PRIVACY POLICY eNor Securities’ privacy policy guidelines fully comply with the commitment of the Organization’s Senior Management to ensure the application of the Personal Data Protection Act principles for its customers, partners, professionals or any institution or person that has a relationship with the organization. The privacy and security of the user’s personal data is of great importance to us. That’s why we transparently explain how we collect, store, share and use your personal data. This document is intended to clarify the rights and duties of the personal data holders related to the rules for the data processing that include, for example, the operations of collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction of data collected from USERS, in addition to the recording of its activities, in accordance with applicable laws. WHEN THE USER ACCEPTS THIS PRIVACY POLICY, HE EXPRESSES HIS/HER FREE AND EXPRESS AGREEMENT WITH THE TERMS STIPULATED HEREIN. Our site may from time to time contain links to and from the websites of our partner, advertiser and affiliate networks. If you follow a link to any of these sites, you should note that these sites have their own privacy policies and that we have no responsibility for those policies. By using the eNor Securities Platform the user expressly guarantees that he/she is fully capable (over 18 years without any legal impediment), to exercise and enjoy all services. IMPORTANT DEFINITIONS For the purposes of this document, the following definitions and descriptions should be considered for your best understanding: USER: person who accesses or interacts with the functionalities offered by the websites, applications and services offered by eNor Securities. The USER must have legal capacity to accept and consent to this PRIVACY POLICY and other documents of the organization. ACCOUNT: is the way in which the USER is represented when accessing the functionalities of the website, applications and services offered by eNor Securities, usually corresponding to a set of data that represents the USER (such as registration data) and other relevant data to ensure a more appropriate and complete relationship between eNor Securities and the USER. COOKIES: small files or data packs sent by eNor Securities to the USER’s device to identify and collect information that will help eNor Securities improve the services provided to the USER. PERSONAL DATA: information related to identified or identifiable natural person. They may include, for example, name, address, email, telephone number, identification number, debit/credit card number, IP address, proof of residence and income. RESPONSIBLE: natural or legal person appointed by eNor Securities responsible for acting as a communication channel between the controller, the data subjects and the National Data Protection Authorities. CONTROLLER: natural or legal person, under public or private law, to whom decisions concerning the processing of personal data are responsible. DATABASE: Structured set of personal data located in one or more locations, in electronic or physical support. CONSENT: it is the free, informed and unambiguous manifestation by which the USER agrees to the use of his/her personal data. PAYMENT GATEWAY: It is the company that provides a consistent service in the connection between the platforms of sale of products, with acquirers, Sub-Acquirers, Flags or Intermediaries, in order to enhance and ensure security in the relationships between “users buyers” and “selling users”. PAYMENT GATEWAY USER: individuals or legal entities registered and using the payment gateway. DATA COLLECTION INFORMATION 1.1 WHAT TYPES OF INFORMATION DO WE COLLECT? Personal DATA will be collected when voluntarily entered or submitted by the USER on the website, applications and services offered by eNor Securities, such as ACCOUNT creation, navigation, interaction with content and acquisition of services. Personal Data that is submitted in an automated manner and without the need for any action by the USER, such as through Cookies or partners who have obtained authorization to share personal data with eNor Securities, will also be collected. eNor Securities treats users’ PERSONAL DATA as necessary to comply with their legal and contractual obligations, operate businesses, provide the products and services that USERS use. The legal basis that legitimizes the processing of personal data will be the consent given when registering and registering on the platform, expressly accepting these provisions. INFORMATION AND CONTENT YOU PROVIDE We collect the content, communications, and other information you provide when you register to create an account: full name, user documentary identification number, date of birth, email address, phone number. INFORMATION ABOUT TRANSACTIONS MADE ON OUR PAYMENT GATEWAY If you use our payment gateway for purchases or other financial transactions, we collect account or transaction information. This includes payment information; other account and authentication information; billing and contact details. ACCESS LOG INFORMATION We collect information from and about the computers, phones, and other web-connected devices you use when accessing our platform that integrate sits with our payment gateway and combine that information from the different devices you use. The information we obtain from these devices includes: Device attributes: Information such as operating system, hardware and software versions, battery level, signal strength, available storage space, browser type, file and application names and types, and plugins. Network and connections: Information such as the name of your mobile operator or internet service provider, language, time zone, mobile number, IP address, connection speed. Device signals: Bluetooth signals and information about nearby Wi-Fi hotspots, beacons, and cell towers. Device configuration data: Information that you allow us to receive through the device settings you activate, such as access to your GPS location, camera, or photos. 1.2 HOW DO WE USE THIS INFORMATION? Creation of access/login to devices: personal data collected when creating your account will be used for your identification and authentication of use in our services. This way, you can use the same account information to connect from any location or device. Improve our products and services: your personal data will be used to build a profile about you, understand the way you use our products and services, develop new products and services that are more interesting and relevant, as well as customize the products and services we have already offered you. Process your order: You use the relevant personal data described above to process, deliver and report on the status of your operations. Perform checks: We will also use your personal data to assess your suitability and prevent fraud. In Customer Service: if you contact our Service Channels, we will use personal data to process your request and offer the best possible service/solution. For marketing actions: When you sign up to receive eNor Securities’ newsletters or Insight s service, create an account, request or provide feedback about an online product or service, or use our website, we will use your personal data to create a profile based on the information we have about you. We create your profile according to your preferences to offer the best personalized experience and send personalized marketing messages and newsletters, as well as for opinion research. In order to achieve these objectives, eNor Securities uses your personal data in accordance with how you interact with our brand through all the different channels described above and the information we collect in this regard, through each of these channels, relate so much about your interests and preferences. This perception allows us to offer the best possible experience. If you have allowed us to send marketing communications, we will use the information you have provided, when interacting with us, to send messages of this nature, but in a personalized way, about the products or services, discounts, gifts, events, and commercial promotions conducted by eNor Securities. In some circumstances, we will also combine your personal information with those from other individuals to create comprehensive reports on how customers use our products and services and experience our brand, but for statistical reasons we will use your personal data anonymously. In addition, we will send direct marketing communications through the channel you choose and authorize, such as email, telephone, or social networks. As we mentioned, the messages we forward will be customized and customized according to your individual preferences and interests. We use analytical data to generate these custom messages. These direct marketing messages may contain information about eNor Securities products and services, events, giveaways or promotions and news. We will also use, under certain circumstances, channels for opinion polls (to ask if you would like to participate in a survey), as well as to learn more about your experience. Redirection: Our sites use redirect technologies. This guarantees us to show our visitors, who have already shown interest in our store and our products and/or services, our advertisements on other sites. We believe that serving personalized, interest-based ads is more interesting and relevant to our customers than ad serving that has no personal connection. Redirect technologies analyze the information we collect about your interactions, as described above, regarding marketing actions, including your cookies, and display ads based on your prior web browsing behavior. Enriching our data: By obtaining your information from a variety of sources, we combine this information, in some circumstances, to enrich our understanding of your preferences regarding our products and services, in order to improve your experience by sending you personalized marketing or preparing more effective marketing campaigns. Improvement of our products and services: we use the personal data we hold about you (as well as the pseudonymous or anonymous information generated by your personal information) to perform our analysis and research, including: science or data analysis, in which we combine information (such as personal and/or sensitive information obtained from the use of a Training application or your browsing history, navigation for example) that we maintain on a large scale, with the aim of learning more about our customers and their preferences, identifying their patterns and trends, enhancing the user experience on our websites, providing information, content and offers tailored to needs in an individualized manner, generic research and statistical purposes, or even for the purposes of aggregate eNor Securities group reporting. It can also help us develop new products and services, monitor their performance and/or improve our technology. Website: the personal data collected via our website will be used to allow us to evaluate browsing behaviors on our website, understand where we can improve, optimize our products and services, as well as to personalize and enhance your experience on our site. Performance Analysis: We will use your personal data (including via anonymity and aggregation with other customers’ personal information) for sales, supply chain and financial analysis purposes to determine how eNor Securities is performing, where improvements can be made and, where necessary, inform our parent company or group affiliates. We will ask for your permission if we wish to use your personal data for purposes other than those mentioned in this Privacy Policy. 1.3 IS YOUR INFORMATION SHARED? eNor Securities operates with payment automation routines and financial transactions, so it can work together with other companies to provide the services properly. Sharing personal data can involve companies such as payment processors, fraud prevention agents, and agencies. Your information is shared with others as follows: Service providers and providers: We work with external partners who help us deliver and improve our payment gateway. We emphasize that we impose strong restrictions on how our partners can use and disclose the data we provide. We provide information and content to suppliers and service providers that enable the operation of our business, whether providing technical infrastructure services, analyzing how our platform is used, providing customer service, facilitating payments or conducting surveys. Law enforcement or legal requests: eNor Securities may also share your information with law enforcement or judicial authorities, competent public authorities or other third parties, inside and outside the country in which you reside, if required by applicable law, court decision and request of authorities, or if necessary to respond to legal proceedings or to participate in any disputes or disputes of any nature. With companies of the eNor Securities Group: We can share the data we collect with the companies of the Economic Group to which eNor Securities belongs. The same guarantees and care that eNor Securities has with your data will be replicated by the companies of the eNor Securities Group. The data sharing with companies of the eNor Securities Group will have the following purposes: development of new products and services, offer of products and services that best meet their interests, generation of statistical and aggregate data about the use of our products and services and user profiles. 1.4 DO WE TRANSFER YOUR DATA TO OTHER COUNTRIES? We may do international data transfers to other countries in order to carry out some activities involved in the services provided to you, as well as to obtain information that may contribute to the improvement of our services. In any case of sharing with partners located in other countries, we have found that the partner is hereby denied that the data protection and information security standard is compatible with this privacy policy, so that your data is always protected in these terms. HOW DO WE PROTECT YOUR INFORMATION? eNor Securities employs its best efforts to respect and protect your personal information from loss, theft or any form of misuse, as well as against unauthorized access, disclosure, alteration and destruction. We only process your data through a high degree of security, implementing the best practices in use in the industry for data protection, such as encryption techniques, monitoring and periodic security testing. However, it is not possible to fully guarantee the non-occurrence of interceptions and breaches of eNor Securities’ systems and database, since the internet has its security structure in permanent improvement. HOW LONG IS THE INFORMATION STORED? eNor Securities stores your information for the period necessary for the purposes set out in eNor Securities’ Terms and Conditions of Use and this Privacy Policy, respecting the data retention period determined by applicable law. If you request deletion of your account, your personal information provided to eNor Securities during the use of our services will be permanently deleted from the legislation required. In some cases, we may retain your information even if you delete your account, such as in the mandatory records required to be kept in applicable law, if there is an unresolved issue related to your account (such as an unresolved claim or dispute), or if it is necessary for our legitimate business interests, such as fraud prevention and improving the security of our users. WHAT ARE YOUR RIGHTS WITH RESPECT TO YOUR PERSONAL DATA? The holder of the personal data is entitled to obtain from the controller, in relation to the data of the data subject, processed by him, at any time and upon request: Right to access: the right of the holder to obtain from the controller the confirmation of the processing of his/her data and, in addition, to request access to his/her personal information. Right to rectification: the right of the holder to ensure that his/her personal data is accurate and up to date as necessary. Right to exclusion or forgetfulness: the right of the holder to request the controller to delete his personal data without undue delay. Right to opposition and restriction of processing: the right of the holder to oppose the processing of his data and even restrict them if he so wishes. Right to data portability: the right of the holder to obtain his information in a structured and machine-readable format or to have his data transferred to another organization if possible. Right to information: the right of the holder to be informed about how and why their personal data is being processed. Right to notification: in the event of a data breach, the data subjects must be informed within 72 hours of the knowledge of the breach. Please contact the eNor Securities data protection officer if you have any questions about how we process your personal data or wish to exercise any of your rights in relation to your personal data. The contact of the person in charge is the support address support@enorsecurities.com If, despite eNor Securities’s commitment and efforts to protect your personal data, you find that your data privacy rights have been violated, we advise you to first seek eNor Securities in order to resolve any issue. 5. UPDATING THIS POLICY eNor Securities may change, at any time this Privacy Policy, due to changes /updates on its platform or the technologies associated with it, as well as, whenever it deems necessary, in order to improve and improve the services provided. If there are updates in this document, eNor Securities will notify the USER through the tools available on the websites, applications and services provided and/or means of contact provided by the USER. The USER will be linked with the new we have of this document from the delivery of the notification about the updates. The new Privacy Policy will take effect 10 (ten) days after its publication on the site. Within 5 (five) days from the publication of the new version, the USER must communicate by e-mail if he does not agree to the amended terms. In this case, the contractual bond will cease to exist, provided that there are no accounts or outstanding debts. If there is no manifestation within the stipulated period, it will be understood that the USER has accepted the new terms of the Privacy Policy and the contract will continue to bind the parties. 6. HOW TO CONTACT US If you have any questions or concerns regarding eNor Securities Privacy Policy or any practice described herein, please contact us via the “CONTACT” tab on the eNor Securities website. In order for your request to be properly reviewed by us, it must contain at least the following information: Full name; Type and number of identifications document; Contact phone; e-mail (the same used in the Registration of eNor Securities) description of the doubt or reasons for any request. Date of last review: July 5, 2023.