IVO LEGAL PRIVACY NOTICE Tax ID (NIT): 900.634.584-5

IVO LEGAL S.A.S (hereinafter IVO LEGAL) hereby informs all interested parties that, in compliance with the general data protection regime and regulatory standards, personal data obtained through operations developed within the framework of the company’s corporate purpose will be processed in accordance with the principles and duties defined in Law 1581 of 2012 and other related regulations. In the case of financial Habeas Data, Law 1266 of 2008 and its regulatory norms shall apply, and finally, processing will adhere to the special rules set forth in Law 2300 of July 10, 2023.

Inquiries and Claims (PQRS): If you wish to submit an inquiry, claim, or request for information related to personal data protection, you may do so at our office located at Carrera 11 No. 93 – 53, Bogotá, Colombia, or via email at:

legal@recu.com.co

Processing of Personal Data: Personal data collected by IVO LEGAL through its various channels, from third parties (natural or legal persons), or directly from the data subjects, will be used, communicated, stored, transferred, transmitted, and processed for purposes framed within the development of IVO LEGAL’s corporate purpose, the fulfillment of legal and administrative obligations, among others.

Uses and Purposes of Processing: In general, the main uses and purposes of Personal Data Processing by IVO LEGAL include, but are not limited to:

• Labor Management: Personnel selection, hiring, fulfillment of labor obligations, and payroll settlement.

• Administrative Management: Managing necessary information for the fulfillment of tax, contractual, commercial, corporate, and accounting records.

• Contractual Fulfillment: Performing relevant actions to guarantee contract compliance, particularly debt collection activities and commercial prospecting for third parties.

• Fraud Prevention: Controlling and preventing fraud in any of its forms.

• Provider Relations: Executing all necessary activities for the fulfillment of different contractual stages in relationships with suppliers and contractors.

Special Authorization for Sensitive Personal Data: IVO LEGAL informs all data subjects that, under Law 1581 of 2012 and Regulatory Decree 1074 of 2015, they are not balanced to grant authorization for the processing of sensitive data. IVO LEGAL processes the following sensitive data: psychotechnical tests, health-related data, images, and fingerprints. These are used for identification, profile analysis for vacancies, facility access, security, and legal compliance.

Transmission of Personal Data: IVO LEGAL may transmit personal data to third parties with whom it has an operational or contractual relationship to provide services necessary for its proper operation. In such cases, IVO LEGAL will adopt the necessary measures to comply with the specific requirements for this type of operation set forth in Law 1581 of 2012. In the event of data transfer, measures established by the governing regulations will be applied.

Exercise of Rights: The data subject or their duly accredited legal representative may limit the use or disclosure of their personal data, as well as exercise, where applicable, the rights of Access, Rectification, Update, Deletion, Modulation, or Revocation provided by Law.

Rights of Data Subjects: In the processing of Personal Data, the rights of the subjects will be respected at all times, including:

• a) To know, update, and rectify data; and to have an agile and efficient mechanism to cancel the receipt of messages, unless a contractual obligation of permanence exists.

• b) To request proof of the authorization granted.

• c) To be informed by the company, upon request, regarding the use given to their data.

• d) To file complaints before the Competent Authority for violations of the law.

• e) To revoke authorization or request data deletion when constitutional and legal principles are not respected (provided there is no legal or contractual duty to retain the data).

• f) To access processed Personal Data free of charge.

• g) To be contacted for collection or commercial prospecting only through expressly authorized channels, from Monday to Friday (7:00 am – 7:00 pm) and Saturdays (8:00 am – 3:00 pm). Subjects will not be contacted more than once per day or through multiple channels in the same week for collection purposes.

• h) Not to be forced to accept data processing for commercial prospecting when performing transactions or entering buildings.

• i) Not to be subject to debt collection visits at their home or workplace.

Modifications to the Privacy Notice: Any modification to this Notice or the Data Protection Policy will be notified through: A message sent to your email or notices published on the IVO LEGAL website.

For more information, you may consult our PERSONAL DATA PROCESSING POLICY.