SEKOIA AGENTE DE VALORES S.A., with its address at Ruta 8 km 17.500, Zonamerica, Building M1, office H, Montevideo (the "Company", "we", "us" or "our") is responsible for the processing of the personal data of users of the Consultas Online application (the "App"), which is incorporated into its databases.

This Privacy Policy describes what data we collect, how we use it, with whom we share it, how we protect it and what rights the user has in relation to their personal information. Use of the App implies knowledge and acceptance of this Policy. We recommend that the user read this document carefully before using the App.

The user acknowledges that this Privacy Policy forms an integral part of the Terms and Conditions of Use of the App and must be read together with them.

Providing the data that the App or the account opening process identifies as mandatory is necessary for the provision of the services; failure to provide such data, or providing inaccurate data, may prevent access to the App or the provision of those services.

2.1 Data provided by the user

• Identity data: full name, type and number of identity document (national ID, tax ID, passport or equivalent depending on the region), date of birth, nationality.
• Contact data: email address, telephone number.
• Access credentials: password (stored in encrypted form; never in plain text).
• Biometric data: if the user voluntarily enables biometric authentication, biometric data (fingerprint, facial recognition) is processed exclusively by the device's operating system (iOS/Android) and is never transmitted to, stored by or accessed by the Company. Enabling this feature is optional and it may be disabled by the user at any time.
• Attached documents: transfer receipts or other documents that the user voluntarily uploads in the process of depositing money.

2.2 Data generated by use of the App

• Activity data: history of transactions, movements, fund subscriptions and redemptions, portfolio queries.
• Session data: date and time of login and logout, access history, devices used.
• Preferences: selected language, notification settings, display mode (light/dark).

2.3 Technical data collected automatically

• IP address.
• Operating system type and version.
• Device identifier (for authentication and security).
• App usage and performance data (error logs, performance metrics).
• Information on the source of funds and destination of investments (in accordance with anti-money laundering and countering financing of terrorism due diligence obligations).

Personal data is used for:

The Company may share the user's personal data with:

4.1 Financial and regulated entities

Data is shared with the stockbroker, financial agent or regulated entity corresponding to the user's region (Argentina, Uruguay, New Zealand) for the execution of transactions and compliance with regulatory obligations. Specifically, the Company may share data with related entities of the economic group, in accordance with the service outsourcing agreements duly communicated to the competent supervisory authorities. In particular, the App service is provided to the Company by Cucchiara y Cía. S.A., with its address at Sarmiento 470, 2nd floor, office 201, Autonomous City of Buenos Aires, Argentina, acting as data processor.

4.2 Technology service providers

We use external providers for cloud infrastructure services (Amazon Web Services - AWS), file storage, office and collaboration tools (Microsoft 365), sending of emails and push notifications (Firebase Cloud Messaging - FCM). These providers act as data processors and are subject to confidentiality and data protection agreements that ensure an adequate level of protection.

4.3 Competent authorities

Where required by applicable law, a court order or a legitimate request from a competent authority.

4.4 Software development companies

The development and maintenance of the App is carried out by specialised providers engaged within the economic group, who may have limited access to personal data exclusively for technical support and development purposes, under strict confidentiality obligations.

The Company does not sell, rent or trade its users' personal data with third parties for advertising purposes.

As the App operates in Argentina, Uruguay and New Zealand, users' data may be stored and processed on servers located outside the user's country of residence, including servers of Amazon Web Services (AWS) and Microsoft located in the United States and other regions. In such cases, the Company adopts the adequate safeguards in accordance with the regulations applicable in each jurisdiction, including the contractual data protection commitments assumed by the providers, adequacy decisions where they exist, or the user's express consent where applicable, which is given by accepting this Policy in the App.

Personal data is retained for as long as necessary to fulfil the purposes described in this Policy and the applicable legal obligations:

• Active account data: for the entire term of the contractual relationship.
• Financial transaction data: in accordance with the legal retention periods required by the financial regulations of each jurisdiction (generally between 5 and 10 years).
• Security and audit data (logs): up to 12 months.
• Data following a request for account deletion: the data necessary to comply with outstanding legal obligations will be retained until such obligations are extinguished.

The Company implements appropriate technical and organisational measures to protect users' personal data, including:

• Encryption of credentials in the database.
• Secure storage of session tokens using platform encryption mechanisms (Keychain on iOS, EncryptedSharedPreferences on Android).
• Encrypted communications via HTTPS/TLS.
• Role-based access control for internal staff.
• Security monitoring and alerts on the cloud infrastructure (AWS).
• Security incident response process.
• Periodic security assessments and system audits.
• Data minimisation policies and access based on the need-to-know principle.

However, no security system is completely infallible and the Company cannot guarantee the absolute security of the data. The user is responsible for maintaining the security of their access credentials and devices, and for immediately notifying the Company of any unauthorised use of their account or any other security breach.

In accordance with the applicable data protection regulations, the user has the right to:

• Access: request information about what personal data of theirs we process.
• Rectification: request the correction of inaccurate or incomplete data.
• Deletion: request the deletion of their personal data, where there is no legal obligation to retain it.
• Objection: object to the processing of their data in certain circumstances.
• Portability: receive their data in a structured and commonly used format.
• Restriction: request the restriction of processing in certain cases.
• Complaints: lodge a complaint or claim with the competent supervisory authority if they consider that their rights have been infringed.

To exercise any of these rights, the user may do so from the Profile section of the App, through the enabled support channels, or by sending a written communication to the contact address indicated in this Policy. The Company will respond within the time limits provided by the applicable regulations of each jurisdiction. Exercising these rights is free of charge, except for manifestly unfounded or excessive requests.

The App may send push notifications to the user's device to report events relating to their account and transactions. The user may manage their notification preferences from the settings section of the App or from the operating system settings of their device.

Notifications relating to the user's account and transactions are considered transactional communications and not marketing communications. For promotional or marketing communications, the user's prior and express consent will be required, which may be withdrawn at any time.

The App is not intended for persons under 18 years of age. The Company does not knowingly collect data from minors. If we detect that we have collected data from a minor without the consent of their legal guardian, we will delete it.

The Company may update this Privacy Policy periodically to reflect changes in data processing practices, legal requirements or improvements to the services. When an updated version is published, the user will be notified upon logging in to the App, with a clear indication of the changes made. In the case of substantial changes that significantly affect the user's rights or the processing of their data, the user's consent will be requested again before such changes are applied. Continued use of the App following notification of non-substantial changes implies acceptance of the updated Policy.

This Policy is governed by the data protection regulations in force in each jurisdiction:

• Argentina: Law No. 25,326 on the Protection of Personal Data and its Regulatory Decree 1558/2001. Supervisory authority: Agencia de Acceso a la Información Pública (AAIP).
• Uruguay: Law No. 18,331 on the Protection of Personal Data and Habeas Data Action. Supervisory authority: Unidad Reguladora y de Control de Datos Personales (URCDP).
• New Zealand: Privacy Act 2020. Supervisory authority: Office of the Privacy Commissioner (OPC).

For enquiries, requests to exercise rights or any matter relating to the processing of their personal data, the user may contact the Company through the support channels available in the App, on the Company's official website (www.sekoia.com.uy), or by email at: compliance@sekoia.com.uy. The Company will appoint a person responsible for handling enquiries and requests relating to the protection of personal data.