address as indicated.