1. Objective

To inform all employees, customers, providers, shareholders, and all stakeholders involved in the business development about the data processing and cookie management policies, guaranteeing their right to know, update, and rectify information collected about them that resides in the Databases or files of LANGUAGE EXCHANGE SAS, hereinafter GRINGO TUESDAYS, in compliance with the constitutional rights, freedoms, and guarantees referred to in Articles 15 and 20 of the Political Constitution of 1991, Law 1581 of 2012, Regulatory Decree 1377 of 2013, and Decree 1074 of 2015.

2. Scope This policy applies to shareholders, customers, board members, candidates in selection processes, workers, officials of national and foreign subsidiaries, commercial partners, contractors, children of workers and/or officials, providers of goods and services, and third parties in general who have a direct or indirect relationship with GRINGO TUESDAYS.

It applies to all databases, websites, and personal information files held by GRINGO TUESDAYS within the contextual framework of Law 1581 of 2012, Decree 1373 of 2013, Decree 1081 of 2015, and other norms that modify or regulate them.

3. Definitions

• Authorization: The prior, express, and informed consent of the Data Subject to carry out the processing of personal data.

• Personal Database: An organized set of personal data subject to processing, easily accessible, managed, and updated with prior authorization from the data subject.

• Personal Data: Information that identifies us or can make us identifiable, such as name, citizenship ID (cédula), address, email, phone number, marital status, image, and biometric data.

• Customers: Natural or legal persons, public or private, with whom the entity has a commercial relationship.

• Private Data: Data that, due to its intimate or reserved nature, is only relevant to the owner.

• Public Data: Data that is not semi-private, private, or sensitive. Public data includes data regarding marital status, profession or trade, and status as a merchant or public servant.

• Semi-private Data: Data that does not have an intimate, reserved, or public nature, and whose knowledge may interest the owner as well as a certain sector or society in general (e.g., financial or credit data).

• Sensitive Data: Information affecting the privacy of the owner, whose improper use may lead to discrimination (e.g., political convictions, religion, health, sexual life, biometrics).

• Data Processor: Natural or legal person who performs the processing of personal data on behalf of the Data Controller.

• Privacy Officer: The high-level professional responsible for developing policies for personal data protection and implementing best practices.

• Data Subject (Titular): Natural or legal person whose personal data is subject to processing.

• Data Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

• Data Controller (Responsable): Natural or legal person who decides on the database and/or the processing of the data.

• Claim: Request by the Data Subject to correct, update, or delete data, or revoke authorization.

• Transfer: Sending data to a recipient (Data Controller) located inside or outside Colombia.

• Transmission: Communication of data within or outside Colombia for processing by a Processor on behalf of the Controller.

4. Principles Applicable to the Processing of Personal Data GRINGO TUESDAYS will apply the following principles: Legality, Purpose, Freedom, Veracity/Quality, Transparency, Restricted Access and Circulation, Security, and Confidentiality.

5. Processing of Personal Information GRINGO TUESDAYS, as Data Controller, collects, stores, uses, circulates, transmits, transfers, updates, rectifies, and deletes personal data (including sensitive data) of workers, customers, providers, and shareholders.

5.1. Data Processing Limits: Processing requires express authorization unless exempted by law, or if necessary to protect the vital interest of a physically/legally incapacitated subject.

5.2. Processing of Data of Children and Adolescents: Prohibited unless the data is of a public nature and respects the best interests of the minor. Express authorization from parents or legal representatives is required. If a minor provides data without authorization, the company has 5 business days to contact the guardian before deleting the information.

6. Purposes of Data Processing

• General: Processing and administration of users, offering new products/benefits, handling complaints, sending commercial communications/newsletters, statistical purposes, and security/protection within facilities.

• Specific: For shareholders (control/analysis), employees (training/payroll), contractors (formalization of contracts), and customers (marketing/relationship management).

7. Rights of the Data Subject Data subjects have the right to: Know, update, and rectify data; request proof of authorization; be informed of data use; file complaints with the Superintendency of Industry and Commerce (SIC); revoke authorization; and access their data free of charge.

8. Refusal to Access, Rectify, or Cancel Data GRINGO TUESDAYS may deny access or rectification if the applicant is not the owner or representative, if third-party rights are injured, if there is a legal impediment, or if the data subject is not in the database.

9. Authorization of the Data Subject Authorization is required except for: a. Information required by public/administrative entities or court orders. b. Data of a public nature. c. Medical emergencies. d. Historical, statistical, or scientific purposes authorized by law. e. Data related to the Civil Registry.

10. Obligations The document details obligations for GRINGO TUESDAYS and Data Processors, including ensuring the effective exercise of habeas data, maintaining security measures, updating information within 15 business days of receipt, and handling claims.

11. Handling Requests, Inquiries, and Claims

• Competent Areas: Customer Service (for complaints/claims) and Legal Office (for petitions).

• Procedure: via email at admongringotuesdays@gmail.com or phone at +57 320 4629202.

• Response Time: 10 business days (extendable by 5 more).

12. Security of Personal Data GRINGO TUESDAYS will implement administrative and technological measures but does not guarantee total security against technical failures or unauthorized third-party entry.

13. Transfer and Transmission of Personal Data Data may be delivered to third-party contractors under strict contractual clauses regarding confidentiality, purpose, and security measures.

14. Privacy and Data Processing Officer The Officer oversees policy implementation, reports to the SIC, maintains the database inventory, and ensures employee training on data protection.

15. Current Regulations This policy is effective as of June 22, 2017, governed by Law 1581 of 2012 and Decree 1377 of 2013.

16. Express Authorization for Cookie Use GRINGO TUESDAYS uses first and third-party cookies.

• Types: Technical, Personalization, Analysis, Advertising, and Behavioral Advertising.

• Third-party services: Meta Ads, Google Ads, Google Analytics, and Wix.

• Acceptance: By clicking [Accept and Continue] or continuing to browse, the user consents to cookie use.

• Disabling: Users may delete/deactivate cookies via browser settings (Firefox, Chrome, Edge, Safari).

17. Termination Comments and suggestions can be sent to:

• Website: http://gringotuesdays.co

• Email: admongringotuesdays@gmail.com

• Phone: +57 320 4629202

• Facilities: Ac. 85 #11-53, Chapinero, Bogotá.