Privacy Policy

1. Generalities

This document establishes the Personal Data Processing Policies of Signa Techlaw Corp. (hereinafter the "ENTITY"), acting as a private law entity, in compliance with the provisions of Law 1581 of 2012 and Decree 1377 of 2013, and it describes the mechanisms through which the ENTITY guarantees proper handling of the personal data collected in its databases, in order to allow the owners the proper exercise of the fundamental right of Habeas Data.

2. Responsible

The ENTITY is a Company called Signa Techlaw Corp. domiciled in Miami, Florida, with Tax Identification Number (EIN) 30-1409754 and whose contact information is as follows:

• Address: 25 SW 9th St, Suite 406, Miami, FL, 33130
• Telephone: +57 2351699
• Email: legal@signaip.com
• Website: www.signaip.com

The ENTITY will directly exercise the processing of the personal data in question, subject to the provisions of this Policy. However, in the event that said functions are transferred to a third party to be a temporary manager or a permanent person in charge of processing the information, the designated third party will comply with the duties set forth in this document.

3. General Objective of this Information Treatment Policy

The Personal Data Processing Policy of Signa Techlaw Corp. aims to inform all people regarding the rights and duties that assist them in the face of the regulation of personal data protection in Colombia (Law 1581 of 2012 and Decree 1377 of 2013), all to guarantee a legal and ethical treatment of information of a personal nature within the ENTITY.

4. Definitions and Principles

• Authorization: Prior consent, express and informed by the Owner, to carry out the Processing of their personal data.
• Database: Organized set of personal data that is subject to Treatment.
• Personal data: Any information linked or that can be associated with one or more specific or determinable natural or legal persons.
• Manager: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller.
• Responsible: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Treatment of the data.
• Owner: Natural or legal person whose personal data is subject to Treatment.
• Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Applicable Principles:

• Principle of legality: The processing of personal data is a regulated activity that must be subject to the provisions of the law and the other provisions that develop it.
• Principle of purpose: The Treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Holder.
• Principle of freedom: Treatment can only be exercised with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.
• Principle of veracity or quality: The information subject to Treatment must be truthful, complete, exact, updated, verifiable and understandable. The Processing of partial, incomplete, fragmented or misleading data is prohibited.
• Principle of transparency: In the Treatment, the right of the Owner to obtain from the Treatment Manager, at any time and without unjustified restrictions, information about the existence of data that concerns them.
• Principle of restricted access and circulation: Treatment is subject to the limits derived from the nature of personal data, the provisions of the law and the Constitution. Personal data, except for public information, may not be available on the Internet or other means of mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or third parties authorized by law.
• Security principle: The information subject to Treatment must be handled with the technical, human and administrative measures necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
• Confidentiality principle: All persons involved in the Processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks that the Processing comprises.

5. Exceptions

The personal data present in the databases of the ENTITY may be sent to public, financial, public service, notarial and judicial entities that are inherent to the correct development of the legal transactions that have been concluded with its owner.

In addition, the ENTITY will provide the information required by the competent authorities for the self-control of the risk of money laundering and financing of terrorism, with respect to operations classified as suspicious or attempted, in the terms of the provisions of the Basic Legal Circular of the Superintendency of Companies.

Finally, for the proper fulfillment of constitutional and legal duties and obligations, the ENTITY may keep the information that is necessary for its full compliance. To that extent, there will be data that will be kept for periods established by law, despite the existence of the right of deletion of the corresponding holders of personal data.

6. Database Content

6.1 Clients

1. Identification data: general (full name/business name, class and identification number, marital status, gender), specific (signature, nationality, place and date of birth, age), and biometric (fingerprints, photographs and videos).
2. Location data related to business or professional activity, such as address, telephone and email.
3. Personal location data related to private activity, such as address, telephone and email.
4. Current occupation, profession or trade.
5. Information on the status of compliance with obligations to the ENTITY.

6.2 Suppliers and Contractors

1. Identification data: general, specific, and biometric as described above.
2. Location data related to business or professional activity, such as address, telephone and email.
3. Personal location data related to private activity, such as address, telephone and email.
4. Current occupation, profession or trade.
5. Information on the status of compliance with obligations to the ENTITY.

6.3 Allies

1. Identification data: general, specific, and biometric as described above.
2. Location data related to business or professional activity, such as address, telephone and email.
3. Personal location data related to private activity, such as address, telephone and email.
4. Information on the status of compliance with obligations to the ENTITY.

6.4 Shareholders

1. Identification data: general, specific, and biometric as described above.
2. Location data related to business or professional activity, such as address, telephone and email.
3. Personal location data related to private activity, such as address, telephone and email.
4. Data related to the class of shares of which they are the owner, their capital participation, the status of compliance with obligations with the ENTITY and the direction of their votes in deliberation processes at the Shareholders' Meeting.

6.5 Workers

1. Identification data: general, specific, and biometric as described above.
2. Location data related to business or professional activity, such as address, telephone and email.
3. Personal location data related to private activity, such as address, telephone and email.
4. Performance data such as employment and academic history.
5. Sensitive data such as the composition of the family group, the health of the worker and their eventual membership in trade union organizations.

The employee databases also include information on employment and academic history, sensitive data required by the nature of the employment relationship (photograph, composition of the family group, among others). Sensitive information may be stored in the databases with the prior authorization of its owner, in compliance with the provisions of articles 5 and 7 of Law 1581 of 2012.

7. Treatment

The information that appears in the databases of the ENTITY is subjected to different forms of treatment, such as collection, exchange, updating, processing, reproduction, compilation, storage, use, systematization and organization, all of them in compliance with the purposes set forth herein.

The information may be delivered, transmitted or transferred to public entities, business partners, contractors, affiliates and subsidiaries, solely for the purpose of fulfilling the purposes of the corresponding database. In any case, the delivery, transmission or transfer will be made after signing the commitments necessary to safeguard the confidentiality of the information.

Personal information, including sensitive information, may be transferred to third countries, as long as they have a security level equal to or higher than that present in the Colombian regulations. The ENTITY declares that it currently has contracts for the storage of information with Managers located inside and outside the country, which have an information privacy policy available to any interested party who requests it.

8. Scope

This Information Treatment Policy will apply to all the organizational processes of the ENTITY that involve the treatment of personal data. The ENTITY will fully comply with the provisions of this Policy to carry out any behavior that implies treatment of information.

9. Purpose

9.1 Clients

1. Evaluate and approve the commercial links to be established with clients.
2. Carry out follow-ups and commercial studies.
3. Promote a better offer of our range of services.
4. Proper monitoring and registration of our clientele, both current and potential, including their contact information. Knowledge studies of the profile of the various clients of Signa Techlaw Corp. may be carried out, as well as customer satisfaction surveys.

9.2 Suppliers

1. Proper monitoring and registration of our suppliers of products and services, both current and potential, including their contact information.
2. Inform you of important news concerning Signa Techlaw Corp. and/or about our services.

9.3 Allies

1. Promote the services of Signa Techlaw Corp. on the web pages of our allies.
2. Promote the services of our allies on the website of Signa Techlaw Corp. (www.signaip.com).

9.4 Shareholders

1. Organize and systematize the information of our entire group of shareholders.
2. Facilitate the exercise of the economic and political rights derived from the quality of shareholder.

9.5 Workers

1. Organize and systematize the information of all our Human Talent.
2. Verify the information presented in the selection process and their aptitude to occupy the position for which they are applying.
3. Comply with the obligations of an employment contract.
4. Advance the administrative, accounting and disciplinary procedures related to the worker.
5. Report the work resume of the worker within the ENTITY.
6. The other functions intrinsic to the access of the worker's information for the fulfillment of the Employment Contract.

9.6 Generalities

• Prevent and detect fraud or other illegal or prohibited activities.
• Ensure the security and integrity of the handling of all types of information within Signa Techlaw Corp.
• Organize and systematize the information of our entire work team.
• Facilitate the payment and/or collection of pending obligations. In this sense, the solvency and compliance status of said obligations can be supervised.
• Facilitate, promote, allow or maintain labor, civil and commercial relationships.
• Comply with pre-contractual, contractual, post-contractual, certification, commercial, customer service and marketing, processing, research, training, accreditation, consolidation, organization, updating, reporting, statistics, survey, service and processing objectives.

10. Rights of the Owners

In accordance with the provisions of article 8 of Law 1581 of 2012, holders may:

10.1 Know, update and rectify your personal data before the ENTITY or the Managers. This right may be exercised against partial, inaccurate, incomplete, fragmented, misleading data, or those whose Treatment is expressly prohibited or has not been authorized by its owner.

10.2 Request proof of the authorization granted to the ENTITY, except when expressly excepted as a requirement for Treatment, in accordance with the provisions of article 10 of Law 1581 of 2012.

10.3 Be informed by the ENTITY or the Manager, upon request through the corresponding consultation mechanism, regarding the use that has been given to your personal data.

10.4 Present before the Superintendency of Industry and Commerce complaints for infractions of Habeas Data, after exhausting the consultation and claim mechanisms provided in this Policy.

10.5 Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment. When the ENTITY demonstrates that it has justified reasons to keep the information in question, the revocation and/or deletion will proceed when the competent authority has determined that the ENTITY has engaged in conduct contrary to the law and the Constitution.

10.6 Free access to your personal data that has been processed.

11. Obligations of the ENTITY

The ENTITY must:

11.1 Guarantee the Holder, at all times, the full and effective exercise of the fundamental right of habeas data.

11.2 Request and keep, under the conditions set forth in this Policy, a copy of the respective authorization granted by the Holder.

11.3 Duly inform the Holder about the purpose of the treatment and the rights that assist them by virtue of the authorization granted.

11.4 Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

11.5 Guarantee that the information provided to the Manager is true, complete, accurate, updated, verifiable and understandable.

11.6 Update the information, communicating in a timely manner to the Person in Charge of the Treatment all news regarding the data previously provided and adopt the measures necessary so that the information provided is kept up to date.

11.7 Rectify the information when it is incorrect and communicate what is pertinent to the Manager.

11.8 Provide the Processor, as the case may be, only data whose Treatment is previously authorized in accordance with the provisions of this law.

11.9 Require the Manager at all times to respect the security and privacy conditions of the Holder's information.

11.10 Process queries and claims formulated in the terms indicated in this Policy.

11.11 Adopt an internal manual of policies and procedures to guarantee proper compliance with this Policy and, in particular, for dealing with queries and claims.

11.12 Inform the Manager when certain information is under discussion by the Holder, once the claim has been filed and the respective procedure has not been completed.

11.13 Inform at the request of the Owner about the use given to their data.

11.14 Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the Holders' information.

11.15 Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

12. Person or Area Responsible for Queries and Claims

Any request, query, complaint, or claim related to the handling of personal data, in application of the provisions of Law 1581 of 2012 and Decree 1377 of 2013, must be sent to:

• Entity: Signa Techlaw Corp.
• Unit: Customer Service
• Address: 25 SW 9th St, Suite 406, Miami, FL, 33130
• Telephone: +57 2351699
• Email: legal@signaip.com

13. Procedures for Submitting and Responding to Queries

The holders of personal data that appear in the ENTITY's databases, their proxies, or their successors in title, may consult the data being processed by the ENTITY. Any request for consultation must be submitted in writing or by email, as per the contact information contained in this document.

Queries will be answered within a term of ten (10) business days from the date of receipt of the respective request. If it is not possible to respond within this term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the query will be addressed, which may not exceed five (5) business days following the expiration of the initial term.

14. Procedures for Submitting and Responding to Requests and Claims

Claims must be submitted in writing or by email, in accordance with the conditions outlined in this document, and must include at least the following information:

• Identification of the Holder
• Clear and concise description of the facts leading to the claim
• What is requested, clearly and precisely
• Documentation to be submitted as evidence
• Notification address of the Holder, both physical and electronic

If the consultation and claim mechanisms are to be exercised through a proxy, a duly authenticated power of attorney before a Notary Public must be provided to initiate the process. Likewise, when acting on behalf of a legal entity, proof of legal or contractual representative status must be submitted.

If the claim is incomplete, the interested party will be required within five (5) days after receipt to correct the issues. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

15. Validity of this Policy

The ENTITY's Personal Information Treatment Policies will be effective as of February 25, 2020. The ENTITY reserves the right to modify them, under the terms and within the limitations provided by law.

The databases managed by the ENTITY will be maintained indefinitely, as long as it continues its operations and it is necessary to ensure compliance with legal obligations, particularly labor and accounting taxes. However, the data may be deleted at any time upon the request of the holder, as long as this request does not contravene a legal obligation of the ENTITY or an obligation contained in a contract between the ENTITY and the Holder that supports its retention.

Last updated: 2026