Data Protection

AM25, S.A.S. DE C.V.

Version 1.2

This Policy sets out the measures applied by AM25, S.A.S. DE C.V. (hereinafter, “AM25”) for the processing and protection of personal data used in connection with the provision of its services and the management of its operations. AM25 will process personal data only for legitimate, specific purposes related to the applicable commercial, contractual, technical, or administrative relationship.

Scope and Supplementary Documents

This Policy establishes AM25’s general data protection framework. Product-specific privacy notices, service terms, and applicable data processing agreements supplement this framework and describe the particulars of each relationship. Specific commitments regarding availability, support, backups, restoration, handover, and service closure are established in the documents applicable to each engagement and do not automatically extend to other services.

Updating this Policy does not, by itself, amend signed contracts or replace the versions or annexes incorporated into them. Any contractual amendment must follow the procedure applicable to the relevant relationship, without prejudice to enforceable legal obligations.

Definitions

For the purposes of this Policy:

• Personal data: information linked or capable of being linked to an identified or identifiable natural person.

• Data subject: the natural person to whom the personal data relates.

• Processing: any operation performed on personal data, including its collection, recording, storage, consultation, modification, transmission, or deletion.

• Data controller: the natural or legal person who determines the purposes and means of processing personal data.

• Data processor: the natural or legal person who processes personal data on behalf of the data controller.

• ARCO-POL rights: the rights of access, rectification, cancellation, objection, portability, erasure, and restriction recognized under applicable law.

Data Processed

Depending on the nature of each relationship or service, AM25 may process identification data, contact information, billing data, contractual information, technical records, authorized credentials, and other information necessary to:

• prepare quotations, proposals, contracts, and receipts;

• invoice and manage payments;

• provide and manage services;

• provide technical support;

• send transactional communications;

• protect its systems and infrastructure;

• perform backups and data recovery;

• comply with legal and contractual obligations.

AM25 will seek to collect only the information necessary for these purposes.

Responsibility for Personal Data

AM25 may act as a data controller when managing data required for its own operations and commercial relationships.

When processing personal data on behalf of a client that determines the purposes and means of processing, AM25 will act as a data processor, within the scope of the contracted service and in accordance with applicable documented instructions. Data managed on behalf of a client will not be used for AM25’s own purposes unrelated to the contracted service.

The relevant contract or data processing agreement must specify, according to the nature of the service, the subject matter and duration of processing, its purposes, the categories of data and data subjects, authorized instructions, and the conditions for access, assistance, return, or deletion. Requests concerning data processed on behalf of a client will be coordinated with the relevant controller, without prejudice to AM25’s legal obligations.

Access and Confidentiality

Access to personal data will be limited to expressly authorized persons and only when necessary for the performance of their duties. Permissions will be assigned on a least-privilege basis and reviewed or revoked when duties change or access is no longer required.

Every authorized person must use the data solely for their assigned duties and will be subject to confidentiality obligations. Authorization to access information does not permit its use for purposes other than those of the relevant relationship or service.

Information Security

AM25 applies technical and organizational measures designed to protect the confidentiality, integrity, and availability of personal data.

Measures currently implemented include:

• unique and independent passwords for different services;

• two-factor authentication (2FA) on critical administrative systems;

• restricted access to infrastructure and services;

• AES-256-GCM encryption of personal data and documents stored in KIZUNA™ Ops where applicable to the system design;

• communications protected through HTTPS/TLS;

• logical separation between applications, databases, and services;

• firewall and access controls on managed infrastructure;

• periodic data backups.

The scope of each control depends on the relevant component and system design. The reference to KIZUNA™ Ops encryption does not imply that all data across all products, integrations, or providers uses the same mechanism.

Sensitive Operations

Before performing operations that may delete information, revoke access, or significantly affect data availability or integrity, AM25 will verify the requester’s identity and authority, the scope of the affected resources, and foreseeable consequences, as appropriate. Authorization and recovery measures will be determined according to the relevant service and procedure.

Creating a prior backup will not be a universal requirement: its necessity and appropriateness will be assessed without conflicting with valid erasure requests, retention periods, or legal obligations. Specific procedures will be established in the relevant agreements or protocols.

Storage and Backups

The KIZUNA™ Ops database is hosted on VPS infrastructure managed by AM25. Personal data and documents stored in KIZUNA™ Ops are protected through the controls defined in this Policy. The KIZUNA™ Ops database is backed up daily to external storage using Cloudflare R2. Backups are used exclusively for recovery, business continuity, and incident response.

These conditions describe KIZUNA™ Ops and do not establish a universal backup frequency or retention period for client websites, applications, or infrastructure. The scope, frequency, retention, and restoration capabilities of each service will be defined in its relevant documentation or agreement.

Technology Providers and Artificial Intelligence

AM25 may use external providers for infrastructure, storage, email, code repositories, payments, monitoring, and other services required for its operations. The use of these services will be limited to the purposes necessary for the relevant service and, where applicable, through permissions restricted to the minimum necessary scope.

When a product incorporates artificial intelligence features, including those provided through KIZUNA™ Assistant, the relevant privacy notice or documentation must describe the purposes, categories of information used, and involvement of external providers where applicable. Access to or transmission of information to these features must be limited to what is necessary for the request and the authorized context.

Each provider’s specific processing and retention conditions will depend on the relevant service and configuration. This Policy does not generally attribute retention, location, or training-use conditions to all providers unless those conditions have been verified for the relevant integration.

Retention and Deletion

Personal data will be retained for as long as necessary to fulfill the purpose for which it was processed and to comply with applicable contractual, tax, or legal obligations. Data used in service operations, information contained in backups, and commercial, contractual, or tax documentation subject to retention will be distinguished.

When the data is no longer necessary and there is no obligation to retain it, AM25 will proceed with its deletion, anonymization, or restriction, as appropriate. Closing a service or revoking access does not, by itself, imply the immediate deletion of all related documentation or all backup copies.

Information contained in backups may be deleted in accordance with the retention cycles established for each system, without prejudice to applicable legal obligations. During that period, access to copies will remain restricted to recovery, business continuity, and incident response purposes. When a backup is restored, previously fulfilled erasure requests or processing restrictions must be taken into account to avoid reactivating unauthorized uses.

Rights of Data Subjects

Data subjects may exercise the rights recognized under Salvadoran law, including the rights of access, rectification, cancellation, objection, portability, erasure, and restriction, where applicable.

Requests to exercise these rights may be submitted directly to AM25 by email.

The request must include, at a minimum:

• full name of the data subject or their representative;

• sufficient identification to verify their identity or authority;

• the right they wish to exercise;

• a clear description of the request and the personal data concerned;

• contact information for receiving communications or the corresponding response.

Where necessary, AM25 may request additional information or documentation to verify the identity of the person making the request, establish their authority to act on behalf of another person, or accurately identify the data concerned.

Once the necessary information has been received, AM25 will process and respond to the request within the timeframes and under the conditions established by applicable law. When a request cannot be fulfilled in whole or in part, AM25 will communicate the corresponding reasons and, where appropriate, the available mechanisms for continuing the process.

The data subject may, if they wish, use the forms made available by ACE for the exercise of personal data protection rights.

Security Incidents

AM25 will document and address incidents that may compromise personal data under its responsibility or management. When an incident affects information processed on behalf of a client, AM25 will communicate the situation to the relevant client where applicable and take the necessary measures to contain its effects and recover the available information. Communications to data subjects or authorities will be made in accordance with applicable law.

Policy Updates

AM25 may update this Policy when there are changes to applicable law, its systems, providers, security measures, or data processing activities. The version is identified in this document and its effective date is displayed in the corresponding field on the page.

AM25 will retain a record of previous versions and, when a version is incorporated into an engagement, evidence of the corresponding text. Material changes will be communicated through the channels of the product or contractual relationship and in accordance with applicable requirements. Publishing a new version does not replace any applicable notification, acceptance, or contractual amendment procedures.