Personal data processing policy

1. Data controller

Controller: Forvel S.A.S., a Colombian simplified stock corporation, Tax ID (NIT) 902.094.186-6, domiciled in Bogotá D.C., Colombia. Forvel is the brand under which the services are provided.

Data protection contact: info@forvel.ai.

Queries, claims and requests from data subjects are handled through that address.

2. Scope and legal framework

This Policy binds Forvel as data controller and governs the collection, storage, use, circulation, transfer, transmission and deletion of the personal data of those who interact with Forvel, including prospects, clients, client contacts, referrers, referrals, suppliers and partners.

Processing is governed by Law 1581 of 2012 and its implementing decrees.

3. Definitions

For the purposes of this Policy, the definitions of Law 1581 of 2012 and Decree 1074 of 2015 apply, in particular:

• —Consent: the data subject's prior, express and informed authorization to carry out the processing.
• —Database: an organized set of personal data subject to processing.
• —Personal data: any information linked to, or that can be associated with, an identified or identifiable natural person.
• —Sensitive data: data affecting the data subject's privacy or whose misuse may lead to discrimination (health, political views, beliefs, biometric data, among others). Forvel does not deliberately collect sensitive data.
• —Processor: the natural or legal person who, alone or with others, carries out processing on the controller's behalf.
• —Controller: the natural or legal person who decides on the database and the processing (in this Policy, Forvel).
• —Data subject: the natural person whose data is processed.
• —Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
• —Transfer: sending data to a recipient, inside or outside the country, who is also a controller and will process the data on its own behalf.
• —Transmission: communicating data to a processor, inside or outside the country, so that it processes the data on the controller's behalf.

In addition: Forvel Plan is the platform where a prospect configures their project, books the definition meeting, approves, pays and follows progress; a Referrer is someone who recommends Forvel's services; a Referral is the person recommended; and a Case study is the communication piece describing a project and its results.

4. Governing principles

Forvel applies the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality, under article 4 of Law 1581 of 2012.

Accordingly, it processes data only for disclosed and legitimate purposes, with the data subject's consent where the law requires it, and adopts measures to guarantee security and confidentiality.

5. Data collected

Forvel collects only the data necessary for the purposes of this Policy. Depending on the case, it may include:

• —Identification and contact data: name, email address, phone, company or entity and role.
• —Project data: the challenge or need described in Forvel Plan, and any data provided for the development of the project.
• —Billing and contracting data: what is required to issue invoices and manage payment, under tax rules.
• —Meeting data: preferred day, time and time zone for the definition meeting.
• —Technical and browsing data: a temporary visit identifier that links the steps of a single journey, does not identify the user and disappears when the tab is closed.
• —Referral data: contact details a Referrer provides about a Referral.
• —Data for promotional purposes: name, brand, logo, testimonial, image and results the client authorizes for case studies.

6. Sensitive data and minors' data

6.1. Forvel neither requires nor requests sensitive data for the use of the site or of Forvel Plan. Users must refrain from entering sensitive data, their own or third parties', in free-text fields. If a specific project requires processing sensitive data, this will be agreed within the relevant contract, with the data subject's express consent and the reinforced security measures required by article 6 of Law 1581 of 2012.

6.2. Forvel's services are addressed to adults in business contexts. Forvel does not knowingly collect data from children or adolescents. If it becomes aware that a minor's data has been collected without the corresponding authorization, it will be deleted.

7. Purposes of processing

Forvel processes personal data for the following purposes:

• —Service delivery: handling requests, preparing the initial read of the challenge, and providing the contracted services.
• —Relationship management: arranging and holding the definition meeting and any other communication needed to run the project.
• —Billing and contracting: issuing invoices, managing collections and meeting tax and accounting obligations.
• —Commercial communications: sending information, news, content and offers about Forvel's services through the channels the data subject has provided.
• —Referral programme: operating it, contacting referrals and applying the corresponding benefits.
• —Promotional and marketing purposes: with the data subject's authorization, using name, brand, logo, testimonial, image, description of the challenge, the solution delivered and its results in case studies, portfolios, commercial proposals, the Forvel website, social media and other communication materials (see section 9).
• —Analytics and improvement: understanding which needs come up most often, producing statistics and improving the services.
• —Transmission to processors: transmitting data to infrastructure and technology providers in order to operate the service (see section 11).
• —Legal compliance: responding to requests from authorities and complying with the law.

Purpose limitation: Forvel does not use data for purposes other than those disclosed here. Any new purpose will require additional authorization from the data subject.

8. The data subject's consent

8.1. Form of consent. By describing their challenge and continuing in Forvel Plan, by requesting the definition meeting, by accepting these documents through the notice provided for that purpose, or by any other unequivocal means, the data subject consents to the processing of their data for the purposes of this Policy. Consent may be recorded in physical or electronic form, or by any means that allows it to be consulted later.

8.2. Evidence and retention. Forvel keeps evidence of the consent given, under Decree 1074 of 2015.

8.3. Withdrawal. The data subject may withdraw consent and request deletion of their data at any time, provided no legal or contractual duty requires retention. Withdrawal operates for the future.

9. Promotional use, case studies and testimonials

9.1. The data subject authorizes Forvel to use, for promotional, commercial and marketing purposes, the following information arising from the relationship: the client's trade name, logo and distinctive signs; a description of the challenge addressed and the solution delivered; the results and metrics obtained; and any testimonials or quotes the client provides. This information may be included in case studies, portfolios, commercial proposals, the Forvel website, social media and other communication materials.

9.2. Forvel will refrain from disclosing information the client has identified in writing as confidential and which does not form part of the authorized case study. At the client's request, the case may be presented anonymously, without name or logo.

9.3. The promotional use authorization is free of charge, non-exclusive and valid in the territories where Forvel operates. The client may withdraw it at any time by written request; withdrawal operates for the future and does not oblige Forvel to withdraw or destroy materials already published, distributed or produced before the withdrawal, although Forvel will make reasonable efforts not to reuse the case in new pieces.

9.4. Where a case study includes the image or testimonial of a natural person, that person is understood to authorize the use of their image and testimonial for these same purposes and under these same rules.

10. Processing of referral and third-party data

10.1. Anyone providing Forvel with a third party's contact details (for example, under the referral programme) declares and warrants that they have that third party's authorization to share them with Forvel for commercial contact purposes. This implies that Forvel may contact the referral directly in order to obtain their data for commercial purposes.

10.2. Whoever provides the data holds Forvel harmless against any claim arising from having provided it without proper authorization. Forvel will process the referral's data under this Policy and will inform the referral, at first contact, of the origin of their data and of their rights as a data subject.

11. Processors, transfer and international transmission

To operate the service, Forvel relies on infrastructure and technology providers that act as data processors and whose servers may be located outside Colombia:

The use of these providers involves a transmission and, where applicable, an international transfer of data. By accepting this Policy, the data subject grants express and unequivocal authorization for that transfer and transmission, under article 26 of Law 1581 of 2012.

Forvel enters into contracts with its processors requiring them to apply this Policy, maintain confidentiality, adopt adequate security measures and process the data solely on its instructions.

12. Rights of the data subject

Under article 8 of Law 1581 of 2012, the data subject may at any time:

• —Know, update and rectify their data.
• —Request evidence of the consent given.
• —Be informed about the use made of their data.
• —File complaints with the SIC for breaches of the law.
• —Withdraw consent and request deletion of their data where no legal or contractual duty requires retention.
• —Access their data free of charge.

13. Procedure for queries and claims

Queries, claims and requests are submitted to info@forvel.ai, stating the data subject's name, a description of the request and contact details. The statutory deadlines are:

An incomplete claim may be returned for correction within the following five (5) days. After two (2) months without a response from the applicant, it will be deemed abandoned. The data subject may turn to the SIC once the query or claim procedure before Forvel has been exhausted.

14. Information security

Forvel adopts reasonable technical, human and administrative measures to protect data against unauthorized access, loss, alteration or misuse, including need-based access control, encryption in transit where applicable, and restricting access to the personnel who require it to handle the request.

No system is absolutely impenetrable: Forvel does not guarantee absolute security, but acts diligently and addresses any incident promptly.

15. Database validity and retention

Forvel keeps data while a relationship with the data subject exists, while a purpose justifies it, or while a legal retention duty applies (for example, tax and commercial obligations). Once those grounds are met, data is deleted or anonymized.

Databases will remain active for as long as is necessary to fulfil the purposes of this Policy.

16. Privacy notice

Where it is not possible to make this Policy available to the data subject at the time of collection, Forvel will use a privacy notice stating the controller's identity, the processing and its purpose, the data subject's rights and the mechanism for consulting the full Policy.

17. National Database Registry

The duty to register with the National Database Registry (RNBD) administered by the SIC falls on controllers whose total assets exceed one hundred thousand (100,000) UVT. Forvel will comply with this obligation if and when it reaches that threshold; regardless, it complies with all other obligations of the data protection regime.

18. Cookies and tracking technologies

The site does not use analytics, advertising or cross-site tracking cookies, and for that reason it does not show a cookie banner either: there is nothing to consent to.

All the browser stores is what the site needs in order to work: a temporary visit identifier that links the steps of a single journey and disappears when the tab is closed, and the plan the user chooses to save, which stays in their own browser. Neither identifies the user nor follows them outside forvel.ai.

The client portal and the team's internal area do use a session cookie: it is what recognises someone who has already signed in, so they are not asked for their link or password on every screen. It is strictly necessary to provide the service — without it the portal cannot work —, it lasts as long as the access does, it does not follow anyone outside forvel.ai and it does not require prior consent. While a client is filling in their form, the browser also keeps a local copy of what they have written so far, so that closing the tab does not lose their work; that copy stays on their own device.

If analytics are introduced in the future, this section will be updated and the corresponding consent will be requested before activating them.

19. Amendments

Forvel may amend this Policy. The version in force is the one published on the site, with its update date. Substantial changes will be announced through the usual channels.

20. Governing law and effect

This Policy is governed by Colombian law and takes effect on the date stated in the header.