Personal Data Processing Policy

This document formalizes the personal data processing policy for clients, job candidates, collaborators, suppliers, and other third parties who interact with VERTEX S.A.S. ("Vertex"), whether through our website, contact forms, recruitment processes, or any other channel.

VERTEX S.A.S. is a private company legally established in Colombia, with offices in Bogotá and Cartagena, contact email gerenciavertexsas@gmail.com, and phone lines +57 300 865 8910 and +57 312 491 6281.

This policy applies to all of Vertex's databases — including the contact form, the job application form, and general website browsing — and to the personal data contained in them for which VERTEX S.A.S. is responsible, within the framework of Law 1581 of 2012 and the regulations that amend, add to, or implement it.

For the purposes of this policy, the following terms — taken from Law 1581 of 2012 and Decree 1377 of 2013 — have the meanings indicated below:

Authorization

The data subject's prior, express, and informed consent to carry out the processing of personal data.

Database

An organized set of personal data that is subject to processing.

Personal data

Any information linked to, or that can be associated with, one or more identified or identifiable natural persons.

Sensitive data

Data that affects the data subject's privacy or whose misuse may lead to discrimination, such as racial or ethnic origin, political affiliation, religious or philosophical beliefs, membership in unions or social organizations, and health, sex life, or biometric data.

Data processor

A natural or legal person who, alone or jointly with others, processes personal data on behalf of the data controller.

Data controller

A natural or legal person who, alone or jointly with others, decides on the database and/or the processing of the data. In this policy, VERTEX S.A.S.

Data subject

The natural person whose personal data is being processed.

Processing

Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

Transfer and transmission

A transfer occurs when the controller sends the data to another controller inside or outside the country. A transmission occurs when the processing is carried out by a processor on behalf of the controller, inside or outside Colombia.

The personal data that Vertex collects, stores, and processes is used in accordance with the Constitution, Law 1581 of 2012, and this policy, whether the data subject provides it directly by verbal, physical, or online means, or Vertex collects it through lawful means such as public databases.

Sensitive data and data of minors: in the normal course of its operations, Vertex does not process the data of children or adolescents. If doing so is ever unavoidable, it will have the authorization of their legal representatives.

Information received from third parties: when Vertex receives personal information from third parties, its use is limited to the purposes authorized by the data subjects and Vertex's own activity as data controller. Vertex maintains agreements with these third parties establishing their data-protection obligations.

For each data collection, Vertex will inform the data subject of the specific purpose before requesting their authorization. In general, the purposes of processing include:

• Managing commercial or institutional inquiries, preparing proposals, and responding to the interested person or entity.
• Inviting contacts to Vertex's own events or third-party events considered of interest to them.
• Handling requests, complaints, and claims submitted by clients, candidates, and other third parties.
• Responding to requirements from authorities in the exercise of their functions.
• Evaluating a candidate's fit for a specific role, managing the selection process, and communicating its outcome. Data from one process is not reused for future openings without new authorization, unless the data subject expressly authorizes inclusion in a talent pool.
• Sharing information with contracted third parties who provide services to Vertex to support the efficient development of its work.
• Transferring information to third parties expressly authorized by the data subject.
• Conducting statistical and historical analysis based on the data processed; in such cases, results may be shared with third parties without identifiable personal information, unless authorized by the data subject.
• Contacting data subjects by email, social media, physical mail, instant messaging, or phone for the purposes set out in this policy.

Without prejudice to the other provisions of Law 1581 of 2012, Vertex complies with the following obligations:

• Guaranteeing, at all times, the data subject's full exercise of the right of habeas data.
• Requesting and retaining, when necessary, a copy of the authorization granted by the data subject.
• Duly informing the data subject about the purpose of the collection and the rights available to them.
• Keeping the information under security conditions that prevent its alteration, loss, or unauthorized access.
• Ensuring that the information is truthful, complete, accurate, up to date, verifiable, and understandable.
• Correcting the information when it is inaccurate.
• Processing inquiries and claims submitted by data subjects within the timeframes set by law.
• Adopting internal procedures to ensure compliance with the law, particularly in handling inquiries and claims.
• Notifying the data protection authority of security breaches that put data subjects' information at risk.
• Complying with the instructions and requirements of the Superintendence of Industry and Commerce (SIC).

Every data subject whose personal data is processed by Vertex has the right to:

• Know, update, and correct their personal data held by Vertex, including partial, inaccurate, incomplete, or unauthorized data.
• Request proof of the authorization granted to Vertex, except where the law exempts this requirement.
• Be informed, upon request, about how Vertex has used their personal data.
• File complaints with the Superintendence of Industry and Commerce for violations of data protection regulations.
• Revoke authorization and/or request deletion of data when legal and constitutional principles, rights, and guarantees are not respected.
• Access, free of charge, their personal data that has been processed.

When required, the collection, storage, use, circulation, or deletion of personal data by Vertex is carried out with the data subject's prior, free, express, and informed consent.

Ways to grant authorization: authorization may be given through a physical or electronic document, a data message, a voice recording, or any suitable technical or technological mechanism that allows the data subject's consent to be verified — including the consent checkboxes on our website forms.

Proof of authorization: Vertex keeps records or suitable technical mechanisms to demonstrate the authorization granted by data subjects.

In the course of its activities, Vertex may capture photographic images and audio or video recordings, either directly or through contracted providers.

This material is used to (i) document the activities carried out, (ii) publish it in informational campaigns across different media, and (iii) include it in printed, digital, or electronic audiovisual material, as well as on Vertex's website and social media. Vertex carefully reviews this material before publishing it, to avoid infringing on the dignity, privacy, or reputation of the people who appear in it.

Those who authorize the use of their image or voice acknowledge that they are not entitled to financial, commercial, or other compensation, and that such use does not transfer any intellectual property rights over the material.

Responsible area: Vertex's management team handles all requests, inquiries, complaints, and claims from data subjects related to their rights to know, update, correct, and delete their personal data.

Inquiries: handled within a maximum of ten (10) business days from receipt. If this deadline cannot be met, the requester will be informed of the reason for the delay and the new response date, which may not exceed an additional five (5) business days.

Claims: when a data subject believes their information should be corrected, updated, or deleted, or suspects a possible breach of the law, they may file a claim identifying themselves, describing the facts, and attaching any supporting documents. If the claim is incomplete, the requester will be asked to correct it within five (5) days; if two (2) months pass without a response, the claim will be considered withdrawn.

Once a complete claim is received, the database will be flagged "claim in process" within the following two (2) business days, and this flag will remain until the claim is resolved. The maximum time to resolve a claim is fifteen (15) business days, extendable by up to eight (8) additional business days if the requester is informed in a timely manner.

Channel to exercise these rights: data subjects may send their requests, inquiries, or claims to gerenciavertexsas@gmail.com.

Vertex implements reasonable technical, human, and administrative measures to protect personal data against unauthorized access, loss, alteration, or misuse, in accordance with the sensitivity of the information processed.

In addition to the processing described in the previous sections, the Vertex website uses first-party cookies and, only with your authorization, third-party analytics and advertising technologies. The full detail of each cookie, its purpose, provider, and approximate retention period is published in our Cookie Policy.

Before you grant your authorization, only the cookies strictly necessary for the site to function are active, along with Vercel Web Analytics, a cookieless and anonymized analytics technology that does not identify individual people.

If you grant your authorization for the Analytics category, the site activates Google Analytics 4 and Microsoft Clarity to understand site usage, along with a first-party cookie (vertex_attribution) to identify, on an aggregate basis, which acquisition channel led to a commercial inquiry. If you grant your authorization for the Marketing category, the site activates the LinkedIn Insight Tag, Google Ads, and Meta Pixel to measure and improve our advertising. None of these technologies is activated before your authorization.

The content of our contact form (name, email, phone, message) and of job applications (résumé, candidate details) is never sent to Google Analytics, Microsoft Clarity, LinkedIn, Google Ads, or Meta Pixel. These tools only receive generic events (for example, "the contact form was submitted") without the field contents. Additionally, job applicant information is never used to build advertising audiences or shared with LinkedIn, Google Ads, or Meta.

You can change or withdraw your Analytics and Marketing authorization at any time from the "Cookie preferences" link available in the site footer. Withdrawing a category deletes the corresponding first-party cookies and stops sending new events to those tools.

This policy is governed by Law 1581 of 2012, Decree 1377 of 2013, and any other regulations that amend, add to, or implement them.

This policy takes effect in September 2026. Personal data processed by Vertex will remain in its databases until the purpose for which it was collected has been fulfilled. Vertex reserves the right to review or modify this policy at any time and will publish any changes on this website; substantial changes will be communicated to data subjects, indicating the date from which the new version takes effect.