Personal Data Processing Policy

Notice: this version 1.0 is the first published revision. The described practices are updated periodically as Sibell SAS operations and Colombian data protection regulations evolve.

Sibell SAS — NIT 901.916.609-5
Version: 1.0
Effective Date: May 15, 2026
Last Updated: May 15, 2026

1. Identification of the Data Controller

2. Regulatory Framework

This policy complies with the Political Constitution of Colombia (Article 15), Law 1581 of 2012, Decree 1377 of 2013, Decree 1074 of 2015, circulars and resolutions issued by the Superintendent of Industry and Commerce (SIC), and other related regulations in force in Colombia on personal data protection.

3. Scope of Application

This policy applies to all personal data recorded in databases administered by Sibell SAS in its capacity as Data Controller, including:

• Corporate client data (legal representatives, authorized employees, business contacts).
• Commercial prospects and leads data.
• Website visitors data for sibell.in and subdomains.
• Employee, contractor, and supplier data.
• Data collected through support, marketing, or customer service channels.

Important — operation as Data Processor: In its main business line (SMS 2FA authentication service and related services), Sibell SAS acts as Data Processor of data for which the Data Controller is its corporate client. The processing of such data is governed by the respective Data Processing Agreement signed with each client and by Law 1581 of 2012. Habeas Data requests regarding data processed under this arrangement must be directed to the corresponding corporate client; Sibell will collaborate in all cases as established in section 11 of this policy.

4. Definitions

For purposes of this policy, the definitions in Article 3 of Law 1581 of 2012 and Article 3 of Decree 1377 of 2013 apply. In particular:

• Authorization: prior, express, and informed consent from the Data Subject to process their personal data.
• Database: an organized set of personal data subject to processing.
• Personal Data: any information linked or that can be associated with one or more determined or determinable natural persons.
• Sensitive Data: data that affects the Data Subject's privacy or whose improper use may lead to discrimination (racial origin, political affiliations, religious beliefs, health, sexual life, biometric data, among others).
• Data Processor: a natural or legal person who processes personal data on behalf of the Data Controller.
• Data Controller: a natural or legal person who decides on the database and/or the processing of the data.
• Data Subject: a natural person whose personal data is subject to processing.
• Processing: any operation or set of operations on personal data (collection, storage, use, circulation, deletion, etc.).
• International Transfer: sending of personal data by the Data Controller or Processor to a recipient in a country other than the country of origin.

5. Principles

Sibell SAS applies the principles enshrined in Article 4 of Law 1581 of 2012:

1. Legality: all processing is subject to law.
2. Purpose: data is processed for a legitimate purpose, disclosed to the Data Subject.
3. Freedom: processing is only carried out with prior, express, and informed consent from the Data Subject.
4. Truthfulness or Quality: the information processed is truthful, complete, accurate, current, verifiable, and understandable.
5. Transparency: the Data Subject's right to obtain information about the processing of their data is guaranteed.
6. Restricted Access and Circulation: data may only be processed by authorized persons or those provided for by law.
7. Security: necessary technical, human, and administrative measures are adopted to protect the data.
8. Confidentiality: all persons involved in processing are obligated to guarantee the confidentiality of the information.

6. Types of Personal Data Processed

6.1 Identification Data

Full name, identity document number, date of birth, nationality.

6.2 Contact Data

Email address, phone number, address, city, country.

6.3 Professional and Employment Data

Position, company, work area, professional experience.

6.4 Transactional Data

Payment information, billing, consumption of contracted services.

6.5 Technical Data

IP address, browsing data, cookies, device identifiers, platform access logs.

6.6 Sensitive Data

Sibell SAS does not collect or process sensitive data from Data Subjects covered by this policy. If the Data Subject voluntarily provides sensitive data (for example, in a support communication), explicit authorization will be requested and enhanced processing will apply.

6.7 Data from Minors

Sibell SAS does not direct its services to minors nor knowingly collect data from minors. If data from a minor is identified, it will be immediately deleted, unless authorization from the legal representative is provided pursuant to Article 7 of Law 1581 of 2012.

7. Purposes of Processing

Sibell SAS processes personal data for the following purposes:

1. To provide SMS 2FA authentication services, artificial intelligence services, analytics, automation, and consulting services contracted by the client.
2. To manage the client's commercial lifecycle: registration, onboarding, billing, collections, support, and assistance.
3. To communicate to the client relevant technical, commercial, or legal changes for the provision of the service.
4. To handle support requests, petitions, complaints, claims, and suggestions.
5. To carry out marketing and commercial prospecting activities, always with prior authorization from the Data Subject and with the option to unsubscribe at any time.
6. To comply with legal, contractual, accounting, tax, and regulatory obligations.
7. To evaluate and improve the quality of services provided through aggregated and anonymized analytics.
8. To prevent, detect, and investigate fraud, abuse, or improper use of the platform.
9. To manage the employment, contractual, or service provision relationship with employees, contractors, and suppliers.
10. Any other purpose disclosed to the Data Subject and authorized by them at the time of collection.

8. Rights of the Data Subject

Pursuant to Article 8 of Law 1581 of 2012, every Data Subject has the right to:

1. Know, update, and rectify their personal data with Sibell SAS. This right may be exercised, among other things, regarding partial, inaccurate, incomplete, fragmented data that leads to error, or those whose processing is expressly prohibited or has not been authorized.
2. Request proof of the authorization granted to Sibell SAS, except when expressly exempted as a requirement for processing (Article 10 Law 1581).
3. Be informed by Sibell SAS, upon request, regarding the use that has been given to their personal data.
4. Lodge complaints with the Superintendent of Industry and Commerce (SIC) for violations of Law 1581 of 2012 and its regulatory decrees.
5. Revoke authorization and/or request deletion of the data when the processing does not respect the constitutional and legal principles, rights, and guarantees. Revocation and/or deletion shall proceed when the SIC has determined that Sibell SAS has engaged in conduct contrary to the law in its processing.
6. Access free of charge to their personal data that has been subject to processing.

9. Channels to Exercise Rights

The Data Subject may exercise their rights through any of the following channels:

• Email: privacidad@sibell.in
• Physical Address: Calle 174 No. 57-30, Bogotá D.C., Colombia

Requests must contain:

1. Full name and identity document of the Data Subject.
2. Clear and precise description of the request, fact, or right being exercised.
3. Physical or electronic address for notifications.
4. Documents supporting the request, if applicable.
5. Signature of the request (if submitted in physical writing).

10. Habeas Data Procedure

10.1 Queries

Sibell SAS will handle queries within a maximum term of ten (10) business days from the date of receipt. When it is not possible to handle the query within said term, the interested party will be informed before expiration, stating the reasons for the delay and indicating the date on which the query will be handled, which in no case may exceed five (5) business days following the expiration of the first term.

10.2 Claims

Claims must be filed identifying the Data Subject, describing the facts giving rise to the claim, indicating the notification address, and attaching the documents to be considered.

If the claim is incomplete, Sibell SAS will require the interested party within five (5) business days following receipt to correct the deficiencies. After two (2) months from the requirement without the claimant presenting the required information, the claim will be deemed withdrawn.

The maximum term to handle the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to handle the claim within said term, the interested party will be informed of the reasons for the delay and the date on which it will be handled, which in no case may exceed eight (8) business days following the expiration of the first term.

10.3 Procedural Requirement before the SIC

Pursuant to the paragraph of Article 16 of Law 1581 of 2012, the Data Subject may only file a complaint with the SIC once they have exhausted the query or claim procedure with Sibell SAS.

11. Handling Requests for Data Processed as Processor

When a Habeas Data request refers to personal data processed by Sibell SAS as Processor (for example, phone number of an end user of a client fintech), Sibell SAS will:

1. Receive the request and acknowledge receipt to the Data Subject within maximum two (2) business days.
2. Identify the Data Controller (the corporate client).
3. Transfer the request to the Data Controller within two (2) business days for them to handle it directly pursuant to their own processing policy.
4. Inform the Data Subject of the transfer and the Data Controller's direct channel when appropriate.
5. Collaborate with the Data Controller in the response when requested, without prejudice to the confidentiality obligations agreed in the respective Data Processing Agreement.

12. Security Measures

Sibell SAS applies reasonable and proportionate technical, administrative, and human measures to protect personal data against alteration, loss, query, use, or unauthorized or fraudulent access. These include:

• Encryption in transit via TLS 1.2 or higher for all communications involving personal data.
• Encryption at rest for databases and backups containing personal data.
• Role-based access control (RBAC) and principle of least privilege.
• Salting and hashing of credentials and OTP codes before storage.
• Audit logs regarding access and critical operations on personal data.
• Network segmentation via VPC on Google Cloud Platform.
• Periodic encrypted backups with documented retention policies.
• Security incident management policy with timely notification to clients and the SIC when appropriate.
• Periodic training of personnel on security best practices and data protection.
• Confidentiality agreements with employees, contractors, and sub-processors.

More details on the technical architecture can be found on the Security & Compliance page.

13. Retention and Deletion of Data

Sibell SAS will retain personal data only for the reasonable time necessary to fulfill the processing purposes or as required by Colombian law (accounting, tax, labor obligations, and fraud prevention, among others).

Once the purposes are fulfilled and legal retention periods expire, data will be securely deleted or irreversibly anonymized.

14. Sub-processors / Processors of Sibell

For the provision of services, Sibell SAS relies on technology providers acting as Processors or sub-processors. The current list includes:

This list may be updated. The current version can be requested at privacidad@sibell.in.

15. International Transfers and Transmissions

Sibell SAS carries out international data transfers due to the use of technology providers with infrastructure outside Colombia (for example, Google Cloud Platform). These transfers are made to countries that have an adequate level of data protection or, failing that, through contractual clauses that guarantee standards equivalent to those required by Colombian legislation.

By accepting this policy, the Data Subject authorizes such transfers.

16. Cookies and Similar Technologies

The website sibell.in uses cookies and similar technologies to improve browsing experience, remember preferences, analyze site usage, and, where appropriate, perform targeted marketing. The specific cookie policy is available at sibell.in/cookies.

17. Authorization for Processing

Authorization from the Data Subject will be obtained prior to processing, through:

• Express checking of acceptance checkbox in web forms (including the client registration form).
• Digital acceptance when signing contracts or terms.
• Signed physical document, when applicable.
• Any other means that allows proving the manifestation of will from the Data Subject.

Authorization may be revoked at any time through the channels in section 9.

18. Privacy Notice

When, by exception, it is not possible to obtain prior authorization, Sibell SAS will make available to the Data Subject a privacy notice pursuant to Article 14 of Decree 1377 of 2013.

19. National Database Registry (RNBD)

Sibell SAS will periodically evaluate the obligation to register its personal databases with the National Database Registry administered by the SIC, pursuant to the thresholds defined by current regulations. In its main role as Data Processor, this obligation does not apply while Sibell does not retain end-user personal data under its own responsibility.

20. Modifications

Sibell SAS may modify this policy at any time. Modifications will be communicated through the website sibell.in at least ten (10) calendar days before their effective date. Substantial changes will also be communicated by email to active clients.

21. Effective Period

This policy becomes effective on May 15, 2026 and will remain in force until modified or repealed by Sibell SAS. The administered databases will have indefinite validity as long as the processing purposes are fulfilled and legal or contractual obligations exist that justify their preservation.