PRIVACY POLICY AND PERSONAL DATA PROCESSING

INKEIROS is a commercial trademark used for the provision of business services related to product development, strategic sourcing, supplier validation, international logistics, manufacturing, subassembly and supply chain coordination.

The main controller of the personal data collected through the website www.inkeiros.com is:

When data is collected or managed in Colombia, the following may also act as data controller:

The full physical address of KATHEKON ANDINA S.A.S. is available to data subjects upon prior written request sent to dsuarez@inkeiros.com.

In this Policy, the expressions "INKEIROS", "we" or "our" refer to the entity that collects, receives, attends to or manages the corresponding request.

This Policy explains how INKEIROS collects, uses, stores, shares, protects and deletes the personal data provided by users.

This Policy applies to personal data collected through:

• the website www.inkeiros.com
• contact forms
• email communications
• telephone communications
• communications initiated via WhatsApp
• requests for information, calls, meetings, diagnostics, proposals or quotes
• other commercial communications voluntarily initiated by the user

This Policy is designed to address, where applicable, the personal data protection regulations of Mexico, Colombia, the United States and the People's Republic of China.

INKEIROS may collect only the data that the user voluntarily provides, including:

• full name
• email address
• telephone number
• company name
• position or professional role
• city or country
• content of the message or inquiry
• general information about the project, product, logistics operation or business need consulted
• any additional information the user voluntarily includes in their communications

INKEIROS does not request through its public forms:

• financial or banking information
• credit or debit card numbers
• passwords
• official identification documents
• medical information
• biometric data
• information on sexual orientation, religious beliefs, union membership or political ideology
• other categories of sensitive personal data

The user should refrain from including sensitive data, financial information, trade secrets or unnecessary confidential information in the site's free-text fields.

Personal data is obtained directly from the data subject when they:

• fill out a form
• send an email
• initiate a phone or WhatsApp conversation
• request a meeting or call
• request information about the INKEIROS services
• voluntarily participate in a commercial communication

INKEIROS may also receive contact data when a person or company makes a business presentation or referral.

In those cases, INKEIROS will verify the interest of the referred person before continuing communications and will allow them to consult this Policy.

Personal data will be processed for the following purposes:

• receive, review and respond to inquiries
• contact the user by email, phone or WhatsApp
• organize a call, meeting or videoconference with INKEIROS specialists
• understand the user's business, commercial, technical, production or logistics needs
• preliminarily determine whether INKEIROS can offer a solution
• prepare diagnostics, proposals, quotes or requested communications
• assign the request to the appropriate specialist, office or team
• follow up on communications initiated by the user
• manage commercial or pre-contractual relationships
• keep a reasonable record of communications and requests
• verify the quality and timeliness of the service
• prevent misuse, fraud or security incidents
• exercise or defend rights in administrative, judicial or extrajudicial proceedings
• comply with legal obligations or valid requests from competent authorities

Personal data will not be used to send mass advertising campaigns, newsletters or unsolicited promotions, unless the data subject grants an additional, express, voluntary and separate authorization.

When applicable legislation requires consent, INKEIROS will request it through an unchecked box, a written statement or any other mechanism that allows demonstrating a prior, express, informed and unequivocal manifestation by the data subject.

By completing the form and checking the corresponding authorization box, the user declares that:

• they have had access to this Policy
• they provide their data voluntarily
• they authorize processing for the described purposes
• they authorize INKEIROS to communicate with them by email, phone or WhatsApp to respond to the request

When the user directly initiates communication by email, phone or WhatsApp, INKEIROS will process the minimum data necessary to respond to that communication.

Where applicable legislation permits, processing may also be based on:

• the adoption of pre-contractual measures requested by the user
• compliance with legal obligations
• the performance of a contractual relationship
• the protection of legitimate rights and interests
• the attention of requests from competent authorities

The data subject may withdraw their consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the request is received and processed.

When the user provides their email address or phone number, INKEIROS may use it to:

• respond to the inquiry
• organize a call or meeting
• request information necessary to understand the project
• send information requested by the user
• provide reasonable follow-up to the conversation
• communicate progress related to a proposal or project

When the user selects a WhatsApp link, the interaction will also be subject to the terms and privacy policies of the WhatsApp provider.

INKEIROS does not control the privacy, security or information storage practices of WhatsApp or other external services.

The user may request the suspension of communications by replying to the message received or by writing to hola@inkeiros.com or, for service in Colombia, to dsuarez@inkeiros.com.

Personal data may be accessed only by:

• authorized INKEIROS personnel
• specialists who need to handle the request
• entities related to INKEIROS that participate directly in the analysis or execution of the project
• web hosting providers
• email and communications providers
• form, information security or contact management providers
• meeting scheduling providers
• legal, accounting, technological or professional advisors subject to confidentiality obligations

Providers and processors may only process the data in accordance with INKEIROS's instructions, for the authorized purposes and under confidentiality and security obligations.

INKEIROS does not sell, rent, license or commercialize personal data databases.

Due to the international nature of INKEIROS's operations, personal data may be accessed, transmitted or processed from countries other than the country where the data subject is located, including Mexico, Colombia, the United States and China.

These operations may be carried out when necessary to:

• respond to an inquiry
• organize meetings
• conduct a technical or commercial evaluation
• coordinate international specialists
• validate the feasibility of a project
• prepare a requested solution or proposal
• use international technology providers

INKEIROS will limit transfers to the data reasonably necessary to handle the request.

When applicable legislation requires additional authorization, separate consent, a contract, a specific clause, an impact assessment, a certification or another mechanism to carry out an international transfer, INKEIROS will adopt such mechanism before making it.

When personal data of persons located in the People's Republic of China is processed and its personal information protection legislation applies:

• the data subject will be informed about the identity of the controller, the purposes, the means of processing and the categories of data collected
• only data necessary to respond to the request will be collected
• separate consent will be requested when legally necessary
• information on international transfers will be provided where applicable
• the legal and security measures required to provide personal information outside China will be applied
• the data subject may request access, copy, correction, limitation or deletion of their data
• the data subject may withdraw consent when processing depends on it
• sensitive data will not be processed unless there is a specific need, a determined purpose and a valid authorization

When the obligation to designate a local entity or representative in China applies, INKEIROS will make such designation in accordance with current legislation and publish its contact details.

When a U.S. federal or state privacy law applies, the user may exercise the rights recognized by that legislation.

These rights may include:

• know the categories of personal data collected
• know the purposes of processing
• request access
• correct inaccurate information
• request deletion
• obtain a copy of their data
• know the categories of third-party recipients
• opt out of the sale or exchange of data
• limit certain processing of sensitive information
• opt out of certain uses for targeted advertising or profiling
• not receive discriminatory treatment for exercising their rights

INKEIROS does not sell personal data, does not share data for cross-context behavioral advertising, and does not make exclusively automated decisions that produce legal or significantly similar effects on users.

As of the publication date of this Policy, www.inkeiros.com does not use its own or third-party cookies.

The site does not use cookies for:

• analytics
• advertising
• personalization
• behavioral tracking
• profiling
• campaign measurement
• tracking users across different websites

INKEIROS also does not use advertising pixels or technologies designed to identify or track users' navigation.

The site may contain links to external services, including WhatsApp, email or social networks.

By selecting one of these links, the user leaves the INKEIROS site. The external service may apply its own policies, cookies or technologies, over which INKEIROS has no control.

Personal data will be retained for the time necessary to respond to and follow up on the request.

When no commercial or contractual relationship is initiated, the data may be retained for a maximum period of 24 months counted from the last substantial communication with the user.

Data may be deleted before that period when:

• the data subject requests it
• they are no longer necessary for the authorized purposes
• there is no legal obligation justifying their retention

When there is a contractual relationship, tax obligation, legal obligation, claim, dispute or need for legal defense, the information may be retained for the period required by applicable legislation.

Once the corresponding period has concluded, the data will be deleted, anonymized or reasonably blocked.

INKEIROS adopts reasonable administrative, organizational and technical measures to protect personal data against:

• loss
• destruction
• alteration
• unauthorized access
• improper disclosure
• use incompatible with the authorized purposes
• any unauthorized processing

Access to information is limited to persons who need to know it to handle the request or provide the corresponding service.

No system connected to the internet can guarantee absolute security.

In the event of a breach that may significantly affect the rights of data subjects, INKEIROS will carry out the actions, investigations and notifications required by applicable legislation.

Depending on the country of residence and applicable legislation, the data subject may:

• know whether INKEIROS processes their data
• access their personal data
• request a copy
• correct or update inaccurate information
• request deletion, cancellation or suppression
• object to certain processing
• limit use or disclosure
• withdraw or revoke consent
• request portability where applicable
• know the purposes and recipients
• submit inquiries, requests or claims
• not receive discriminatory treatment for exercising their rights
• go before the competent data protection authority

Data subjects located in Mexico may exercise their rights of:

• Access
• Rectification
• Cancellation
• Opposition

These rights are known as ARCO rights.

They may also:

• revoke their consent
• request limitation of the use or disclosure of their data
• know the modifications made to this Policy

Data subjects located in Colombia may:

• know, update and rectify their data
• request proof of the authorization granted
• be informed about the use given to their data
• freely access their personal data
• submit inquiries and claims
• request suppression when legally appropriate
• revoke the authorization where applicable
• file a complaint with the Superintendence of Industry and Commerce, after exhausting the direct procedure before INKEIROS when legally necessary

Inquiries, requests or claims related to privacy should be sent to the following channels:

The full physical address is available upon prior written request sent to dsuarez@inkeiros.com.

The suggested email subject is: "Privacy request"

The request should contain:

• name of the data subject
• means to receive the response
• clear description of the right to be exercised
• sufficient information to locate the data
• description of the data to be consulted, corrected or deleted
• reasonably necessary documents to verify identity or representation, only when indispensable

INKEIROS may request additional information when necessary to verify the requester's identity, protect data against improper access or understand the request.

Inquiries and claims will be handled within the timeframes established by applicable legislation.

When a request is totally or partially rejected, INKEIROS will inform the corresponding grounds, unless a legal provision prevents providing that information.

The exercise of rights will be free of charge, except for reasonable reproduction, shipping or delivery costs permitted by applicable legislation.

The user may request that INKEIROS stop contacting them for commercial or follow-up purposes.

The request may be made by:

• replying to the message received
• writing to hola@inkeiros.com
• for service in Colombia, writing to dsuarez@inkeiros.com

The suspension of communications will not prevent INKEIROS from sending messages necessary to fulfill a contractual, legal or security obligation.

The INKEIROS website and services are directed at companies, professionals and adults.

INKEIROS does not intentionally collect personal data from minors.

If INKEIROS identifies that it received data from a minor without the corresponding authorization, it will proceed to delete it within a reasonable period, unless there is a legal obligation to retain it.

The site may contain links to WhatsApp, email, social networks or other services operated by third parties.

INKEIROS does not control the privacy, security, storage or information use practices of those services.

Processing carried out by third parties will be governed by their own policies and conditions.

INKEIROS may update this Policy to reflect:

• legal changes
• operational changes
• incorporation or removal of providers
• technological modifications
• changes in processing purposes
• additional security measures

The current version will be available at www.inkeiros.com and will indicate the date of its last update.

When a modification substantially changes the authorized purposes or requires new consent, INKEIROS will provide the corresponding notice and request a new authorization when necessary.

The full physical address is available upon prior written request sent to the indicated email address.