Personal Data Processing and Protection Policy

1. Who we are and in what capacity we process your data

FastOfi Corp S.A.S., a commercial company identified with NIT 901.031.306-1, domiciled at Calle 4G 81A-105 INT 1807, Medellín, Antioquia, Colombia, email [email protected], telephone ___, is the controller of the personal data described in this policy.

FastOfi develops and operates a management platform (ERP) for regulated manufacturing and pharmaceutical services companies. This dual nature —a company with its own customers, and a platform where those customers upload third-party data— means that we process personal data in two different capacities, explained in section 3.

2. Scope and definitions

This policy applies to all personal data processed by FastOfi, whether through the fastofi.com website, the platform, our sales and support channels, or our internal processes.

We use the definitions in article 3 of Ley 1581 de 2012:

• Data subject: the natural person whose personal data is processed.
• Personal data: any information linked or that can be associated with one or more identified or identifiable natural persons.
• Sensitive data: data that affects the data subject’s privacy or whose misuse may lead to discrimination; among others, data relating to health, sex life and biometric data.
• Controller: the party that makes decisions about the database and its processing.
• Processor: the party that processes personal data on behalf of the controller.
• Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
• Authorization: the data subject’s prior, express and informed consent to carry out the processing.
• Privacy notice: a communication made available to the data subject to inform them of the processing, its purposes and how to access this policy.

3. Our two roles: controller and processor

This distinction is the most important part of this document and determines whom you should contact to exercise your rights.

3.1. FastOfi as controller

We are the controller of the data we collect on our own behalf and for our own purposes: website visitors, people who request a demo, sales contacts, contact persons at our customers and suppliers, job applicants and our own team.

3.2. FastOfi as processor

When a customer subscribes to the platform and uploads information to it —employees, supplier contacts and, in the pharmaceutical services module, patient data— the controller of that data is the customer, not FastOfi. We act as processor: we process the data solely in accordance with the customer’s instructions and to provide the contracted service.

In that capacity:

• We do not use a customer’s information for our own purposes, nor do we assign or sell it.
• We do not cross-reference or mix information between different customers. Each instance is isolated.
• We do not use a customer’s data to train general-purpose artificial intelligence models or to improve the product in a way that makes it identifiable or retrievable by third parties.
• We apply the security measures described in section 12 and notify the customer of any incident.
• We return or delete the information when the contract ends, under the terms agreed therein.

The conditions of this role are formalized in a data processing agreement attached to the service contract.

If you are a patient, employee or supplier of a company that uses FastOfi and you wish to access, update or delete your data, you must contact that company, which is the controller. If you write to us directly, we will guide you and inform our customer, but we cannot modify or disclose information from its instance without its instruction.

4. Principles we apply

All processing we carry out is subject to the principles set out in article 4 of Ley 1581 de 2012:

• Legality: processing is a regulated activity.
• Purpose: processing serves a legitimate purpose that we disclose to the data subject.
• Freedom: we only process data with prior, express and informed consent, or under a legal or judicial mandate.
• Accuracy or quality: information must be truthful, complete, accurate, up to date, verifiable and understandable.
• Transparency: we guarantee the data subject’s right to obtain information about their data.
• Restricted access and circulation: data is only accessible to authorized persons.
• Security: we adopt technical, human and administrative measures to prevent tampering, loss, or unauthorized consultation or access.
• Confidentiality: everyone involved in the processing is bound to keep it confidential, even after their relationship with us ends.

5. What data we process and why

As controller, we process the following categories. We only collect what we need for each purpose.

We do not make automated decisions that produce legal effects on data subjects. The platform’s artificial intelligence features generate suggestions and drafts; the decision and the signature always belong to a person.

6. Sensitive data and data of minors

As controller, we do not collect sensitive data. We do not request it on the website, in the demo form or through our sales channels.

As processor, the platform may store health-related data when a customer operates the pharmaceutical services module. In that case:

• The customer is responsible for obtaining the patient’s express authorization.
• No one is required to authorize the processing of sensitive data, or to disclose sensitive data or data of minors.
• We apply role-based access control, encryption and audit trails to that information, and access by our support staff is logged and limited to what is strictly necessary to handle a customer request.

The processing of data of children and adolescents is prohibited except for the legal exceptions; when it occurs, it must serve their best interests and ensure respect for their fundamental rights.

7. How we obtain and evidence your authorization

We request your authorization in a prior, express and informed manner, through an unchecked box accompanied by a description of the purposes and a link to this policy. Optional purposes, such as sending commercial content, are requested separately: they are never bundled into the main authorization.

We keep evidence of each authorization: date and time, channel, IP address and the version of this policy in force at that moment. You may request a copy of that record from us.

You may revoke your authorization at any time by writing to [email protected], except where a legal or contractual duty requires us to retain the information.

8. Your rights as a data subject

In accordance with article 8 of Ley 1581 de 2012, you have the right to:

• Access, update and rectify your personal data.
• Request evidence of the authorization you granted, except where the law does not require it.
• Be informed, upon request, of the use we have made of your data.
• File complaints with the Superintendencia de Industria y Comercio (SIC) for violations of the data protection regime, once the inquiry or claim process with us has been exhausted.
• Revoke the authorization and request the deletion of the data, where no legal or contractual duty prevents it.
• Access your personal data being processed free of charge.

9. How to exercise your rights and how quickly we respond

Channel: write to [email protected], or file your request in writing at Calle 4G 81A-105 INT 1807, Medellín, Antioquia, Colombia. Include your name, your identity document, a channel for our reply and a description of your request. If you are acting on behalf of another person, provide evidence of that capacity.

9.1. Inquiries

When you wish to know the information we hold about you, we respond within a maximum of ten (10) business days. If that is not possible, we will notify you before the deadline, explaining the reasons and the date on which we will address your inquiry, which will not exceed five (5) additional business days.

9.2. Claims

When you believe your data should be corrected, updated or deleted, or that we have breached any duty, we address the claim within a maximum of fifteen (15) business days counted from the day after its receipt. If that is not possible, we will inform you of the reasons and the new date, which will not exceed eight (8) additional business days. If the claim is incomplete, we will ask you to complete it within the following five (5) days; if you do not do so within two (2) months, the claim will be deemed withdrawn. If we are not the competent party, we will forward the claim to the appropriate party and inform you. While the claim is being processed, the data will be marked with the legend “claim in process”.

10. Who we share data with

We do not sell personal data. We share it only with providers that render services necessary for our operation, bound by confidentiality and data processing agreements:

• Cloud infrastructure and hosting: ___
• Transactional email and communications: ___
• Website analytics: ___
• Sales management and support: ___
• Artificial intelligence model providers for Sophia features: ___
• Accounting, tax and legal services.

We may also provide information to administrative or judicial authorities when there is a legitimate request made in the exercise of their functions.

11. International transfers and transmissions

Some of our providers are located outside Colombia, so your data may be stored or processed abroad. These operations are carried out under transmission agreements that impose on the recipient the same duties set out in this policy, or to countries declared by the Superintendencia de Industria y Comercio as having an adequate level of protection, or with your express and unequivocal authorization when required by law.

12. Security and incidents

We apply reasonable technical, human and administrative measures to protect information: encryption in transit and at rest, role-based access control, audit trails, environment separation, periodic backups with restore verification, vulnerability management and confidentiality agreements with all staff.

No system is infallible. In the event of an incident that compromises personal data, we report it to the Superintendencia de Industria y Comercio within fifteen (15) business days after we detect it, inform the affected customers and adopt the appropriate containment and corrective measures.

13. Term of the policy and of the databases

This policy is effective as of 2026-08-05. We retain personal data for as long as the purpose that justified its collection lasts and, thereafter, for the periods required by applicable accounting, tax, commercial and health regulations. Once those periods expire, we securely delete or anonymize it.

___ (Include here, if applicable, the certificate of registration in the SIC’s Registro Nacional de Bases de Datos. The registration obligation applies to companies with total assets exceeding 100,000 UVT; if FastOfi does not exceed that threshold, this policy remains mandatory but registration does not.)

14. Changes to this policy

We may update this policy. When a change substantially affects the purposes of the processing, we will notify you through the contact channel we have on record before applying it, and we will request a new authorization if required by law. The current version and its date always appear at the beginning of this document.

Version 2026-08-05 · FastOfi Corp S.A.S. · NIT 901.031.306-1