Personal Data Processing, Privacy and Information Governance Policy

Purpose

This Personal Data Processing, Privacy and Information Governance Policy (the "Policy") establishes the rules, principles, procedures and measures adopted by RAMBIT S.A.S., identified as the owner and operator of the DeportID technology platform (hereinafter "DeportID" or the "Platform"), to guarantee the appropriate, transparent, secure and responsible processing of personal data collected, stored, used, consulted, transmitted, transferred, updated, deleted and, in general, processed in connection with the provision of the services offered through the Platform.

This Policy develops the constitutional right to habeas data and seeks to guarantee respect for privacy, informational self-determination, the protection of personal information and the other fundamental rights of the data subjects, in accordance with the Political Constitution of Colombia, Law 1581 of 2012 (Colombian Personal Data Protection Law), Decree 1074 of 2015, Law 1266 of 2008 where applicable, Law 527 of 1999, Law 1098 of 2006 (Colombian Children and Adolescents Code), the instructions issued by the Superintendence of Industry and Commerce and the other rules that amend, complement or replace them.

RAMBIT S.A.S. recognizes that the protection of information constitutes one of the fundamental pillars of the DeportID Contractual Ecosystem and, therefore, adopts a privacy approach based on demonstrated accountability, minimization of processing, information security, transparency, enhanced protection of children and adolescents, and the continuous improvement of its processes.

Scope of Application

This Policy shall apply to all processing of personal data carried out by RAMBIT S.A.S. in connection with the development of the activities inherent to the DeportID Platform, regardless of the physical or digital medium through which the information is collected or processed. In particular, this Policy shall apply to the processing of information corresponding to visitors to the Platform, registered users, players, organizers of sporting events, coaches, referees, delegates, legal representatives, mothers, fathers, guardians and caretakers of minors, sponsors, strategic partners, suppliers, contractors, workers, candidates in selection processes and any other natural person whose personal data is processed by RAMBIT S.A.S. in the development of its corporate purpose.

The provisions contained in this Policy shall likewise apply to the processing carried out by data processors acting on behalf of RAMBIT S.A.S., within or outside Colombian territory, where applicable under the relevant legislation.

Data Controller

The Data Controller of the personal data regulated by this Policy is RAMBIT S.A.S., a commercial company incorporated under the laws of the Republic of Colombia, owner and operator of the DeportID platform. RAMBIT S.A.S. will act as Data Controller with respect to personal data whose purpose corresponds to the provision of the services offered through the Platform, the administration of the relationship with Users, compliance with legal and contractual obligations, the protection of the DeportID Ecosystem and the other purposes set forth in this Policy. Where certain processing activities are carried out by third parties acting as Data Processors, such processing shall be developed under the instructions given by RAMBIT S.A.S., without prejudice to the legal obligations specific to each Data Processor.

Integration with the DeportID Contractual Ecosystem

This Policy forms an integral part of the DeportID Contractual Ecosystem and shall be interpreted in harmony with the Platform's Terms and Conditions of Use, the General Code of Conduct, the Payments, Refunds, Chargebacks, Cancellations and Release of Funds Policy, the Organizer Adhesion Agreement and the other documents that regulate specific aspects of the Platform's operation. Matters relating to contractual rights and obligations, use of the Platform, intellectual property, administrative measures, digital security, payment processing, electronic communications, artificial intelligence, technological integrations and other aspects inherent to the legal relationship between Users and the Platform shall be governed primarily by the Terms and Conditions of Use, while this Policy shall exclusively develop the rules relating to the processing of personal data. In the event of apparent contradictions between this Policy and the other documents of the Contractual Ecosystem, the special provisions of the document that specifically regulates the matter under analysis shall prevail, always seeking a systematic and comprehensive interpretation.

Institutional Commitment to Privacy and the Protection of Children and Adolescents

RAMBIT S.A.S. recognizes that personal information constitutes an asset whose protection is essential to preserving the trust of Users and ensuring the proper functioning of the Platform. Accordingly, all activities related to the processing of personal data shall be carried out in accordance with a governance model based on the principles of legality, transparency, demonstrated accountability, privacy by design, privacy by default, minimization of processing, information security and respect for the fundamental rights of data subjects.

In particular, RAMBIT S.A.S. adopts a reinforced commitment to the protection of the personal data of children and adolescents who use the Platform or participate in activities managed through it. In furtherance of this commitment, every interpretation of this Policy shall favor the best interests of the child, the protection of their privacy, the reduction of risks associated with the digital environment, and the adoption of reasonable measures aimed at preventing the improper use of their personal information.

The processing of personal data of minors shall only take place where there is a legitimate purpose, where the prevailing rights of children and adolescents are respected, where the authorizations or legal bases required by applicable legislation are observed, and where reinforced security, confidentiality and access-control measures are implemented, seeking to limit the circulation of information to the minimum necessary for the fulfillment of the authorized purposes.

Personal Data Processing Governance Model

RAMBIT S.A.S. recognizes that the protection of personal data constitutes a permanent process of organizational management and, accordingly, adopts a governance model aimed at ensuring that all personal data processing activities are carried out in a planned, documented, verifiable manner and in accordance with the principles established in this Policy. The governance model comprises the definition of responsibilities, the adoption of internal procedures, the implementation of technical and administrative controls, the ongoing supervision of regulatory compliance, the management of risks associated with the processing of personal data, the continuous training of personnel, the periodic evaluation of the security measures implemented, and the permanent strengthening of the data-protection culture within the organization. All persons who take part in the processing of personal data on behalf of RAMBIT S.A.S. shall act in accordance with the principles of confidentiality, necessity, proportionality, minimization, demonstrated accountability and reinforced protection of the rights of data subjects.

Demonstrated Accountability

RAMBIT S.A.S. shall carry out the processing of personal data under the principle of demonstrated accountability, undertaking to implement reasonable mechanisms that make it possible to demonstrate compliance with applicable personal data protection legislation and effective observance of this Policy. To that end, the company may adopt, among others, measures related to the identification and assessment of risks, the periodic updating of this Policy, the implementation of access controls, the documentation of internal procedures, the management of security incidents, the evaluation of suppliers, personnel training, the management of authorizations, the handling of inquiries and complaints, the performance of internal audits, and any other action aimed at strengthening the privacy program.

The implementation of such mechanisms shall be dynamic and may be adjusted as the Platform, applicable legislation, the technology used, or the risks associated with the processing of personal data evolve.

Roles within the Privacy Ecosystem

In order to ensure proper governance of information, RAMBIT S.A.S. may interact with different actors that take part in the processing of personal data, each with clearly differentiated responsibilities under applicable legislation. The following, among others, may take part in the operation of the Platform:

• Data Controller. RAMBIT S.A.S., when it determines the purposes, means and conditions under which the processing of personal data related to the operation of the Platform and the provision of its services is carried out.
• Data Processors. Natural or legal persons who, on behalf of RAMBIT S.A.S., carry out activities related to the storage, processing, administration, support, maintenance, hosting, analysis, transmission, user assistance or any other operation necessary for the provision of the services.
• Technology Providers. Specialized companies that supply technological infrastructure, cloud services, authentication, artificial intelligence, storage, analytics, communications, information security, monitoring, backup, software development or other technological services required for the operation of the Platform.
• Payment Service Providers. Entities or specialized platforms that take part in payment processing, funds collection, transaction validation, prevention of financial fraud, release of funds or any other activity related to economic operations carried out through the Platform.
• Strategic Partners. Sports entities, clubs, leagues, federations, sponsors, universities, educational institutions, public or private entities and other organizations with which RAMBIT S.A.S. establishes collaborative relationships involving the joint development of activities compatible with the purposes authorized by the data subjects. The participation of any of these actors does not imply a transfer of the status of Data Controller, except where applicable legislation or the specific nature of the processing determines otherwise.

9. Processing Carried Out by Organizers of Sporting Events

The Platform allows certain Users, acting as Organizers, to manage tournaments, competitions, sports schools, clubs, academies, leagues, recreational events and other sporting activities through the technological tools offered by DeportID. In events where the Organizer autonomously determines the purposes and means of processing personal data related to the administration of their sporting activity, such Organizer shall act as an independent Data Controller with respect to the processing that corresponds to them under applicable legislation, without prejudice to the responsibilities assumed by RAMBIT S.A.S. as Data Controller with respect to the operation of the Platform.

Accordingly, each Organizer shall be responsible for ensuring the obtaining of the authorizations that are necessary, for attending to the exercise of data subjects' rights where legally applicable to them, for implementing reasonable security measures, and for complying with the obligations set forth by Colombian personal-data-protection legislation with respect to information whose administration directly depends on their management. The use of the Platform does not exempt Organizers from complying with their legal obligations as independent controllers where the nature of the processing so determines.

10. Privacy Culture and Continuous Improvement

The protection of personal data constitutes a permanent responsibility of RAMBIT S.A.S. and forms part of its corporate governance model. Accordingly, the company shall seek to continuously strengthen its internal processes through the periodic updating of its policies, risk review, the adoption of best practices, the implementation of technological controls, the training of persons involved in the processing of personal data, and the incorporation of continuous-improvement mechanisms that make it possible to strengthen the protection of information and respond promptly to the technological, regulatory and operational evolution of the Platform. The measures implemented shall be proportional to the level of risk associated with each processing activity, always seeking to guarantee a balance between technological innovation, the appropriate provision of services and the effective protection of the fundamental rights of data subjects.

11. Definitions

For purposes of this Policy, in addition to the definitions set forth in Colombian personal-data-protection legislation, the terms indicated below shall have the meaning assigned to them in this article, without prejudice to the definitions contained in the Platform's Terms and Conditions of Use, a document to which this Policy refers on a complementary basis.

• Authorization: A free, prior, express, informed and unequivocal manifestation of will through which the Data Subject permits the processing of their personal data, where such processing requires authorization under applicable legislation.
• Official Channels: All physical or digital means enabled by RAMBIT S.A.S. to interact with Users, including the website, the mobile application, email, the notification center, in-Platform messages, WhatsApp, SMS, support lines, support chat and any other means officially made available by DeportID.
• Personal data: Any information linked to, or that may be associated with, an identified or identifiable natural person.
• Sports Data: Information related to a person's participation in sporting activities, including teams, positions, categories, statistics, results, competitive history, sporting achievements, performance, rankings, sports licenses and other information generated during the use of the Platform.
• Browsing Data: Technical information generated during interaction with the Platform, including IP address, device type, browser used, operating system, device identifiers, session logs, connection times, approximate location obtained through the IP address, activity logs and other technical data related to access to the services.
• Sensitive Data: Data that affects the Data Subject's privacy or whose improper use may give rise to discrimination, under Colombian legislation.
• DeportID or Platform: The technology ecosystem managed by RAMBIT S.A.S. that enables the management of sporting events, organizations, clubs, schools, academies, competitions, teams, players, payments, statistics, communications and other services offered through digital tools.
• Data Processor: A natural or legal person who processes personal data on behalf of the Data Controller.
• Contractual Ecosystem: The set of legal documents that regulate the operation of the Platform, comprising the Terms and Conditions of Use, this Policy, the General Code of Conduct, the Refund Policy, the Organizer Adhesion Agreement, the Operations Manual and the other complementary documents issued by RAMBIT S.A.S.
• Geolocation: Information relating to a User's approximate or precise geographic location, where such functionality is used by the Platform and there exists a legal basis permitting its processing.
• Information Governance: The set of policies, procedures, controls and responsibilities through which RAMBIT S.A.S. administers the life cycle of the personal information processed by the Platform.
• Artificial Intelligence: Computer systems capable of assisting classification, automation, recommendation, analysis, risk-detection, content-generation processes or supporting the provision of the services offered by DeportID.
• Minor: A person who has not reached eighteen (18) years of age, including children and adolescents under Colombian legislation.
• Organizer: A natural or legal person who uses the Platform to create, administer or manage tournaments, competitions, sports schools, clubs, academies, leagues, championships or other sporting activities.
• Sports Profile: The set of data associated with an athlete within the Platform, including sporting identification information, competitive history, statistics, categories, teams, achievements, results and other information related to their sporting activity.
• Privacy by Design: The principle under which the Platform's functionalities, processes and technological developments seek to incorporate personal-data-protection mechanisms from the initial stages of design and development.
• Payment Service Provider: A specialized entity responsible for the processing, validation, collection, release or administration of economic transactions carried out through the Platform.
• Technology Provider: A legal person that supplies infrastructure, software, storage, artificial intelligence, authentication, information security, communications, analytics or other technological services necessary for the operation of DeportID.
• RAMBIT S.A.S.: The Colombian commercial company that owns and operates the DeportID Platform, which acts as Data Controller with respect to the personal data processed in the development of the services offered.
• Data Controller: A natural or legal person who decides on the purposes and means of the processing of personal data.
• Data Subject: A natural person whose personal data is subject to processing.
• Processing: Any operation carried out on personal data, such as collection, storage, use, circulation, updating, transmission, transfer, consultation, organization, retention, deletion or any other activity permitted by applicable legislation.
• Guardian: A mother, father, legal representative or person authorized to represent a minor with respect to actions that require authorization under the law.
• User: Any natural or legal person who interacts with the Platform in any of the roles enabled by DeportID, including visitors, players, organizers, coaches, referees, delegates, legal representatives, sponsors and other persons authorized to use the services.

The definitions contained in this Policy shall be interpreted in harmony with the Terms and Conditions of Use and with the other documents that make up the DeportID Contractual Ecosystem. In the event of conflict between definitions, the definition that is most specific to the matter being regulated shall prevail, always seeking a systematic interpretation that favors the protection of the rights of data subjects and the coherence of the Contractual Ecosystem.

12. General Principles

All personal data processing activities carried out by RAMBIT S.A.S. shall be developed in accordance with the principles set forth in the Political Constitution, Law 1581 of 2012, Decree 1074 of 2015 and the other rules that regulate the protection of personal data, as well as the governance, digital security and privacy principles set forth in this Policy. These principles shall guide the interpretation, application and execution of all actions related to the processing of personal information within the DeportID Ecosystem and shall prevail over any practice that is incompatible with the effective protection of the rights of data subjects.

13. Principle of Legality

All processing of personal data carried out by RAMBIT S.A.S. shall be developed on the basis of a valid legal basis and in accordance with applicable legislation, refraining from carrying out processing incompatible with the purposes authorized by the data subjects or with the other legally established scenarios.

14. Principle of Purpose

Personal data shall only be processed for legitimate, determined, explicit purposes that have been made known to the data subject or that are permitted by law. RAMBIT S.A.S. shall refrain from using personal information for purposes incompatible with those that initially justified its collection, unless there is a new legal basis authorizing the corresponding processing.

15. Principle of Freedom

The processing of personal data shall require the data subject's prior, express and informed authorization where such authorization is required under Colombian legislation. No processing activity shall imply the waiver of the rights recognized to data subjects or the imposition of general authorizations that exceed the legitimate purposes of the Platform.

16. Principle of Transparency

RAMBIT S.A.S. shall seek to keep data subjects informed about the conditions under which their personal data is processed, facilitating access to this Policy, to the mechanisms for exercising their rights, and to the information necessary to understand the scope of the processing carried out by the Platform.

17. Principle of Accuracy and Quality of Information

Personal information subject to processing must be truthful, complete, accurate, up to date, verifiable and understandable. Data subjects undertake to provide authentic information and to keep it reasonably up to date, while RAMBIT S.A.S. shall seek to implement mechanisms allowing information to be corrected, updated or deleted where appropriate.

18. Principle of Access and Restricted Circulation

Access to personal data shall be limited to persons who, by reason of their duties, contractual obligations or legal requirements, need to know the information in order to fulfill the purposes set forth in this Policy. The circulation of information shall be limited to the minimum necessary for the proper provision of the services offered by the Platform and shall be carried out observing reasonable security and confidentiality measures.

19. Principle of Information Security

RAMBIT S.A.S. shall implement technical, administrative, organizational and legal measures reasonably aimed at protecting personal data against loss, alteration, unauthorized access, destruction, improper disclosure, fraudulent use or any other unauthorized processing. Such measures shall be proportional to the level of risk associated with each category of information and may evolve in line with technological development, the emergence of new digital threats and best practices in information security.

20. Principle of Confidentiality

All persons involved in the processing of personal data shall be obligated to guarantee the confidentiality and privacy of the information known to them by reason of their duties, even after the employment, contractual or commercial relationship that gave rise to access to such information has ended.

21. Principle of Demonstrated Accountability

RAMBIT S.A.S. shall adopt reasonable measures aimed at demonstrating ongoing compliance with the obligations arising from personal-data-protection legislation, implementing oversight, documentation, continuous-improvement, risk-management and internal-control mechanisms that make it possible to demonstrate the proper administration of the privacy program.

22. Principle of Privacy by Design and by Default

The Platform shall seek to incorporate personal-data-protection mechanisms from the initial stages of design, development, implementation and updating of its processes, products and functionalities, seeking to ensure that default settings favor the highest possible level of protection of personal information compatible with the nature of the service offered. Every new functionality shall be evaluated considering, among other aspects, the necessity of the processing, the minimization of the information collected, the risks to data subjects, and the security measures reasonably applicable.

23. Principle of Minimization of Processing

RAMBIT S.A.S. shall seek to collect only those personal data that are relevant, adequate and reasonably necessary for the fulfillment of the purposes made known to data subjects, avoiding the indiscriminate collection of information unrelated to the services offered by the Platform. Where a purpose can be achieved using a smaller volume of information or through less sensitive data, that alternative shall be favored.

24. Principle of Reinforced Protection of Children and Adolescents

The protection of the personal data of children and adolescents constitutes a cross-cutting principle of the DeportID Ecosystem. Accordingly, every processing activity related to minors must be interpreted and carried out favoring their best interests, the protection of their privacy, the prevention of risks associated with the digital environment, and respect for their fundamental rights.

RAMBIT S.A.S. shall adopt reasonable measures to restrict the unnecessary circulation of information corresponding to minors, to limit access to such information exclusively to those who need to know it for legitimate reasons, and to promote mechanisms that allow mothers, fathers, legal representatives or guardians to properly exercise the rights recognized to them by Colombian legislation. Whenever possible, the Platform's functionalities shall be designed seeking to reduce the public exposure of information corresponding to minors and to strengthen the controls associated with its processing.

25. Principle of Proportionality

Every decision related to the processing of personal data must bear a reasonable relationship between the purpose pursued, the nature of the information processed, the existing level of risk, and the measures implemented to protect the rights of data subjects. No excessive or disproportionate processing shall be carried out in relation to the legitimate purpose that justifies it.

26. Principle of Continuous Improvement

This Policy shall be subject to periodic review in order to incorporate improvements arising from regulatory changes, technological evolution, newly identified risks, growth of the Platform or national and international best practices in privacy and personal-data protection. RAMBIT S.A.S. shall promote an organizational culture aimed at the ongoing strengthening of privacy, seeking to ensure that the measures implemented evolve consistently with the development of the DeportID Ecosystem.

27. Data Subjects of Personal Data

This Policy shall apply to the personal data corresponding to all natural persons whose information is processed by RAMBIT S.A.S. in connection with the use of the DeportID Platform, the provision of its services, or the development of activities related to its corporate purpose. For purposes of this Policy, data subjects may belong to one or more of the following categories, without such classification limiting the rights recognized by Colombian legislation.

28. Platform Visitors

These are persons who access the website, mobile applications or other digital channels of DeportID without having created an account or without authenticating within the Platform. With respect to these data subjects, RAMBIT S.A.S. may process the information strictly necessary to enable browsing, guarantee information security, administer the technical functioning of the Platform, prevent cybersecurity incidents, obtain aggregate usage statistics and address the other purposes set forth in this Policy.

29. Registered Users

This category comprises natural persons who create an account within the Platform to access any of the services offered by DeportID. This category includes both those who actively participate in sporting activities and those who use the Platform to administer organizations, consult information, make payments, interact with other Users or access technological functionalities available within the DeportID Ecosystem.

30. Athletes, Players and Participants

These are natural persons enrolled in tournaments, competitions, leagues, sports schools, clubs, academies, championships, training sessions or any other sporting activity administered through the Platform. The processing of their information may include data related to their sporting participation, competitive history, statistics, categories, results, teams, sporting performance and other information necessary for the proper functioning of the services offered by DeportID. The processing of this information shall be carried out seeking to respect the athlete's dignity, avoiding discriminatory processing and limiting the publication of information to the minimum necessary for the fulfillment of the Platform's legitimate purposes.

31. Organizers

These are natural or legal persons who administer tournaments, clubs, sports schools, academies, championships, leagues, recreational events or other sporting activities using the technological tools offered by DeportID. Organizers may provide information corresponding to third parties under their own responsibility and must ensure compliance with the obligations applicable to them under personal-data-protection legislation and under the Organizer Adhesion Agreement. Where the Organizer autonomously determines the purposes and means of processing with respect to certain information, it shall act as an independent Data Controller as set forth in this Policy and in Colombian legislation.

32. Coaches, Referees, Judges, Delegates and Technical Staff

The Platform may process information corresponding to coaches, physical trainers, referees, sports judges, delegates, coordinators, physiotherapists, authorized medical personnel, technical assistants and other persons involved in the development of sporting activities administered through DeportID. The processing of such information shall be limited to the fulfillment of the purposes related to the organization of sporting events, the administration of competitions, the management of sports organizations and the other activities set forth in this Policy.

33. Mothers, Fathers, Legal Representatives, Guardians and Caretakers

Where the Platform allows the participation of minors, it may process information corresponding to their mothers, fathers, legal representatives, guardians or caretakers for purposes of verifying authorizations, managing enrollments, attending to requests related to the minor, facilitating communication with the family, administering payments, guaranteeing the minor's safety, and complying with the corresponding legal obligations. Actions related to minors shall seek to strengthen the participation of legal representatives and facilitate the exercise of the rights recognized to them by Colombian legislation.

34. Children and Adolescents

RAMBIT S.A.S. recognizes that children and adolescents are data subjects entitled to special constitutional and legal protection. Accordingly, the processing of their personal data shall be carried out under reinforced criteria of necessity, proportionality, security and confidentiality, seeking to limit the collection of information to the minimum necessary for the provision of sports services, to restrict the public circulation of their personal data, and to reduce any risk arising from the digital environment. The Platform shall seek to implement controls aimed at preventing unauthorized access to information corresponding to minors and shall adopt reasonable measures to prevent situations that could compromise their safety, dignity, or physical, psychological or emotional integrity. Whenever required under applicable legislation, RAMBIT S.A.S. shall request the authorization of the mother, father, legal representative or guardian before carrying out processing that requires it. If any situation that could pose a risk to a minor is identified, RAMBIT S.A.S. may adopt preventive protection measures within the scope of its powers, including access restrictions, suspension of functionalities, additional identity verification, or any other action reasonably aimed at protecting the best interests of the minor, without prejudice to the actions that correspond to the competent authorities.

35. Representatives of Legal Entities

This Policy shall also apply to the processing of personal data corresponding to legal representatives, administrators, authorized officers, employees or other natural persons who act on behalf of sports clubs, leagues, federations, sponsoring companies, public entities, educational institutions, strategic partners or any other legal entity linked to the Platform.

36. Suppliers, Contractors, Strategic Partners and Applicants

RAMBIT S.A.S. may process information corresponding to suppliers, contractors, consultants, strategic partners, candidates in selection processes, workers and other natural persons who maintain or seek to maintain legal relationships with the company. The processing of such information shall be carried out in accordance with the specific purposes set forth in this Policy, at all times respecting the principles of necessity, confidentiality, minimization and information security.

37. Equal Protection of Data Subjects

The classification set forth in this Title has an exclusively organizational purpose and does not imply differences with respect to the level of protection recognized to data subjects. RAMBIT S.A.S. shall guarantee the exercise of the rights set forth by Colombian legislation to all data subjects whose personal data is subject to processing, without prejudice to the reinforced protection measures applicable to children and adolescents and to the particularities arising from the nature of certain processing activities.

38. General Categories of Information Processed.

RAMBIT S.A.S. shall process only the personal data that are relevant, adequate and reasonably necessary for the fulfillment of the purposes set forth in this Policy, seeking at all times to respect the principles of necessity, proportionality, minimization and reinforced protection of the rights of data subjects. Depending on the service used by the User and the nature of the relationship existing with the Platform, one or more of the categories of information set forth in this Title may be processed. The collection of a given category of data does not mean that all Users must provide it, but only that which is necessary for the provision of the corresponding service.

39. Identification Data

RAMBIT S.A.S. may process data intended to fully identify the data subject, including first and last names, type and number of identity document, date of birth, nationality, sex where relevant, profile photograph, signature, electronic signature, username, internal Platform identifiers and other information necessary to individualize the person within the DeportID Ecosystem. Where the nature of the service so requires, identity documents may be verified in order to prevent impersonation, protect minors, guarantee the security of the Platform, or comply with legal obligations.

40. Contact Data

Email addresses, telephone numbers, physical addresses, municipality, department, country of residence, authorized contact channels, information for sending communications and any other data necessary to maintain the relationship between the data subject and the Platform may be processed. RAMBIT S.A.S. shall seek to use this data only for the authorized purposes and shall limit commercial communications in accordance with the preferences expressed by the data subject and applicable legislation.

41. Authentication and Security Data

In order to protect User accounts and strengthen the security of the DeportID Ecosystem, the Platform may process information related to authentication mechanisms, including encrypted passwords, login and logout records, IP addresses, device identifiers, verification codes, multi-factor authentication, security tokens, activity logs, access history, authentication events and other technical information necessary to prevent unauthorized access. Access credentials shall be administered through reasonable security mechanisms and shall not be used for purposes other than those related to authentication and account protection.

42. Sports Data

The Platform may process information related to Users' sporting activity, including sport, category, playing position, club, school or academy to which they belong, teams, participation history, competitions, results, sports statistics, rankings, recognitions, achievements, competitive history, sporting performance and other information necessary for the operation of the services offered. RAMBIT S.A.S. shall seek to ensure that the publication of such information serves legitimate purposes related to sports management and shall limit the public exposure of information corresponding to minors in accordance with the criteria established in this Policy.

43. Economic and Transactional Data

Where the Platform allows payments or collections to be made, data related to economic transactions, payment history, enrollments, billing, receipts, transaction status, returns, refunds, withholdings, commissions, payment methods used and other information necessary for the proper administration of economic operations may be processed. RAMBIT S.A.S. shall not store information corresponding to credit or debit cards where such administration corresponds directly to specialized payment service providers, except for the minimum information necessary to evidence the existence of the transaction or to attend to claims.

44. Browsing and Device Data.

The Platform may process technical information related to the use of the services, including IP address, device identifiers, browser used, operating system, language, time zone, screen resolution, browsing logs, time spent, interaction history, events generated within the Platform, session identifiers and other information necessary to guarantee the technical functioning of the services. This information may be used to strengthen information security, improve the User experience, prevent fraud, perform aggregate statistical analysis, and optimize the performance of the Platform.

45. Geolocation Data

Where the User expressly authorizes access to their device's location or where the corresponding functionality is necessary for the proper provision of certain services, RAMBIT S.A.S. may process information related to the User's approximate or precise geographic location. The processing of this information shall be limited to the specific purposes that justify its use and may be disabled by the User where the nature of the service allows it. With respect to minors, the use of geolocation-based functionalities shall seek to be developed under reinforced criteria of protection and risk minimization.

46. Image, Voice and Audiovisual Content Data

The Platform may process photographs, videos, voice recordings, live broadcasts, audiovisual material, profile images and other multimedia content that Users publish, authorize or generate during the use of the services. Where such content corresponds to minors, RAMBIT S.A.S. shall adopt reasonable measures aimed at restricting its unnecessary circulation and shall seek to ensure that its publication serves sporting, informational, institutional or security purposes previously authorized under applicable legislation.

47. Communications Data

Communications exchanged between Users and the Platform through the Official Channels may be processed, including support requests, inquiries, complaints, messages, notifications, emails, conversations held through User-support tools, and other interactions related to the provision of the services. These communications may be retained where necessary to attend to subsequent requests, guarantee the quality of the service, resolve disputes, strengthen the security of the Platform, or comply with legal obligations.

48. Inferred and Analytical Data

As a result of the use of the Platform, RAMBIT S.A.S. may generate information derived from the analysis of data previously provided by Users, including usage indicators, aggregate statistics, usage patterns, functional profiles, performance metrics, predictive models and other analyses aimed at improving the services. The generation of these analyses shall seek to be carried out using mechanisms that reasonably reduce the impact on the privacy of data subjects and shall not be aimed at making discriminatory decisions or decisions incompatible with the fundamental rights of Users.

49. Sensitive Data and Categories Subject to Special Protection

RAMBIT S.A.S. recognizes that certain processing may involve sensitive data or information subject to reinforced protection under Colombian legislation. Accordingly, the processing of this type of information shall only be carried out where there is a valid legal basis, where it is strictly necessary for the fulfillment of the authorized purposes, or where it corresponds to one of the scenarios provided for by law. This category may include, among others, data related to health where indispensable for safe participation in certain sporting activities, biometric information where authentication mechanisms requiring it are implemented, data corresponding to children and adolescents, and any other information that Colombian legislation considers subject to special protection. RAMBIT S.A.S. shall seek to avoid the collection of sensitive data where the purpose pursued can be achieved through less intrusive information.

50. Update of the Categories of Information

The categories set forth in this Title may be expanded, reorganized or adjusted where the technological evolution of the Platform, the incorporation of new services, regulatory changes or the implementation of new functionalities make it necessary to process additional categories of personal information. Any modification shall respect the principles established in this Policy and, where applicable, shall be communicated to data subjects in accordance with the procedures set forth in the DeportID Contractual Ecosystem.

51. General Criteria for the Processing of Personal Data

RAMBIT S.A.S. shall process the personal data of data subjects exclusively for the fulfillment of legitimate, determined, explicit purposes compatible with the operation of the DeportID Platform, seeking at all times to respect the principles set forth in this Policy and to guarantee an appropriate balance between the provision of services, technological innovation and the protection of the fundamental rights of data subjects. The purposes described in this Title shall be interpreted comprehensively and in a complementary manner, without prejudice to those others that are necessary to comply with legal, contractual or regulatory obligations compatible with the nature of the Platform. Where a purpose requires a different legal basis or an additional authorization under applicable legislation, RAMBIT S.A.S. shall seek to obtain it before commencing the corresponding processing.

CHAPTER I - Purposes Related to Account and User Administration

52. Management of User Accounts

RAMBIT S.A.S. may process personal data for the following purposes:

1. Create, register and administer accounts within the Platform.
2. Verify the identity of Users.
3. Validate the authenticity of the information provided.
4. Enable authentication processes.
5. Administer user profiles.
6. Manage roles, permissions and access levels.
7. Facilitate account recovery.
8. Manage password changes.
9. Implement reinforced authentication mechanisms.
10. Prevent identity impersonation.
11. Detect duplicate registrations.
12. Administer active sessions.
13. Record acceptance of contractual documents.
14. Maintain evidence of the consents granted.
15. Update information provided by the User.
16. Administer privacy settings.
17. Manage User preferences.
18. Administer account statuses.
19. Temporarily suspend functionalities where necessary.
20. Close accounts in accordance with the Terms and Conditions.

CHAPTER II - Purposes Related to Sports Operations

53. Management of Sporting Activities

Information may be processed to:

1. Administer tournaments.
2. Manage championships.
3. Administer leagues.
4. Manage sports schools.
5. Administer academies.
6. Manage clubs.
7. Administer sports organizations.
8. Create teams.
9. Manage sports rosters.
10. Register players.
11. Administer categories.
12. Manage sports calendars.
13. Schedule matches.
14. Administer sports venues.
15. Record results.
16. Generate statistics.
17. Consolidate sports history.
18. Manage rankings.
19. Administer standings tables.
20. Generate sports reports.
21. Facilitate enrollment processes.
22. Manage available slots.
23. Control player participation.
24. Administer sporting sanctions imposed by Organizers.
25. Administer sports documentation.
26. Validate participation requirements; aa) Manage sports licenses where applicable; ab) Generate certificates of participation; ac) Administer sports recognitions; ad) Retain competitive history; ae) Enable historical queries; af) Optimize sports management through technological tools.

CHAPTER III - Purposes Related to the Protection of Children and Adolescents

54. Reinforced Protection of Minors

Where the Platform processes personal data corresponding to children or adolescents, the information may be used exclusively to:

1. Verify the existence of the legally required authorizations.
2. Administer the minor's participation in sporting activities.
3. Identify their mothers, fathers, legal representatives or guardians.
4. Manage enrollment processes.
5. Facilitate communication with the family.
6. Protect the integrity of the minor during sporting activities.
7. Administer special authorizations.
8. Restrict unauthorized access to their information.
9. Prevent risks associated with the digital environment.
10. Limit the public circulation of personal data.
11. Administer viewing permissions.
12. Manage parental controls where implemented.
13. Guarantee the exercise of the rights of legal representatives.
14. Attend to requirements from competent authorities.
15. Protect the physical and digital safety of the minor.
16. Prevent situations of fraud, impersonation or improper contact.
17. Implement reinforced authentication mechanisms where necessary.
18. Comply with the obligations set forth by Colombian legislation with respect to the comprehensive protection of children and adolescents.

Under no circumstances shall personal data corresponding to minors be used for purposes incompatible with their best interests or for behavioral marketing activities, aggressive commercial profiling, or any other purpose that could disproportionately affect their fundamental rights.

CHAPTER IV - Purposes Related to Communications and User Support

55. User Support

Information may be processed to:

1. Attend to inquiries.
2. Resolve petitions.
3. Manage complaints.
4. Respond to requests.
5. Provide technical support.
6. Administer the help desk.
7. Manage incidents.
8. Attend to requirements related to payments.
9. Administer service warranties.
10. Send confirmations.
11. Send operational notifications.
12. Send security alerts.
13. Inform about changes to the Platform.
14. Manage reminders.
15. Attend to judicial or administrative requirements.
16. Manage conciliation processes.
17. Follow up on requests.
18. Measure satisfaction levels.
19. Improve the quality of the service.
20. Maintain traceability of communications carried out through the Official Channels.

CHAPTER V - Purposes Related to Economic Transactions and Financial Administration.

56. Management of Economic Transactions

RAMBIT S.A.S. may process personal data related to economic, financial and transactional operations for the following purposes:

1. Administer the collection of enrollment fees, memberships, participation fees, additional services and any other economic item offered through the Platform.
2. Process payments made by Users using the means enabled by DeportID.
3. Validate the authenticity of economic operations carried out through the Platform.
4. Manage electronic invoicing processes and the issuance of tax documents where applicable.
5. Administer payment receipts and supporting documentation for transactions carried out.
6. Manage returns, refunds, payment reversals, chargebacks and other economic procedures in accordance with the Refunds, Chargebacks and Release of Funds Policy.
7. Administer the release of funds to Organizers in accordance with the conditions set forth in the Contractual Ecosystem.
8. Carry out accounting and financial reconciliation processes.
9. Manage matters related to rejected, pending or failed payments.
10. Detect unusual operations or inconsistencies in economic transactions.
11. Attend to claims related to financial operations.
12. Comply with tax, accounting and financial obligations.
13. Maintain historical records of economic operations.
14. Facilitate financial audit processes.
15. Administer discounts, promotions, coupons and economic benefits where these are offered by the Platform.
16. Manage refund processes ordered by competent authorities.
17. Attend to requirements made by financial institutions, payment service providers or competent authorities.
18. Retain digital evidence related to economic operations.
19. Fulfill any other purpose compatible with the proper financial administration of the Platform.

CHAPTER VI - Purposes Related to Digital Security, Fraud Prevention and Protection of the Ecosystem.

57. Security of the Platform

In order to protect the integrity of the DeportID Ecosystem, information may be processed to:

1. Verify the identity of Users.
2. Detect impersonation attempts.
3. Prevent unauthorized access.
4. Administer authentication mechanisms.
5. Implement multi-factor authentication.
6. Detect anomalous behavior.
7. Identify fraudulent activities.
8. Prevent misuse of the Platform.
9. Manage cybersecurity incidents.
10. Administer audit logs.
11. Monitor security events.
12. Protect the technological infrastructure.
13. Implement access controls.
14. Administer internal permissions.
15. Manage technological vulnerabilities.
16. Investigate security incidents.
17. Perform digital forensic analysis where necessary.
18. Retain electronic evidence.
19. Comply with requirements from competent authorities.
20. Protect the rights of Users.
21. Guarantee the operational continuity of the Platform.
22. Continuously strengthen information-security mechanisms.
23. Prevent cyberattacks.
24. Protect the confidentiality, integrity and availability of information.
25. Manage technological risks.
26. Adopt preventive measures against digital threats.

CHAPTER VII - Purposes Related to Legal and Regulatory Compliance.

58. Compliance with Legal Obligations

RAMBIT S.A.S. may process personal information for the purpose of:

1. Complying with the obligations set forth by Colombian legislation.
2. Complying with orders issued by judicial or administrative authorities.
3. Attending to requirements from oversight bodies.
4. Managing inspection, oversight and control processes.
5. Retaining information where there is a legal obligation to do so.
6. Complying with tax obligations.
7. Complying with corporate obligations.
8. Responding to requests made by competent authorities.
9. Exercising the legal defense of RAMBIT S.A.S.
10. Attending to judicial, arbitration, administrative or disciplinary proceedings.
11. Managing conciliation processes.
12. Complying with obligations arising from electronic commerce.
13. Protecting the rights of third parties.
14. Preventing the use of the Platform for unlawful activities.
15. Guaranteeing compliance with the Contractual Ecosystem.
16. Administering internal compliance processes.
17. Conducting legal audits.
18. Managing risk matrices.
19. Complying with obligations related to the protection of personal data.
20. Documenting actions that must be retained under applicable legislation.

CHAPTER VIII - Purposes Related to Analytics, Continuous Improvement and Innovation.

59. Analytics and Innovation

RAMBIT S.A.S. may process personal information to:

1. Understand how Users use the Platform.
2. Measure usage indicators.
3. Identify opportunities for improvement.
4. Optimize internal processes.
5. Develop new functionalities.
6. Correct technological errors.
7. Conduct quality testing.
8. Implement performance improvements.
9. Generate aggregate statistics.
10. Develop management indicators.
11. Evaluate the performance of the Platform.
12. Identify sporting trends.
13. Develop new technological tools.
14. Optimize the User experience.
15. Evaluate the impact of new functionalities.
16. Develop predictive models.
17. Implement automation tools.
18. Strengthen innovation processes.
19. Conduct statistical analyses without individually identifying data subjects where this is possible.
20. Continuously improve the services offered by DeportID.

CHAPTER IX - Purposes Related to Artificial Intelligence and Automation.

60. Artificial Intelligence

Where the Platform incorporates artificial intelligence tools, personal data may be processed to:

1. Automate administrative processes.
2. Assist User-support processes.
3. Classify information.
4. Detect inconsistencies.
5. Identify operational risks.
6. Strengthen fraud-prevention mechanisms.
7. Generate sports recommendations.
8. Optimize internal processes.
9. Facilitate intelligent searches.
10. Support the generation of statistics.
11. Improve the browsing experience.
12. Personalize certain functionalities authorized by the User.
13. Optimize response times.
14. Strengthen digital-security processes.
15. Continuously improve the technological models implemented by the Platform, seeking to use minimization, anonymization or pseudonymization techniques where technically and legally feasible.
16. The use of artificial intelligence shall be carried out respecting the principles set forth in this Policy and in the Terms and Conditions of Use, guaranteeing that personal data is not used for purposes incompatible with those authorized by data subjects.

CHAPTER X - Purposes Related to Strengthening the Sports Community and Relationships with Users.

61. Engagement with the DeportID Community

RAMBIT S.A.S. may process personal data for the purpose of strengthening the sports community that interacts through the Platform, promoting the responsible participation of its Users, and improving the experience of those who are part of the DeportID Ecosystem. To that end, information may be used to:

1. Maintain ongoing communication with Users regarding the services offered by the Platform.
2. Inform about the opening of new tournaments, competitions, leagues, sports schools, academies and other activities administered through DeportID.
3. Disseminate institutional content related to sport, wellness, physical activity, healthy habits, fair play, coexistence, inclusion and sports education.
4. Inform about news regarding new functionalities, technological improvements and Platform updates.
5. Invite participation in sporting events, training sessions, conferences, institutional campaigns and activities carried out by RAMBIT S.A.S. or by strategic partners.
6. Promote campaigns aimed at strengthening digital security, the protection of children and adolescents, fraud prevention, and the responsible use of the Platform.
7. Publicly recognize sporting achievements where this corresponds to the purpose of the Platform and there is a legal basis permitting such processing.
8. Send information related to loyalty programs, benefits, incentives, promotions or commercial alliances compatible with the sporting nature of the Platform.
9. Administer processes for participation in activities organized by DeportID.
10. Conduct satisfaction surveys.
11. Obtain feedback on the services.
12. Identify opportunities for improvement.
13. Strengthen the sense of community within the Platform.
14. Promote safe, respectful and inclusive spaces for all Users.
15. Develop institutional campaigns aimed at strengthening formative, recreational and competitive sport.
16. Support corporate social responsibility initiatives related to physical activity, inclusion and the comprehensive development of the sports community.
17. Promotional or commercial communications shall be sent respecting the authorizations granted by data subjects and the revocation mechanisms set forth by applicable legislation.

Under no circumstances shall RAMBIT S.A.S. use personal data corresponding to children and adolescents to develop behavioral advertising campaigns, commercial profiling, invasive marketing, or any activity that is incompatible with their best interests or that could result in a disproportionate exposure of their personal information.

CHAPTER XI - Purposes Related to Suppliers, Structural Partners and Corporate Management.

62. Corporate and Administrative Management

RAMBIT S.A.S. may process information corresponding to suppliers, contractors, strategic partners, legal representatives, workers, candidates in selection processes and other persons linked to the company for the following purposes:

1. Evaluate hiring processes.
2. Administer business relationships.
3. Execute and perform contracts.
4. Manage personnel selection processes.
5. Administer labor obligations.
6. Manage payments.
7. Administer suppliers.
8. Evaluate contractor performance.
9. Manage audit processes.
10. Administer accounting processes.
11. Comply with tax obligations.
12. Manage internal administrative processes.
13. Carry out corporate planning activities.
14. Manage corporate risks.
15. Comply with regulatory obligations.
16. Administer compliance processes.
17. Pursue legal actions where necessary.
18. Protect the rights and legitimate interests of RAMBIT S.A.S.
19. Retain information necessary to attend to subsequent obligations arising from the corresponding legal relationship.

CHAPTER XII - Limitations on Processing.

63. Expressly Prohibited Processing

Without prejudice to the other prohibitions set forth by Colombian legislation, RAMBIT S.A.S. shall seek to refrain from carrying out personal data processing that is incompatible with the nature of the Platform or with the principles established in this Policy. In particular, RAMBIT S.A.S. shall not use personal information to:

1. Carry out discriminatory processing on grounds of sex, gender, sexual orientation, gender identity, ethnic origin, nationality, religion, economic status, disability, medical condition, political affiliation, or any other category protected by legislation.
2. Commercialize personal-data databases.
3. Sell personal information to third parties.
4. Allow indiscriminate access to information corresponding to minors.
5. Use personal data for purposes other than those made known to data subjects where this would require a different legal basis.
6. Implement behavioral-advertising mechanisms specifically directed at children and adolescents.
7. Make automated decisions that produce significant legal effects on data subjects without observing the guarantees set forth by applicable legislation.
8. Carry out processing that is manifestly disproportionate in relation to the purpose pursued.
9. Use information obtained through the Platform for unlawful activities or activities incompatible with the DeportID Contractual Ecosystem.
10. The foregoing list is illustrative in nature and does not limit the other restrictions arising from Colombian legislation or from the principles set forth in this Policy.

64. Special Regime for the Processing of Data of Children and Adolescents

RAMBIT S.A.S. recognizes that children and adolescents are data subjects entitled to reinforced constitutional and legal protection and that any processing of their personal data must be carried out favoring their best interests, their comprehensive development, their human dignity, and the effective exercise of their fundamental rights. Accordingly, the processing of personal data corresponding to minors shall only be carried out where strictly necessary for the provision of the sports services offered through the Platform, the organization of sporting activities, the protection of the minor's integrity, compliance with legal obligations, or any other legitimate purpose compatible with their best interests.

RAMBIT S.A.S. shall seek to collect only the information strictly necessary for the fulfillment of such purposes and shall adopt reinforced measures aimed at limiting the circulation of information, restricting internal access, preventing unnecessary processing, and minimizing the risks arising from the digital environment. Whenever required under Colombian legislation, processing shall be carried out with the authorization of the mother, father, legal representative or guardian, without prejudice to the progressive recognition of adolescents' autonomy according to their age, degree of maturity, and applicable legal provisions.

The Platform shall seek to implement reinforced privacy settings for profiles corresponding to minors, limiting by default the public visibility of their information where compatible with the nature of the service. RAMBIT S.A.S. shall permanently promote a safe digital environment for minors, developing awareness campaigns, reporting mechanisms, technological controls and internal procedures aimed at preventing any improper use of information corresponding to this category of data subjects.

65. Processing of Sensitive Data

RAMBIT S.A.S. recognizes that certain personal data, by their nature, require a higher-than-ordinary level of protection. Accordingly, the processing of sensitive data shall only be carried out where there is a valid legal basis, where it is strictly necessary for the fulfillment of a legitimate purpose, and where reinforced security measures aimed at protecting the fundamental rights of data subjects are adopted. The Platform shall seek to avoid the collection of sensitive data where the purposes pursued can be achieved through less invasive information or through alternative mechanisms that reduce the impact on the data subject's privacy.

Where the processing of sensitive data requires the data subject's authorization, such authorization must be obtained on a prior, express and informed basis, clearly indicating the optional nature of providing it, unless applicable legislation establishes an exception. Access to this type of information shall be restricted exclusively to persons who, by reason of their duties, need to know it for the fulfillment of the authorized purposes, implementing reasonable confidentiality, traceability and access-control measures.

66. Information Related to Health Conditions

The Platform's main purpose is not the provision of health services or the compilation of medical records. Nevertheless, where the nature of certain sporting activities reasonably requires knowledge of information related to medical restrictions, allergies, emergency medications, sports insurance, temporary disabilities, physical-fitness certifications or other information indispensable to protect the athlete's integrity during an activity organized through the Platform, RAMBIT S.A.S. may process such information within the limits authorized by law and solely to guarantee the proper management of the sporting event, the handling of emergency situations, or compliance with legal obligations. Whenever possible, medical information shall be administered directly by the corresponding Organizer or by the competent professionals, avoiding RAMBIT S.A.S. processing clinical information beyond the needs inherent to the operation of the Platform.

67. Processing of Images and Audiovisual Content

The Platform may process photographs, video recordings, live broadcasts, institutional images, multimedia content, audiovisual material generated during sporting events and other visual or audio records associated with the operation of DeportID. This processing may be carried out to document sporting activities, facilitate the identification of participants, promote sporting events, generate institutional content, strengthen the sports community, guarantee the safety of the activities, resolve claims, retain evidence of incidents, and develop the other purposes set forth in this Policy.

Where audiovisual content includes minors, RAMBIT S.A.S. shall adopt reinforced measures aimed at limiting its public dissemination, restricting its use for promotional purposes where obtaining specific authorization is necessary, and seeking to ensure that the minor's exposure is always proportional to the purpose pursued. Under no circumstances shall the Platform promote the publication of images of minors that could facilitate identifying their usual whereabouts, reveal sensitive information about their family, educational or personal environment, or increase risks to their safety.

68. Institutional Use of Images

Images obtained during sporting activities may be used by RAMBIT S.A.S. to document the development of the services offered by the Platform, prepare institutional records, disseminate sporting results, promote sports-related campaigns, strengthen the DeportID community, and carry out institutional communication activities compatible with the purposes made known to the data subject. Where the use of an image has a commercial purpose different from the ordinary promotion of the Platform or involves an individualized exploitation of the data subject's image, RAMBIT S.A.S. shall obtain the additional authorizations that are legally necessary.

69. Processing of Location Information

Where the operation of the Platform requires the use of information related to the User's geographic location, RAMBIT S.A.S. shall seek to limit such processing to the information strictly necessary for the fulfillment of the corresponding purpose. Geolocation may be used to facilitate enrollment processes, validate the location of sporting venues, improve the browsing experience, strengthen security mechanisms, optimize services offered by the Platform, and develop functionalities expressly authorized by the User. The permanent use of geolocation mechanisms shall be exceptional and shall only be implemented where necessary for the provision of the corresponding service or where the User grants the authorization required under applicable legislation. With respect to minors, the Platform shall seek to minimize the processing of location information to the greatest extent possible and to limit its access exclusively to those who need to know it for legitimate reasons of safety or the administration of the sporting activity.

70. Processing through Artificial Intelligence Tools

RAMBIT S.A.S. may use artificial intelligence tools, machine learning, advanced analytics and other automation technologies to support the provision of the services offered through the Platform, provided that such processing is compatible with the purposes set forth in this Policy and with the provisions contained in the Terms and Conditions of Use. These tools may be used to support information-classification processes, fraud prevention, initial handling of requests, statistical analysis, generation of recommendations, strengthening of information security, automation of administrative processes, and continuous improvement of the services.

RAMBIT S.A.S. shall seek to ensure that the use of these technologies is developed under criteria of transparency, proportionality, human oversight where necessary, data minimization, information security, and respect for the fundamental rights of data subjects.

Where a decision may produce legal effects relevant to a data subject or significantly affect their rights, RAMBIT S.A.S. shall seek to guarantee reasonable human-review mechanisms where required by applicable legislation or by the nature of the processing. The use of artificial intelligence tools shall under no circumstances authorize the processing of personal data for purposes incompatible with those made known to data subjects, nor shall it permit the creation of discriminatory, invasive profiles, or profiles contrary to the principles set forth in this Policy.

As of the date of this Policy, RAMBIT S.A.S. does not transmit data subjects' personal data to the artificial intelligence providers used by the Platform. The processing carried out through these tools is limited to the processing of logistical and operational variables of tournaments (such as dates, categories, slots, results and other information necessary for sports organization), without including information that would directly identify data subjects. Should it become necessary in the future to transmit personal data to artificial intelligence providers for the development of new functionalities, RAMBIT S.A.S. shall update this Policy prior to such transmission, informing data subjects of that circumstance in accordance with the mechanisms set forth for updating this document.

71. Sports Profile and Statistics

In order to facilitate the administration of sporting activities and improve the User experience, RAMBIT S.A.S. may compile sports profiles based on the information generated during the use of the Platform. Such profiles may include information related to participation history, sports categories, results, statistics, teams, positions, achievements, recognitions, sporting performance and other information necessary for the operation of the services offered. The generation of sports statistics shall seek to promote the transparency of competitions, facilitate the organization of sporting events, and strengthen the sporting development of participants. RAMBIT S.A.S. shall seek to ensure that these activities do not give rise to discriminatory processing, arbitrary decisions, or disproportionate effects on the rights of data subjects. Where technically and legally feasible, analytics and research activities shall seek to use anonymized, aggregated or pseudonymized information to reduce the risks to the privacy of data subjects.

72. Rights of Data Subjects of Personal Data

Without prejudice to the other rights recognized by the Political Constitution of Colombia and applicable legislation, every person whose personal data is processed by RAMBIT S.A.S. shall have the right to:

• Know, update and rectify their personal data where such data is partial, inaccurate, incomplete, fragmented, misleading, or its processing is not authorized under applicable legislation.
• Request proof of the authorization granted where such authorization is required under law.
• Be informed, upon request, of the use that has been made of their personal data.
• Submit inquiries, petitions, complaints or claims related to the processing of their personal data.
• Request the updating, correction, limitation or deletion of information where appropriate under current legislation.
• Revoke the authorization granted for the processing of their personal data where permitted by law and where there is no legal or contractual duty preventing the deletion of the information.
• Request the limitation of processing where there are reasonable grounds justifying such measure.
• Access, free of charge, the personal data subject to processing under the terms set forth by Colombian legislation.
• File complaints with the Superintendence of Industry and Commerce where they consider that a violation of personal-data-protection rules has occurred, once the inquiry or complaint procedure before RAMBIT S.A.S. has been exhausted, where legally required.

The exercise of these rights must be carried out observing the procedures established in this Policy and in applicable legislation.

73. Special Rights of Children and Adolescents

With respect to personal data corresponding to children and adolescents, the rights set forth in the preceding article may be exercised by their mothers, fathers, legal representatives or guardians, without prejudice to the progressive recognition of the minor's autonomy according to their age, maturity and applicable legal provisions. RAMBIT S.A.S. shall seek to facilitate the effective exercise of these rights through simple, timely procedures aimed at guaranteeing the best interests of the minor. Where the Platform identifies requests related to the protection of children and adolescents, they shall be handled with reasonable priority in view of the level of risk associated with the situation raised.

74. Persons Entitled to Exercise the Rights

The following may exercise the rights set forth in this Policy: The data subject; the data subject's successors, where applicable under law; the data subject's legal representative; a duly authorized attorney-in-fact; the mothers, fathers, legal representatives or guardians of minors; and the other persons authorized by Colombian legislation. RAMBIT S.A.S. may request the documents reasonably necessary to verify the identity or representation of the person submitting the request.

75. Channels for Exercising Rights

Data subjects may exercise their rights using any of the Official Channels enabled by RAMBIT S.A.S., including the electronic mechanisms made available on the Platform, the email address designated for privacy matters, the forms enabled for that purpose, or any other means officially made known by the company. In order to protect personal information, RAMBIT S.A.S. may implement reasonable identity-verification procedures before providing information or carrying out actions related to the processing of personal data.

76. Inquiries

Data subjects may submit inquiries related to the personal information processed by RAMBIT S.A.S. Inquiries shall be handled within the terms set forth by Colombian legislation. Where it is not possible to attend to the inquiry within the term initially provided, RAMBIT S.A.S. shall inform the interested party of the reasons for the delay and the estimated response date, in accordance with applicable regulations.

77. Complaints

Where the data subject considers that the information processed by RAMBIT S.A.S. should be corrected, updated or deleted, or that there has been an alleged breach of personal-data-protection legislation, they may submit the corresponding complaint. The complaint must, at a minimum, contain the identification of the requester, a description of the facts giving rise to the request, an indication of the right sought to be exercised, and the documents that reasonably support the request where relevant. If the complaint is incomplete, RAMBIT S.A.S. may request the interested party to provide the information necessary to continue processing it, in accordance with the terms set forth by current legislation. Once the complete complaint has been received, RAMBIT S.A.S. shall carry out the actions necessary to verify the facts stated and shall respond within the legally established terms.

78. Requests for Deletion and Revocation

The deletion of personal data and the revocation of authorization shall proceed where compatible with applicable legislation and where there is no legal, contractual or judicial duty requiring the information to be retained. The request shall not proceed where the retention of the data is necessary for:

1. Compliance with legal obligations.
2. The performance of an ongoing contractual relationship.
3. Attending to judicial or administrative proceedings.
4. The protection of third-party rights.
5. The retention of digital evidence.
6. Attending to subsequent claims.
7. Compliance with tax, accounting or regulatory obligations.
8. The protection of children and adolescents.
9. The prevention of fraud or the security of the DeportID Ecosystem. In such cases, RAMBIT S.A.S. shall inform the data subject of the legal reasons justifying the retention of the information.

79. Free Exercise of Rights

The exercise of the rights set forth in this Policy shall be free of charge, except in cases where Colombian legislation expressly authorizes the charging of certain costs associated with the reproduction of information or with exceptional actions. RAMBIT S.A.S. shall seek to facilitate the exercise of rights through electronic procedures that reduce administrative burdens for data subjects.

80. Comprehensive Information Security Program

RAMBIT S.A.S. shall implement technical, administrative, physical, organizational and legal measures reasonably aimed at protecting the confidentiality, integrity, availability and resilience of the personal information processed through the Platform. Security measures shall be defined taking into account the nature of the information processed, the risks associated with each process, the state of technology, the evolution of digital threats, and the need to provide special protection for information corresponding to children and adolescents. The adoption of security measures does not constitute an absolute guarantee against all existing technological risks; nevertheless, RAMBIT S.A.S. shall seek to maintain an ongoing program to strengthen information security in accordance with applicable best practices.

81. Security Incident Management

RAMBIT S.A.S. shall implement internal procedures to identify, record, analyze, contain, mitigate and manage incidents that may affect the security of personal data. Where an incident significantly compromises the confidentiality, integrity or availability of personal information, the company shall adopt the measures reasonably necessary to control the situation, reduce its effects, document what occurred, and comply with the reporting or notification obligations set forth by Colombian legislation.

82. Retention of Information

Personal data shall be retained only for the time necessary to fulfill the purposes set forth in this Policy, attend to legal, contractual, tax, accounting, regulatory or judicial obligations, and guarantee the proper defense of the legitimate interests of RAMBIT S.A.S. and of data subjects. Once the purposes justifying the processing no longer exist and there is no legal obligation to retain the information, RAMBIT S.A.S. may proceed to delete, anonymize, pseudonymize or block it, as technically and legally appropriate. The specific document-retention criteria may be developed through internal policies or retention matrices adopted by RAMBIT S.A.S., which must respect the principles established in this Policy.

For purposes of this Policy, RAMBIT S.A.S. clarifies the scope of the following concepts: (i) Anonymization: the process by which information is deleted or modified such that the data ceases to be associated, or capable of being associated, with an identified or identifiable person, with no reasonable possibility of reversal; (ii) Pseudonymization: processing whereby personal data can no longer be attributed to a data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures designed to ensure that the data is not attributed to an identified or identifiable person; and (iii) Blocking: a measure consisting of the identification and retention of information solely for purposes of attending to legal, contractual, judicial or administrative requirements, suspending any other processing other than for that purpose.

In particular, when a User deletes their account from the Platform, RAMBIT S.A.S. anonymizes the data that allows their direct identification, such as the name and photograph associated with the profile. However, the statistics, results and other sporting information generated through the Platform shall remain associated with the corresponding record, given that such information is structurally related, through foreign keys and other database-specific links, to other records necessary for the integrity of competitions, sporting results and the rights of other participating third parties. This retention does not mean that the information ceases to be anonymized, insofar as, once the identifying attributes have been removed, such information does not allow the data subject to be re-identified, either on its own or together with the means reasonably available.

83. Transmission of Personal Data

For the proper functioning of the Platform, RAMBIT S.A.S. may transmit personal data to natural or legal persons acting as Data Processors, where such transmission is necessary for the development of the purposes set forth in this Policy. Data Processors may only process the information following the instructions given by RAMBIT S.A.S., observing the obligations set forth by Colombian legislation and adopting reasonable security measures aimed at protecting the personal data subject to processing. RAMBIT S.A.S. shall seek to ensure that every transmission of information is backed by legal instruments regulating the obligations of confidentiality, security, proper use of information, purpose limitation and other conditions necessary to protect the rights of data subjects.

84. National and International Transfers

Where the operation of the Platform makes it necessary to share information with persons or entities located within or outside Colombian territory, RAMBIT S.A.S. may carry out national or international transfers of personal data in accordance with the conditions set forth by Colombian legislation. These transfers may be carried out, among other cases, for the use of specialized technological services, cloud infrastructure, payment processing, user authentication, electronic communications, secure information storage, data backup, artificial intelligence, analytics, security monitoring, technical support and other services compatible with the operation of the Platform. Where applicable legislation so requires, RAMBIT S.A.S. shall verify the existence of adequate safeguards for the protection of the information or shall implement the legal mechanisms necessary to legitimize such transfers.

In order to comply with this duty to inform, RAMBIT S.A.S. discloses that, as of the date hereof, the main Data Processors receiving personal data in connection with national and international transfers are the following: (i) in Brazil, Supabase, for database, storage and user-authentication services; and (ii) in the United States, Resend (electronic communications), Google, Facebook/Meta and OneSignal (authentication, analytics and notifications), PostHog (product analytics), Vercel (technological infrastructure and hosting) and the artificial intelligence providers Anthropic, OpenAI and Google (processing of the Platform's artificial intelligence functionalities). RAMBIT S.A.S. may update this list where necessary for the operation of the Platform, adding or replacing Data Processors, without this implying a substantial modification of the purposes set forth in this Policy.

85. Categories of Data Processors

In order to facilitate understanding of the DeportID Ecosystem, Data Processors may belong, among others, to the following categories:

• Technology Providers, responsible for supplying technological infrastructure, storage services, software development, cloud services, authentication, information security, artificial intelligence, communications, monitoring, information backup and other tools necessary for the operation of the Platform.
• Payment Service Providers, responsible for facilitating payment processing, collections, financial validations, prevention of transactional fraud, returns, refunds and other economic operations related to the services offered through DeportID.
• Strategic Partners, where they participate together with RAMBIT S.A.S. in the development of sports projects, institutional activities or services compatible with the purposes made known to data subjects.
• Complementary Service Providers, where necessary to support the proper provision of the services offered by the Platform.

The participation of any of these actors shall not imply authorization to use personal data for purposes of their own that are incompatible with those set forth in this Policy.

86. Confidentiality of Data Processors

Every natural or legal person who takes part in the processing of personal data on behalf of RAMBIT S.A.S. must maintain the confidentiality and privacy of the information known to them during the performance of their duties, even after the corresponding legal relationship has ended. RAMBIT S.A.S. may contractually require its Data Processors to implement security measures compatible with the nature of the information processed and may carry out reasonable verifications aimed at guaranteeing proper compliance with the obligations assumed.

87. Use of Cookies and Similar Technologies

In order to guarantee the proper functioning of the Platform, improve the User experience, strengthen information security, and optimize the services offered, RAMBIT S.A.S. may use cookies, session identifiers, local browser storage, pixels, tags, SDKs, tokens, authentication technologies and other similar technical tools. These technologies may be used to remember User preferences, keep sessions active, strengthen authentication mechanisms, prevent fraud, obtain aggregate usage statistics, optimize the Platform's performance, and facilitate the provision of services. Where applicable legislation requires the User's consent for the use of certain technologies, RAMBIT S.A.S. shall implement the mechanisms necessary to obtain it and to allow it to be managed. The User may configure their browser or device to restrict certain technologies, without prejudice to the possibility that some Platform functionalities may be limited as a result of that decision.

88. Updating of the Policy

RAMBIT S.A.S. may modify, update or supplement this Policy where necessary to adapt it to regulatory, technological, operational or functional changes related to the Platform. Amendments shall be communicated through the Official Channels where applicable, indicating the effective date of the new version. Where an amendment involves substantial changes to the conditions of processing or requires a new authorization under applicable legislation, RAMBIT S.A.S. shall adopt the measures necessary to obtain it before commencing the corresponding processing.

89. Integration with the Contractual Ecosystem

This Policy forms an integral part of the DeportID Contractual Ecosystem and must be interpreted together with the Terms and Conditions of Use, the General Code of Conduct, the Refunds, Chargebacks and Release of Funds Policy, the Organizer Adhesion Agreement, the Organizer Operations Manual, and the other documents issued by RAMBIT S.A.S. to regulate specific aspects of the Platform. Matters relating to the contractual relationship between the Platform and Users, the functioning of the services, intellectual property, administrative measures, operational procedures, digital security, and the other obligations arising from the use of DeportID shall be governed primarily by the Terms and Conditions of Use. In the event of an apparent contradiction between this Policy and another document of the Contractual Ecosystem, the document that specifically regulates the matter under analysis shall prevail, always seeking a systematic, harmonious and coherent interpretation of the entire Contractual Ecosystem.

90. Interpretation Favorable to the Protection of Data Subjects

The provisions of this Policy must be interpreted in a manner that favors the effective protection of the rights of data subjects. With respect to children and adolescents, any reasonable doubt in the interpretation or application of this Policy must be resolved favoring the best interests of the minor, the protection of their privacy, the minimization of risks associated with the digital environment, and the guarantee of their fundamental rights.

91. Continuous Improvement Program

RAMBIT S.A.S. shall maintain an ongoing process of review and strengthening of its Comprehensive Personal Data Protection Program, seeking to incorporate national and international best practices in privacy, information security, digital governance and the protection of the rights of data subjects. The adoption of new technologies, the evolution of the Platform, or the incorporation of new services shall give rise to periodic review of this Policy, seeking to maintain an adequate level of protection against the risks inherent to each processing activity.

92. Effectiveness

This Policy shall be effective as of its publication and shall remain in effect for as long as RAMBIT S.A.S. carries out personal-data-processing activities related to the DeportID Platform, or until it is replaced by a new, duly published version. The databases administered by RAMBIT S.A.S. shall be retained for the time necessary to fulfill the purposes set forth in this Policy and the applicable legal, contractual or regulatory obligations.