Personal Data Protection Policy

DALITICA GROUP S.A.S.

DALITICA GROUP S.A.S., identified with Tax ID (NIT) 901.765.954-2, incorporated under the laws of the Republic of Colombia, with registered office in Bogotá D.C., (hereinafter "DALITICA") has prepared this Data Treatment Policy based on the guidelines established in Colombia's General Framework for Personal Data Protection: Law 1581 of 2012, Decrees 1377 of 2013 and 886 of 2014 (now incorporated in Single Decree 1074 of 2015), External Circular No. 002 of 2024, among others.

The purpose is to define any operation on personal data, such as the collection, storage, use, circulation or deletion of information linked or that may be linked to one or more identified or identifiable natural persons.

1. OBJECTIVE

This Personal Data Treatment Policy aims to inform all natural persons with whom the company has any relationship about the purposes and use that the company will give to their personal information, as well as to define both the rules for the treatment of personal data and the guidelines under which the data subject may exercise their rights.

2. SCOPE

This Policy applies to all databases and personal data contained therein where DALITICA acts as data controller and, in some cases, as processor for clients. It establishes criteria, mechanisms for exercising rights, principles, purposes and security measures.

3. DEFINITIONS

Term Definition
AlliesThird parties with whom DALITICA enters into agreements to combine efforts and resources for the development of its corporate purpose.
AuthorizationPrior, express and informed consent of the data subject for data treatment.
Privacy NoticeVerbal or written communication informing the data subject about the existence of the Policy and its purposes.
DatabasesOrganized set of personal data subject to treatment.
Contractors/SuppliersLegal or natural persons with whom DALITICA enters into agreements for the development of its purpose and compliance with obligations.
Personal DataData linked to a natural person that allows their identification (exclusive and proper).
Public Personal DataData that is not semi-private, private or sensitive (e.g. public records, gazettes, court rulings).
Semi-private Personal DataData that is not intimate or public, whose knowledge is of interest to the data subject and a certain sector (e.g. financial/credit data).
Data ProcessorPerson who carries out data treatment on behalf of the Controller.
Data ControllerPerson who decides on the database and/or the treatment.
Data SubjectNatural person whose personal data are subject to treatment.
TreatmentOperation on personal data (collection, storage, use, circulation or deletion).

4. GUIDING PRINCIPLES

  • a. Restricted access and circulation: Subject to the limits of the nature of the data and the law.
  • b. Confidentiality: Guarantee of confidentiality of information, even after the relationship has ended.
  • c. Purpose: Treatment must comply with a legitimate purpose informed to the data subject.
  • d. Legality: Regulated activity in accordance with the law.
  • e. Freedom: May only be exercised with prior, express and informed consent.
  • f. Proportionality: Collection limited to data that is relevant and adequate for the purpose.
  • g. Security: Handling with technical, human and administrative measures to prevent alteration, loss or unauthorized access.
  • h. Temporality: Retention for a reasonable and necessary time to fulfill purposes.
  • i. Truthfulness or Quality: Data that is truthful, complete, accurate, up-to-date and understandable.

5. PERSONAL DATA TREATMENT

  • Collection: Through physical, digital or electronic means, incorporating privacy notice and authorization.
  • Storage: On own servers with physical, technical and administrative security measures.
  • Use: Execution of operations to develop the corporate purpose, portfolio management, embedded marketing and handling of requests.
  • Circulation: Transfer to other entities for compliance with contractual obligations or pre-contractual measures.
  • Deletion: Carried out when not legally/contractually necessary, when it does not affect the integrity of the database, when the purpose has been fulfilled, or when requested by the data subject.

6. PURPOSES OF TREATMENT

A. Regarding Clients (DALITICA as Controller)

  • Account registration on FIBEK platform.
  • Communication and marketing (news and offers subject to prior authorization).
  • Contractual management, billing, collection and technical support.
  • Predictive Analysis with AI: Process financial information for AI models aimed at optimizing collection.
  • Data analytics: Study of habits, accounting activities and transfer with Allies.
  • Promotion of complementary financial services (embedded financing).

B. Regarding Clients' Debtors (DALITICA as Processor)

  • Automated collection management (sending collection notices by email, SMS, WhatsApp).
  • Registration and follow-up of payment agreements.
  • Risk analysis, prediction of defaults and recommendation of strategies.
  • Embedded Financing: Profiling of debtors for financial offers that facilitate payment or refinancing.
  • Credit recommendation based on payment behavior.
  • Transfer of data to financial allies to enable financing products.

C. Regarding Financial Allies (DALITICA as Processor)

  • Sharing debtor data (name, ID, payment capacity) for credit assessment.
  • Coordination of financial services, disbursements and automatic payments.
  • Monitoring of operational risks in the transmission of information.
  • Compliance with commercial agreements and audits.

D. With Contractors or Suppliers

  • Administrative procedures, billing, collection and payment.
  • Management of commercial relationships and compliance with accounting duties.
  • Prevention of money laundering and terrorist financing.

7. RIGHTS OF DATA SUBJECTS

The data subject has the right to access, know, update, rectify and delete their data, as well as to revoke authorization. They may also file complaints with the Superintendence of Industry and Commerce.

8. REQUESTS, COMPLAINTS AND CLAIMS (PQR)

Contact Channels:

Channel Detail
AddressTr 59 B No. 128-82
Emaildaliticabi@gmail.com
Webwww.fibek.co
WhatsApp3178794076
  • Requests: Requests for information or service. Response within 15 business days (general) or 10 days (documents).
  • Content: Identification of the data subject, facts, clear request and contact details.
  • Maximum response time: 15 business days, extendable in special cases.

9. TRANSFER AND TRANSMISSION

DALITICA may transfer or transmit data to third parties, allies or suppliers (national or international) in compliance with security standards and with authorization or transmission contract.

10. EFFECTIVE DATE

This policy enters into force as of February 1, 2026.

To request deletion of your personal data: Contact us via the channels above or visit Data Deletion (Spanish).

Important: This Personal Data Treatment Policy is based on current Colombian regulations and may be modified by DALITICA at any time, with changes communicated to data subjects.