Personal Data Processing and Protection Policy

This English version is provided for convenience. In case of any discrepancy, the Spanish version published at https://www.leukos.com.co/politica-de-privacidad/ prevails.

Scope of application

This Policy applies to operations in which LEUKOS CONSULTING S.A.S. acts as Data Controller and, where applicable, as Data Processor on behalf of its clients. It must be published in a medium that is easily accessible to data subjects and kept consistent with the databases, providers and purposes actually used by LEUKOS.

Article 1. Purpose and scope

This Policy sets out the rules that LEUKOS CONSULTING S.A.S., which commercially uses the LEUKOS CONSULTING S.A.S. brand, will apply to the processing of personal data collected, stored, consulted, used, circulated, transmitted, transferred, updated, corrected, deleted or subjected to any other operation in the course of its business, employment, contractual, commercial, creative, digital and third-party relationship activities. It applies to the physical or electronic databases and files for which the company acts as Data Controller and, where relevant, to the operations it carries out as Data Processor on behalf of clients or other Controllers.

Article 2. Identification of the data controller

Channel responsible for data subject requests: the Human Resources Department, without prejudice to the authority of General Management and the support of other areas in handling requests.

Article 3. Legal framework

This Policy is interpreted mainly in accordance with Article 15 of the Colombian Political Constitution; Statutory Law 1581 of 2012; Chapter 25 of Decree 1074 of 2015; Title V of the Single Circular of the Superintendence of Industry and Commerce (SIC), as updated by current instructions, including Circular 001 of 2026; Decree 090 of 2018 regarding the National Database Registry where applicable; Law 2300 of 2023 on commercial and advertising contact; Law 527 of 1999 on data messages; and any rules that amend, add to, replace or regulate them. When processing involves consumer relationships, intellectual property, technology transfer or employment, the relevant special provisions will also apply.

Article 4. Guiding principles

Processing will be governed by the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality set out in Law 1581 of 2012. LEUKOS CONSULTING S.A.S. will additionally apply criteria of necessity, minimization, proportionality, time limitation, privacy by design, demonstrated accountability and risk prevention, so that processing is appropriate to the stated purpose and verifiable.

Article 5. Definitions

For this Policy, the definitions of Law 1581 of 2012 and Decree 1074 of 2015 apply. In particular: the Data Subject is the natural person whose data is processed; the Controller is whoever decides on the database or the processing; the Processor is whoever processes data on behalf of the Controller; authorization is prior, express and informed consent; transfer means sending data to another Controller inside or outside Colombia; transmission means processing by a Processor on behalf of the Controller; sensitive data is data that affects privacy or whose misuse may lead to discrimination; and the privacy notice is the communication that informs about the existence of this Policy, how to access it and the purposes of processing.

Article 6. Categories of data subjects

LEUKOS may process data of, among others, website visitors; form users; prospects and leads; clients and client contacts; suppliers; partners; contractors; candidates; employees; apprentices and interns; event participants, attendees or guests; talent, models, artists, speakers and other people involved in productions; representatives, employees or contacts of organizations with which there is a commercial relationship; and other natural persons whose information is legitimately processed by LEUKOS.

Article 7. Categories of data

Depending on the relationship and purpose, the following may be processed: identification data; contact data; general location; professional, employment or business information; contractual data; information needed for invoicing and payments; commercial preferences and interests; interaction history; information contained in communications; images, voice and audiovisual material; browsing data, technical identifiers, IP addresses and security logs; and other relevant data. Sensitive data and data of children or adolescents will receive exceptional and reinforced treatment in accordance with the law.

Article 8. Sources

Data may be provided directly by the Data Subject; collected through forms, email, WhatsApp, social media, meetings, events, contracts, authorized platforms or the Website; received from clients when LEUKOS CONSULTING S.A.S. acts as Processor; obtained from public sources or third parties that demonstrate legitimacy; or generated as a result of a contractual, employment, technical or commercial relationship. LEUKOS will not use unlawfully obtained sources or carry out indiscriminate profile enrichment.

Article 9. General purposes of processing

• Handling requests, inquiries, messages, quotes and requirements received through the Website, email, WhatsApp or other corporate channels.
• Managing pre-contractual and contractual relationships; preparing, negotiating, executing, administering and closing proposals, projects and services.
• Managing clients, prospects, suppliers, partners and commercial contacts; keeping a record of negotiations, approvals, deliverables and communications.
• Providing the professional consulting, people management, recruitment, training, development, coaching and other services offered by LEUKOS CONSULTING S.A.S.
• Managing invoicing, payments, accounts receivable, accounting, taxes, audits and legal or contractual obligations.
• Managing recruitment, hiring, payroll, social security, well-being, occupational health and safety (SG-SST), training, termination and other legally appropriate employment purposes.
• Managing events, productions, content and audiovisual projects, including accreditation, logistics, photographic or audiovisual records and related communications, where there is legal basis or applicable authorization.
• Protecting systems, information, facilities, assets, credentials and networks; detecting, investigating and managing security incidents or fraud.
• Handling data subject inquiries and complaints, requests and claims (PQR), requirements from authorities, judicial or administrative proceedings, and exercising or defending rights.
• Carrying out statistical analysis and internal measurement with aggregated, anonymized or minimized information whenever possible.
• Sending communications strictly related to a requested, contractual or service relationship and, separately where appropriate, authorized commercial or advertising communications.
• Complying with obligations under Law 1581 of 2012, consumer protection rules, commercial, employment, tax and intellectual property rules and other applicable regulations.

Article 10. Marketing and commercial contact purposes

Advertising messages, promotions, news, invitations or marketing content sent by SMS, app or web messaging, email or calls will be based on the applicable authorization, respecting the channels chosen by the Data Subject, their right to deletion or revocation, and the restrictions of Law 2300 of 2023 and the Do-Not-Call Registry (RNE) where applicable. LEUKOS will not make the purchase of a service or the handling of a request conditional on accepting advertising that is not necessary for the requested relationship.

Article 11. Authorization and duty to inform

Except where the law provides otherwise, LEUKOS will obtain prior, express and informed authorization and keep verifiable evidence of it. At the time of collection it will state the purpose, the rights of the Data Subject, the Controller's contact details and, where appropriate, the optional nature of providing sensitive data. Silence, inaction, pre-checked boxes or ambiguous wording will not be considered authorization. Evidence may be kept through electronic records, date, time, the version of the accepted text, reasonably necessary technical identifiers and other traceability elements.

Article 12. Sensitive data

Sensitive data will only be processed when there is a legal exception or basis. When processing is based on authorization, it will be explicitly and previously stated which data is sensitive, the specific purpose, and that answering questions about such data is optional. No activity will be conditional on providing sensitive data when it is not essential for the corresponding legitimate purpose.

Article 13. Data of children and adolescents

LEUKOS will not design general forms to deliberately collect data from minors. When a project, event, campaign or production requires processing information about children or adolescents, a specific instrument will be applied that respects their best interests, their fundamental rights, the minor's participation according to their maturity and the authorization of their legal representative, in accordance with Law 1581 of 2012 and Article 2.2.2.25.2.9 of Decree 1074 of 2015.

Article 14. Data subjects' rights

• To know, update and correct their personal data.
• To request proof of authorization, except in the cases provided by law.
• To be informed, upon request, about how their data has been used.
• To file complaints for violations with the Superintendence of Industry and Commerce, once the applicable prerequisite procedure has been completed.
• To revoke the authorization and/or request deletion where appropriate and where there is no legal or contractual duty to keep the information.
• To access their personal data being processed free of charge in the cases provided by law.
• Not to be required to provide sensitive data unless there is a legal basis, and to receive sufficient information to exercise their rights.

Article 15. Area and channels for exercising rights

The Human Resources Department will coordinate the handling of data subject requests, inquiries and complaints, supported by General Management and the areas that manage the information. Requests may be sent to diana.angulo@leukos.com.co or submitted through the other published corporate channels. The request must allow the Data Subject to be identified, describe what is being requested and include enough information to locate the data; when a representative acts, they must prove their capacity.

Article 16. Inquiries

Inquiries about personal information will be answered within a maximum of ten (10) business days from receipt. If it is not possible to respond within that period, the interested party will be informed before it expires, explaining the reasons and indicating a new date that may not exceed five (5) additional business days, in accordance with Article 14 of Law 1581 of 2012.

Article 17. Complaints

Complaints regarding correction, updating, deletion or alleged non-compliance will be handled in accordance with Article 15 of Law 1581 of 2012. If incomplete, the interested party will be asked to complete them within five (5) days; after two (2) months without a response, they will be considered withdrawn. If the recipient is not competent, it will forward the complaint within a maximum of two (2) business days and inform the interested party. Once the complete complaint is received, the legend "complaint in process" will be added within a maximum of two (2) business days where technically applicable. The complaint will be resolved within a maximum of fifteen (15) business days from the day after receipt; any extension may not exceed eight (8) additional business days.

Article 18. Revocation and deletion

Revocation of authorization or deletion will proceed under the terms of the law. It will not be mandatory when there is a legal or contractual duty to keep the data, when the data is needed to file, exercise or defend claims, or when another valid legal basis prevents immediate deletion. In such cases, processing will be restricted to the enabling purpose for the necessary time.

Article 19. Transmission to processors

LEUKOS may use technology providers, hosting, email, storage, CRM, messaging, analytics, creative platforms, collaboration tools, payments, security, support and other necessary processors. When a third party processes data on behalf of LEUKOS, instructions, purposes, security measures, confidentiality, incident management, handling of rights, return or deletion and other obligations will be established through the required contract or legal instrument, in accordance with Article 2.2.2.25.5.2 of Decree 1074 of 2015.

Article 20. National and international transfers

When LEUKOS communicates data to another Controller, it will verify the legal basis and, if the operation is international, will apply Article 26 of Law 1581 of 2012, Title V of the SIC Single Circular and the current instructions on countries with an adequate level of protection, exceptions, contractual instruments and, where appropriate, a Declaration of Conformity. Transfers or technology transfer processes involving personal data will also be subject to the current SIC instructions, including External Circular 002 of 2025 where applicable.

Article 21. Processing on behalf of clients

When LEUKOS CONSULTING S.A.S. processes personal data following the instructions of a client that determines the essential purposes and means, it will act as Processor and limit its actions to the contract, the documented instructions and the law. It will not reuse that data for incompatible purposes of its own. The client will retain its obligations as Controller, including the legitimacy of the collection, unless a legally different agreement and allocation of roles applies.

Article 22. Security and confidentiality

LEUKOS will adopt reasonable administrative, technical and human measures proportionate to the risk, including access management, passwords and authentication, separation of permissions, backups, updates, supplier control, training, management of devices and repositories, activity logs where relevant, and confidentiality duties. Staff will only access the information needed for their duties. Data will not be uploaded to personal clouds or to unauthorized artificial intelligence tools or digital services when there is a risk to confidentiality, the rights of data subjects or obligations to clients.

Article 23. Security incidents

Any unauthorized access, loss, alteration, misdirected sending, disclosure, extraction, malware or event that may compromise data must be reported internally immediately. LEUKOS will assess the scope, affected data subjects, containment and restoration measures, and duties to report or communicate to authorities and data subjects where legally required. Sufficient traceability will be kept to demonstrate how the incident was managed.

Article 24. Retention and deletion

Data will be kept for the time reasonably necessary for the stated purpose and for the additional periods required by employment, commercial, tax, contractual and intellectual property rules, statutes of limitation, audits or the defense of rights. Data used exclusively for marketing will be kept while there is a valid authorization and purpose, subject to periodic reviews and the right to revocation or deletion. Once the applicable period has ended, the information will be deleted, anonymized or kept under restricted retention when there is legal justification.

Article 25. Cookies, tags and similar technologies

The Website may use cookies, tags, pixels, identifiers or similar technologies for technical functions, security, preferences, measurement, analytics or advertising. Strictly necessary technologies may operate to allow the technical operation of the site. When a technology involves processing subject to authorization for analytics, advertising or profiling purposes, this will be clearly disclosed and choice mechanisms consistent with Colombian regulations will be implemented. The actual configuration must correspond to the current technical inventory and the services actually enabled.

Article 26. National database registry (RNBD)

LEUKOS will verify annually whether it is required to register its databases in the RNBD. Under Decree 090 of 2018 and the current SIC instructions, the obligation applies, among others, to companies and non-profit entities with total assets exceeding 100,000 UVT. Not being required to register does not exempt the company from complying with Law 1581 of 2012, this Policy or other data protection obligations.

Article 27. Substantial changes

Substantial changes concerning the identification of the Controller or the purposes must be communicated to Data Subjects in a timely manner before they are implemented and, where appropriate, require a new authorization. Non-substantial updates may be communicated by publishing the new version on the Website, keeping version and date control.

Article 28. Effective date

This Policy will take effect on the date it is approved by LEUKOS CONSULTING S.A.S. and published on its channels. Databases will remain in force for as long as necessary to fulfill the purposes and obligations described, without prejudice to specific legal retention periods. The Policy will remain available on the Website and will be reviewed periodically.

Approval

Approved by LEUKOS CONSULTING S.A.S. in Bogotá D. C.

DIANA ANGULO LOZANO
Legal Representative
LEUKOS CONSULTING S.A.S.
NIT 900817314-1