Privacy and Personal Data Processing Policy

This policy applies to all databases and files containing personal data under Pakal's responsibility, and includes information of clients, prospects who contact us through the website or our messaging channels, suppliers, collaborators and third parties with a direct or indirect relationship with the company.

Data controller: PAKAL ORIGINS S.A.S. — NIT 902082046-1.

Contact channels: info@pakalagency.com, WhatsApp and phone +57 323 9218461, and the contact form available on this website.

For the purposes of this policy, the definitions of Law 1581 of 2012 are adopted:

• –Authorization: the data subject's prior, express and informed consent to the processing of their personal data.
• –Database: an organized set of personal data subject to processing.
• –Personal data: any information linked to or that can be associated with one or several determined or determinable natural persons, such as name, phone, email address or the data included in a message.
• –Sensitive data: data that affects the data subject's privacy or whose misuse may lead to discrimination, such as data on health, sexual life, ethnic origin, political, religious or philosophical convictions, or biometric data.
• –Data subject: the natural person whose personal data is subject to processing.
• –Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
• –Data controller: the party that decides on the database and its processing; in this case, Pakal.
• –Data processor: the party that carries out the processing of data on behalf of the controller.
• –Inquiry: a request by the data subject to know the information residing in our databases.
• –Claim: a request by the data subject to correct, update or delete their data, or to revoke the authorization granted.
• –Transfer: the sending of personal data to a recipient that is, in turn, a data controller.
• –Transmission: the communication of personal data so that a processor treats it on behalf of the controller.

In the processing of personal data, Pakal applies the following principles:

• –Legality: processing is carried out in accordance with current regulations.
• –Purpose: data is processed for legitimate purposes, informed to the data subject beforehand.
• –Freedom: data is only collected and processed with the data subject's prior, express and informed authorization, unless required by legal or judicial mandate.
• –Truthfulness or quality: the information must be truthful, complete, accurate, up to date and verifiable.
• –Transparency: the data subject may obtain, at any time, information about the data concerning them.
• –Restricted access and circulation: data is only processed by authorized persons or those provided for by law.
• –Security: we adopt technical, human and administrative measures to protect the information.
• –Confidentiality: those who take part in the processing are obligated to maintain confidentiality of the information, even after the relationship that gave rise to the collection has ended.

Pakal collects only the data that the data subject provides voluntarily when contacting us: name, phone or WhatsApp number, email address when the data subject chooses to share it, and the information included in their message about their brand, company or project. Additionally, we may collect technical browsing information in an aggregated and anonymous form for statistical purposes.

Pakal does not request sensitive data through this website. Should a data subject provide it voluntarily, they are reminded that they are not obligated to do so and that its processing requires express authorization.

This website and Pakal's services are directed at companies and at persons of legal age. We do not knowingly collect personal data of minors. Should we identify that data of a minor has been received without the authorization of their parents or legal representatives, we will proceed to delete it from our databases.

The personal data collected by Pakal is processed for the following purposes:

• –a. To attend and respond to requests, inquiries and quotes.
• –b. To maintain communication during the commercial and negotiation process.
• –c. To provide, execute and follow up on the contracted services.
• –d. To send information about our services, news or content, when the data subject has authorized it.
• –e. To produce internal statistics and aggregated analyses to improve our services and this website.
• –f. To comply with legal, accounting, tax and contractual obligations.
• –g. To attend to requirements of competent authorities.

Pakal does not sell, rent or trade personal data with third parties.

The processing of personal data requires the data subject's prior, express and informed authorization, which is obtained at the moment they decide to contact us through the website form or our messaging channels, accepting this policy. Authorization will not be required in the cases exempted by law, among them: information required by a public or administrative entity in the exercise of its legal functions or by court order; data of a public nature; cases of medical or health emergency; processing authorized by law for historical, statistical or scientific purposes; and data related to the Civil Registry of persons.

In accordance with Law 1581 of 2012, the data subject has the right to:

• –a. Know, update and rectify their personal data.
• –b. Request proof of the authorization granted, except in the cases exempted by law.
• –c. Be informed about the use given to their personal data.
• –d. File complaints with the Superintendency of Industry and Commerce for violations of the regulations.
• –e. Revoke the authorization and request the deletion of their data, where applicable under the law.
• –f. Access, free of charge, their personal data subject to processing.

11.1. Channels. The data subject may exercise their rights through:

• –Email: info@pakalagency.com (main channel for personal data requests).
• –WhatsApp or phone: +57 323 9218461.
• –The contact form available on this website.

11.2. Content of the request. The request must state the data subject's name, the right they wish to exercise, a description of the facts giving rise to the request and a channel to receive a response.

11.3. Response terms. Inquiries will be handled within a maximum term of ten (10) business days from their receipt. When it is not possible to handle them within that term, the interested party will be informed of the reason for the delay and the date on which it will be addressed, which in no case will exceed the five (5) business days following the expiration of the first term.

Claims will be handled within a maximum term of fifteen (15) business days from the day following their receipt. When it is not possible to handle them within that term, the interested party will be informed of the reason for the delay and the date on which it will be addressed, which in no case will exceed the eight (8) business days following the expiration of the first term.

Pakal may deny access to, rectification or deletion of personal data when the requester is not the data subject or their duly accredited representative, when the rights of third parties would be harmed, when the rectification has already been carried out, when there is no data of the requester in our databases, or when there is a legal impediment or a decision of a competent authority. Pursuant to article 9 of Decree 1377 of 2013, deletion of data does not proceed when the data subject has a legal or contractual duty to remain in the database.

In its capacity as data controller, Pakal undertakes to:

• –a. Guarantee the data subject the full and effective exercise of the right to habeas data.
• –b. Request and keep a copy of the authorization granted by the data subject.
• –c. Inform the data subject of the purpose of the collection and the rights they hold.
• –d. Keep the information under security conditions that prevent its alteration, loss, consultation, use or unauthorized access.
• –e. Update and rectify the information where applicable.
• –f. Process inquiries and claims within the legal terms.
• –g. Inform the competent authority when breaches of security codes occur.
• –h. Comply with the instructions and requirements of the Superintendency of Industry and Commerce.

To operate, Pakal uses third-party services that may process personal data on its behalf, such as web hosting providers, messaging services, management tools and digital advertising platforms. These act as data processors and are obligated to protect the information and to process it solely in accordance with the authorized purposes.

Some of these providers may be located outside Colombia. In such cases, the international transfer or transmission of data will be carried out observing the safeguards and conditions provided for in Law 1581 of 2012 and its implementing decrees.

Pakal adopts reasonable administrative, technical and human measures to protect personal data and prevent its alteration, loss, consultation, use or unauthorized or fraudulent access. However, it is not possible to guarantee the absolute security of information transmitted over the internet, so Pakal will not be liable for technical failures or improper access by third parties beyond its reasonable control.

Personal data will be kept for as long as an active commercial relationship exists or as long as it is necessary for the purposes described, and thereafter for the periods required by applicable legal, accounting and tax obligations.

17.1. What they are. Cookies are small text files stored in the user's browser when they visit a website, which allow the site to remember their visit, improve its functioning and understand, in an aggregated way, how it is browsed.

17.2. Types of cookies this site may use:

• –Technical: necessary for the operation of the site and the provision of the service.
• –Personalization: allow the site to remember preferences such as language.
• –Analytics: allow the aggregated measurement and analysis of the site's use in order to improve it.
• –Third-party: external services that may collect information for statistical or advertising-measurement purposes.

17.3. Regulations. In Colombia there is no specific regulation on cookies. This policy is developed as good corporate practice, observing the principles of purpose, freedom, transparency and truthfulness set out in Law 1581 of 2012 and Decree 1377 of 2013.

17.4. Management and deactivation. The user may configure their browser to accept, reject or delete cookies. By continuing to browse this site without disabling them, consent to their use is understood to be given. Disabling certain cookies may affect the operation of the site.

17.5. Detail and consent management. The detail of the cookies, the categories (necessary, analytics and advertising) and the management of your consent are described in our Cookie Policy. You can change your decision at any time from the «Cookie settings» link in the footer.

This policy is effective as of July 18, 2026 and will remain in force for as long as Pakal carries out its corporate purpose. Pakal may modify it at any time; the current version will be the one published on this page, indicating its update date. Databases will be kept for the time required to fulfill the purposes described and the applicable legal obligations.