PRIVACY POLICY

Data Controller

JD SPECIALIST SAS, a commercial company identified with Tax ID (NIT) 901.278.309-2 and domiciled in Bogotá D.C., Colombia, is the data controller responsible for the processing of personal data collected and processed in connection with its activities and through its physical and digital channels.

Contact information of the Data Controller:

Company name: JD SPECIALIST SAS

Tax ID (NIT): 901.278.309-2

Domicile: Bogotá D.C., Colombia

Business address: Calle 126 # 46-25 Of. 503, Bogotá D.C., Colombia

Address for judicial notices: Carrera 15 # 85-76 Of. 501, Bogotá D.C., Colombia

Telephone: +57 315 892 9101

Email: contactenos@jdsupportit.com.co

Website: https://www.jdsoporte.net

This Policy establishes the guidelines applicable to the processing of personal data carried out by JD SPECIALIST SAS in accordance with the Political Constitution of Colombia, Law 1581 of 2012, Decree 1074 of 2015, and any other provisions that amend, supplement or replace them.

Scope

This Policy applies to personal data that is collected, stored, used, circulated, transmitted, updated, consulted, deleted or otherwise processed by JD SPECIALIST SAS in the course of its activities.

It includes, among others, data provided through:

• the website www.jdsoporte.net;
• contact forms;
• Microsoft Bookings;
• email;
• telephone communications;
• requests for information or quotations;
• relationships with customers, prospects, suppliers and contractors;
• support and customer service activities;
• other channels authorized by the company.

Data processed

Depending on the relationship with the data subject, JD SPECIALIST SAS may process data such as:

• first and last names;
• company or organization;
• position or job title, when provided;
• email address;
• telephone number;
• city or country, when required;
• service or technology solution of interest;
• content of requests, inquiries and messages;
• information necessary to schedule meetings;
• information related to proposals or commercial relationships;
• records of communications associated with requests;
• date and time of interactions;
• technical data necessary for security, abuse prevention and operation of digital services, such as IP addresses and server logs.

JD SPECIALIST SAS does not request sensitive personal data or data relating to children or adolescents through its public contact form.

If it becomes exceptionally necessary to process sensitive data, the data subject will be informed in advance of the optional nature of providing such data, the specific purpose of the processing, and the rights available to them, and the corresponding authorization will be requested.

Purposes

JD SPECIALIST SAS may process personal data for the following purposes:

1. receiving, recording and responding to inquiries;
2. responding to requests for information;
3. responding to requests for quotations or proposals;
4. contacting the data subject in connection with a request submitted by them;
5. identifying needs related to technology services;
6. scheduling and managing meetings requested by the data subject;
7. preparing commercial proposals requested by customers or prospects;
8. following up on requests, proposals or commercial relationships;
9. providing contracted services;
10. managing support and customer service activities;
11. managing contractual relationships with customers, suppliers and contractors;
12. maintaining communications related to an existing request or commercial relationship;
13. complying with legal, contractual, accounting, tax and administrative obligations;
14. maintaining evidence of communications and authorizations when necessary;
15. protecting the company’s systems, infrastructure and digital channels;
16. preventing fraud, abuse, spam, automated attacks and activities that compromise security;
17. responding to requests from competent administrative or judicial authorities;
18. exercising or defending the rights of JD SPECIALIST SAS when necessary.

Personal data submitted through the website contact form will not, merely because it has been provided, be used for mass advertising campaigns, commercial newsletters or promotions unrelated to the request submitted.

If JD SPECIALIST SAS wishes to carry out additional direct marketing processing that requires authorization, it will request separate authorization when applicable.

Authorization

When required by applicable law, JD SPECIALIST SAS will obtain the prior, express and informed authorization of the data subject.

Authorization may be obtained through written, electronic, digital or other mechanisms that reasonably and unequivocally demonstrate that the data subject granted consent and that allow evidence of such authorization to be retained.

When requesting authorization, JD SPECIALIST SAS will inform the data subject, at a minimum, of:

• the processing to which their data will be subject;
• the purposes of the processing;
• the optional nature of responding when sensitive data or data relating to minors is involved, where applicable;
• the rights available to the data subject;
• the identification and contact details of the Data Controller.

Submission of an inquiry through the website will not be interpreted as a general authorization for advertising activities other than the purposes disclosed at the time the data was collected.

JD SPECIALIST SAS may process personal data without prior authorization only in cases expressly permitted by Colombian law, including when information is requested by a competent public or administrative authority in the exercise of its legal functions or pursuant to a court order, when the information is public in nature, or in other cases provided for by law.

The absence of a requirement to obtain authorization does not exempt JD SPECIALIST SAS from complying with the other principles and obligations applicable to personal data processing.

Data subject rights

Data subjects whose personal data is processed by JD SPECIALIST SAS have the right to:

1. know, update and rectify their personal data;
2. request evidence of the authorization granted, when legally applicable;
3. be informed, upon request, of the use made of their data;
4. submit inquiries and claims;
5. request deletion of their data when legally applicable;
6. revoke authorization when legally applicable;
7. access, free of charge, the personal data that has been processed;
8. file complaints with the Superintendence of Industry and Commerce once the corresponding procedure before the Data Controller has been exhausted, when such requirement applies;
9. exercise any other rights recognized under Colombian law.

Inquiries and claims

The Administration Department of JD SPECIALIST SAS is responsible for receiving and processing inquiries, requests and claims related to personal data protection.

The electronic channel provided for these purposes is:

contactenos@jdsupportit.com.co

Communications may also be sent to:

Calle 126 # 46-25 Of. 503, Bogotá D.C., Colombia.

The data subject, their successor in interest or duly authorized representative may consult personal information held in the systems or databases of JD SPECIALIST SAS.

The request must contain sufficient information to identify the data subject and the data concerned.

Inquiries will be answered within a maximum period of ten (10) business days from the date of receipt.

When it is not possible to respond within this period, JD SPECIALIST SAS will inform the interested party of the reasons for the delay and the date on which the inquiry will be answered, provided that the additional period does not exceed five (5) business days.

When a data subject believes that information processed by JD SPECIALIST SAS should be corrected, updated or deleted, or when they become aware of an alleged breach of the duties established by data protection regulations, they may submit a claim.

The claim must contain:

• identification of the data subject;
• a clear description of the facts giving rise to the request;
• contact information;
• documents or evidence supporting the request, where relevant.

If the claim is incomplete, JD SPECIALIST SAS may request that the interested party complete the information in accordance with the time limits established by applicable law.

Once a complete claim has been received, it will be handled within a maximum period of fifteen (15) business days.

When it is not possible to respond within that period, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, provided that the additional period does not exceed eight (8) business days.

The data subject may request deletion of their data or revocation of authorization when legally applicable.

Deletion or revocation will not apply where there is a legal or contractual duty requiring the information to be retained, where the data is necessary to comply with existing obligations, or where another legitimate basis permits or requires its retention.

Providers and processors

JD SPECIALIST SAS may use providers acting as data processors to support its technology and business operations.

These providers may include services relating to:

• website hosting;
• technology infrastructure;
• cybersecurity;
• email;
• storage;
• business collaboration;
• meeting scheduling;
• technology support.

Platforms currently used may include Microsoft services, including Microsoft 365, Microsoft Graph and Microsoft Bookings.

JD SPECIALIST SAS will seek to ensure that processors handle data only in accordance with the applicable purposes and instructions and that they adopt appropriate confidentiality and security measures.

International transfers and transmissions

The use of technology providers may involve storage, processing or transmission of information using infrastructure located inside or outside Colombia.

Where applicable, JD SPECIALIST SAS will adopt the legal, contractual, technical and organizational measures required under Colombian law for transfers or transmissions of personal data.

In cases involving the transmission of data to processors, such processors must process the information on behalf of JD SPECIALIST SAS and in accordance with the purposes and instructions established by the company and applicable law.

Retention

Personal data will be retained only for the period reasonably necessary to fulfill the purposes for which it was collected and to comply with applicable legal, contractual, administrative, accounting or rights-defense obligations.

Once there is no longer a legitimate need to retain the data, it will be deleted, anonymized or otherwise processed in accordance with applicable legal obligations.

The public website form does not currently create a separate commercial prospect database. Requests and responses may remain in JD SPECIALIST SAS corporate email and collaboration systems for the period necessary for their management and retention.

Security

JD SPECIALIST SAS adopts reasonable administrative, organizational and technical measures designed to protect personal data against loss, alteration, consultation, use, access, disclosure or unauthorized processing.

These measures may include access controls, authentication, infrastructure security mechanisms, backups, technical logs, abuse protection and other measures appropriate to the level of risk.

However, no computer system or Internet transmission mechanism can guarantee absolute security.

Cookies and similar technologies

The website may process technical information strictly necessary for its operation and security, including server logs and IP addresses.

This information may be used exclusively for purposes such as:

• security;
• diagnostics;
• fraud prevention;
• limiting automated requests;
• incident investigation;
• protecting service availability.

The website may use technologies strictly necessary for its operation, security, maintenance of technical preferences or abuse prevention.

If JD SPECIALIST SAS later introduces cookies or technologies for analytics, advertising, profiling or tracking that involve personal data processing and require consent, the corresponding information and authorization mechanisms will be implemented before such processing takes place.

Minors

The services offered through the website are primarily intended for businesses and adults.

JD SPECIALIST SAS does not intentionally seek to collect personal data relating to children or adolescents through its public form.

Where it becomes exceptionally necessary to process such data, the best interests of minors and the conditions established by Colombian law will be observed.

Changes

JD SPECIALIST SAS may amend this Policy in response to regulatory, legal, technological or business changes, or changes in its data processing activities.

Where substantial changes affect the purposes of processing or require new authorization, the measures required by applicable law will be adopted.

The current version will be available at:

https://www.jdsoporte.net/privacidad/

Effective date

This Personal Data Processing and Protection Policy becomes effective on September 17, 2026.

The databases and associated processing activities will remain in effect for as long as necessary to fulfill the purposes described herein and applicable legal or contractual obligations.