Legal

Personal Data Processing Policy

Last updated: October 1, 2026

PAREX COLOMBIA S.A.S. · NIT 902.100.505-9 · Version 1.0

This is an English translation of the Política de Tratamiento de Datos Personales issued under Colombian law. If there is any discrepancy, the Spanish version prevails.

Chapter I. General provisions

Clause one. Identification of the data controller

The controller of the personal data covered by this policy is PAREX COLOMBIA S.A.S., a simplified stock company with its principal place of business in Bogotá D.C., identified with NIT 902.100.505-9 and commercial registration No. 04147376 of the Bogotá Chamber of Commerce (hereinafter, "PAREX"), domiciled in Bogotá D.C., with the email address for personal data matters compliance@parex.ai.

Clause two. Legal framework

This policy is issued in compliance with article 15 of the Colombian Constitution; Statutory Law 1581 of 2012; Chapter 25 of Title 2 of Part 2 of Book 2 of Decree 1074 of 2015 (which compiles Decree 1377 of 2013); Statutory Law 1266 of 2008, as amended by Law 2157 of 2021, regarding financial, credit, commercial and service information; and the instructions issued by the Superintendencia de Industria y Comercio.

Clause three. Scope

This policy applies to all databases and files containing personal data processed by PAREX, whether automated or manual, in the course of its construction materials marketplace, confirming and receivables purchase operations, and its administrative operations. It is mandatory for PAREX, its directors and officers, employees, contractors and the processors that handle data on behalf of PAREX.

Clause four. Definitions

For the purposes of this policy, the definitions of article 3 of Law 1581 of 2012 and article 3 of Law 1266 of 2008 are adopted, in particular: authorization, database, personal data, public data, semi-private data, private data, sensitive data, data processor, data controller, data subject, processing, transfer and transmission.

Clause five. Principles

In all processing, PAREX will apply the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality set out in article 4 of Law 1581 of 2012, and the principle of demonstrated accountability, under which PAREX will keep evidence of the measures adopted to comply with the law.

Chapter II. Data subjects, data and purposes

Clause six. Data subjects

PAREX processes data of the following categories of data subjects:

(a) Legal representatives, attorneys-in-fact, shareholders, beneficial owners and contacts of materials suppliers onboarded to the marketplace.
(b) Legal representatives, attorneys-in-fact, shareholders, beneficial owners, site contacts and authorized personnel of client construction companies.
(c) Individuals who undertake obligations as joint and several co-debtors, guarantors or sureties of the construction companies’ obligations.
(d) Users of the PAREX digital platform and visitors to its channels.
(e) Contacts at partner banks, insurers, funders, investors and other commercial partners.
(f) Employees, contractors, interns and candidates in recruitment processes.

Clause seven. Data processed

PAREX may process identification, contact, location, employment and professional, asset, tax, financial, credit and commercial data, information from restrictive lists and on politically exposed persons, platform access and usage logs, and electronic signatures. PAREX will not request sensitive data unless required by law or expressly authorized by the data subject; in that case it will inform the data subject that they are not obliged to provide it. Biometric data captured for identity verification during digital onboarding will be treated as sensitive data, with express and separate authorization.

Clause eight. Data by collection channel

PAREX collects data through the following channels:

(a) Registration or contact form on the website: email address and, optionally, name, company and phone number. The email address is required to respond to the request.
(b) Onboarding on the platform: identification data of the company, its representatives, shareholders and beneficial owners, financial and tax information, and supporting documents. These are required to onboard and operate.
(c) Credit line request and credit operations: financial and credit information of the construction company and its co-debtors, and inquiries with credit information bureaus. These are required for the credit analysis.
(d) Whistleblower channel: subject and description of the report, which are required, and optionally the reporter’s name, email and mobile phone. Reports can be made anonymously.
(e) In-person, phone or messaging commercial contact: name, company, position and contact details.

Clause nine. General purposes

Data will be processed for the following purposes:

(a) Onboarding suppliers and construction companies to the platform and verifying their identity and that of their representatives and beneficial owners.
(b) Carrying out the credit analysis of construction companies and their joint and several co-debtors, assigning and reviewing credit lines, and monitoring the portfolio.
(c) Entering into, performing and managing materials purchase and sale, confirming, receivables purchase and electronic invoice endorsement operations, and their registration in RADIAN.
(d) Carrying out pre-judicial and judicial collection and exercising the rights arising from negotiable instruments and guarantees.
(e) Complying with the obligations of the Self-Control and Risk Management System for ML/TF/FP and C/TB (Sistema de Autocontrol y Gestión de Riesgos LA/FT/FP y C/ST) under the Circular Básica Jurídica of the Superintendencia de Sociedades, including due diligence, screening against restrictive lists and reports to the Unidad de Información y Análisis Financiero.
(f) Managing the trade credit insurance covering the portfolio, including the information the insurer requires for underwriting, monitoring and claims.
(g) Coordinating with the partner banks financing the project, on the terms authorized by the data subject.
(h) Complying with accounting, tax and electronic invoicing obligations and responding to requests from authorities.
(i) Sending operational communications and, with prior authorization, commercial communications about PAREX products.
(j) Managing the employment or contractual relationship with employees and contractors and running recruitment processes.
(k) Securing the platform, preventing fraud and impersonation, and keeping audit logs.
(l) Assigning, endorsing or selling the portfolio and the instruments arising from the operations to funders or third parties, and allowing due diligence by potential investors, acquirers or companies resulting from a merger, spin-off or acquisition, under confidentiality undertakings.

Clause ten. Essential and optional purposes

The purposes in items (a) to (h), (j), (k) and (l) of the previous clause are essential to the relationship with the data subject. The purpose in item (i) is optional: the data subject may refuse it or revoke it at any time without affecting the relationship. PAREX does not sell, rent or trade personal data with third parties for those third parties’ commercial purposes.

Clause eleven. Financial and credit information

To consult and report information with financial, credit, commercial and service information bureaus, PAREX will obtain prior, express and separate authorization from the data subject, in accordance with Law 1266 of 2008. The information consulted will be used only to analyze and calculate the data subject’s credit risk and to evaluate the contractual relationship, and never for employment decisions, in accordance with article 10 of Law 1266 of 2008 as amended by Law 2157 of 2021. Before reporting negative data, PAREX will send prior notice to the data subject and observe the period set out in article 12 of Law 1266 of 2008, counted from the sending of that notice. Negative data will be removed in accordance with the retention periods of article 13 of the same law.

Clause twelve. Joint and several co-debtors

Individuals who undertake obligations as joint and several co-debtors will grant, in their own name, authorization for the processing of their data, inquiries and reporting with information bureaus, and screening against restrictive lists. This authorization may be recorded in the same document or digital flow in which the construction company grants its own, provided the co-debtor accepts it with their own signature or individual acceptance mechanism. When the legal representative of the construction company is also a co-debtor, they will grant the authorization in both capacities, separately. The authorization granted by the construction company as a legal entity does not replace the co-debtor’s personal authorization.

Clause thirteen. Whistleblower channel data

Data received through the whistleblower channel will be used solely to investigate possible breaches, acts of corruption, bribery, money laundering or conduct contrary to PAREX’s codes and policies. PAREX will protect the reporter’s identity, will not use this data for commercial purposes and will share it only with those who must take part in the investigation or with the competent authorities. It will be kept for as long as the investigation and the applicable legal retention obligations require.

Chapter III. Authorization

Clause fourteen. Obtaining authorization

PAREX will obtain the data subject’s authorization no later than at the time of collection, in writing, by electronic means, including acceptance on the platform with mechanisms that allow later consultation, or through unequivocal conduct. PAREX will keep proof of the authorization for the entire duration of the processing.

Clause fifteen. Cases where authorization is not required

Authorization will not be required in the cases of article 10 of Law 1581 of 2012, in particular when the information is requested by a public entity in the exercise of its legal functions or by court order, when it is public data, or when it relates to the Civil Registry of Persons.

Clause sixteen. Third-party data provided by clients

When a supplier or a construction company provides PAREX with data of its representatives, employees, contacts or beneficial owners, it will represent that it has those data subjects’ authorization to share it with PAREX for the purposes of this policy, and will hold PAREX harmless against claims arising from the lack of such authorization.

Chapter IV. Circulation of data

Clause seventeen. Processors and recipients

PAREX may share data, to the extent necessary for each purpose, with: (a) the external provider supporting the administration of the Self-Control and Risk Management System for ML/TF/FP and C/TB, as a processor; (b) the trade credit insurer; (c) partner banks, with the data subject’s prior authorization; (d) financial and credit information bureaus; (e) technology providers for hosting, electronic signature, identity verification and electronic invoicing; (f) legal, accounting and audit advisors; and (g) competent authorities. PAREX will sign with each processor a data transmission agreement containing the obligations of article 2.2.2.25.5.2 of Decree 1074 of 2015.

Clause eighteen. International transmission and transfer

When data is hosted or processed by processors outside Colombia, PAREX will sign a data transmission agreement under Decree 1074 of 2015, which does not require additional authorization from the data subject. Any international transfer to a controller will be subject to article 26 of Law 1581 of 2012: only to countries with adequate levels of protection according to the Superintendencia de Industria y Comercio, or with the data subject’s express authorization or under the other legal exceptions.

Clause nineteen. Circulation to other companies

PAREX does not share personal data with companies with which it has no contractual relationship for processing. If an economic affiliation with another company arises in the future, any circulation of data will take place only after this policy is updated and, where applicable, new authorization is obtained.

Chapter V. Rights and procedures

Clause twenty. Rights of the data subject

The data subject has the right to: (a) know, update and rectify their data; (b) request proof of the authorization; (c) be informed about the use of their data; (d) file complaints with the Superintendencia de Industria y Comercio, after exhausting the procedure with PAREX; (e) revoke the authorization or request deletion when there is no legal or contractual duty to remain in the database; and (f) access their data free of charge at least once per calendar month, and whenever there are substantial changes to this policy, under article 8 of Law 1581 of 2012 and article 2.2.2.25.4.2 of Decree 1074 of 2015.

Clause twenty-one. Responsible area

Inquiries and claims are handled by the PAREX compliance area through the email address compliance@parex.ai, which is the official channel for exercising the data subject’s rights. Until the company appoints a separate data protection officer, this function is performed by the legal representative.

Clause twenty-two. Standing and proof

Under article 2.2.2.25.4.1 of Decree 1074 of 2015, the rights may be exercised by: (a) the data subject, proving their identity with a copy of their ID document; (b) their successors, proving that status with the death certificate of the deceased and the document proving kinship or allocation; (c) their representative or attorney-in-fact, with a copy of the power of attorney and of their ID document; and (d) anyone acting under a stipulation for the benefit of another. If PAREX finds discrepancies between the data subject’s name and the document provided, it will inform the requester within five (5) business days so they can clarify them. PAREX will not deliver information to anyone who does not prove standing.

Clause twenty-three. Inquiries

Inquiries will be answered within a maximum of ten (10) business days from receipt. When this is not possible, the requester will be informed of the reason and the response date, which may not exceed five (5) additional business days, in accordance with article 14 of Law 1581 of 2012.

Clause twenty-four. Claims

Claims for correction, update, deletion or non-compliance will be handled under article 15 of Law 1581 of 2012: the claim must include the data subject’s identification, a description of the facts, the address and the supporting documents. If it is incomplete, the requester will be asked to complete it within the following five (5) days; if the information is not provided within two (2) months, the claim will be deemed withdrawn. The legend "claim in process" will be added within no more than two (2) business days. If PAREX is not competent to resolve the claim, it will forward it to the appropriate party within a maximum of two (2) business days and inform the requester. The maximum response time is fifteen (15) business days, extendable by eight (8) business days with notice of the reasons. Claims concerning financial and credit information will also follow article 16 of Law 1266 of 2008.

Clause twenty-five. Revocation

Revocation may be total, covering all purposes, or partial, covering specific purposes such as commercial communications, in which case PAREX may continue processing the data for the other authorized purposes. The data subject will state the scope of the revocation in their request.

Clause twenty-six. Limits to deletion

Deletion or revocation will not proceed while obligations of the data subject or of the construction company they back remain outstanding, nor regarding information PAREX must keep by law, in particular the supporting documents of the Self-Control and Risk Management System for ML/TF/FP and C/TB and the merchant’s books and records, which will be kept for the period set out in article 28 of Law 962 of 2005.

Chapter VI. Security, validity and registration

Clause twenty-seven. Security

PAREX will adopt technical, human and administrative measures to protect data against tampering, loss, or unauthorized consultation or access, including role-based access control, encryption, audit logs and confidentiality undertakings. Security incidents affecting personal data will be reported to the Superintendencia de Industria y Comercio in accordance with item n) of article 17 of Law 1581 of 2012 and that entity’s instructions.

Clause twenty-eight. Cookies and similar technologies

Cookies are small files a website stores in the user’s browser to remember information about their visit. PAREX may use the following categories on its website and platform:

(a) Strictly necessary: they allow signing in, keeping the session active, protecting the platform and preventing fraud. They do not require consent because the service does not work without them.
(b) Functional: they remember user preferences, such as language or platform settings.
(c) Analytics: they measure, in aggregate, how the site is used, for example pages visited and browsing time, in order to improve it.
(d) Advertising or tracking: they measure campaigns and show PAREX ads on other sites.

Cookies in items (b), (c) and (d) will only be activated with the user’s prior acceptance through a notice on the site, which will allow them to accept, reject or configure them by category, and to withdraw consent at any time. Rejecting them does not prevent use of the platform. When these cookies are provided by third parties, such as analytics providers or advertising networks, those third parties will act as processors or under their own policies, and the information may be processed outside Colombia under the clause on international transmission and transfer. Users can also block or delete cookies from their browser settings. PAREX will publish the updated list of cookies in use on its website.

Clause twenty-nine. Minors

The platform is intended exclusively for legal entities and for adult individuals acting on their behalf or as co-debtors. PAREX does not collect data from children or adolescents; if it does so by mistake, it will delete it.

Clause thirty. National Database Registry

PAREX will register its databases in the National Database Registry (Registro Nacional de Bases de Datos) when its total assets exceed one hundred thousand (100,000) UVT, in accordance with article 2.2.2.26.1.2 of Decree 1074 of 2015, as amended by Decree 090 of 2018.

Clause thirty-one. Retention of databases

Data will remain in the databases for as long as necessary to fulfill the purposes for which it was collected and the legal retention periods. Contact data received through the website from people who do not end up onboarding will be kept for up to three (3) years from the last interaction, unless deletion is requested earlier. Once these periods expire, PAREX will delete or anonymize the data.

Clause thirty-two. Amendments

Any substantial change to this policy will be communicated to data subjects before it takes effect, by publishing it on the website with its update date and, when PAREX has their email address, by that means. When the change concerns the purpose of the processing, new authorization will be obtained.

Clause thirty-three. Validity and version

This policy corresponds to version 1.0 and is effective as of October 1, 2026.