Last updated: July 9, 2025

MUTA S.A.S. (hereinafter, “MUTA” or “the Company”), as a provider of Software as a Service (SaaS) solutions, informs users of its commitment to privacy and the protection of personal data in accordance with national and international regulations in force on this matter.

1. Data Controller
MUTA S.A.S.
Cra. 53 #3-05, Galapa, Atlántico
Colombia

2. Personal Data Collected
MUTA collects and processes the following types of personal data:

• Identification data: full name, email address, phone number.
• Professional data: job title, company, industry sector.
• Technical data: IP address, browser type, operating system.
• Usage data: platform activity, navigation behavior, login frequency.

3. Purpose of Processing
Personal data is collected and used for the following purposes:

• Provision of the contracted services.
• Account management and maintenance.
• Customer support and technical assistance.
• Sending commercial information and updates, with the user’s prior consent.
• Compliance with legal and regulatory obligations.
• Continuous improvement and statistical analysis of the platform.

4. Legal Basis for Processing
The processing of personal data is based on:

• The performance of a service agreement.
• The express consent of the data subject.
• Compliance with legal obligations.
• MUTA’s legitimate interest in improving services and preventing fraud.

5. Data Recipients and Transfers
MUTA may share personal data with:

• Technology service providers necessary for the platform’s operation (sub-processors).
• Administrative or judicial authorities, when required by law.

In the case of international data transfers, MUTA commits to implementing appropriate safeguards to ensure an adequate level of protection, such as the use of standard contractual clauses or other mechanisms recognized by applicable law.

6. Data Retention
Personal data will be stored for as long as necessary to fulfill the purpose for which it was collected or while a contractual relationship exists. Once this period ends, data will be retained only for the time required by applicable law or until the data subject exercises their right to erasure.

7. Data Subject Rights
Data subjects have the right to:

• Access their personal data.
• Request the rectification of inaccurate data.
• Request the deletion of data when it is no longer needed or when consent is withdrawn.
• Request the restriction of data processing.
• Object to the processing of their data.
• Request the portability of their data to another controller.

To exercise these rights, users may send a request to the following address: Cra. 53 #3-05, Galapa, Atlántico, Colombia.

8. Right to Erasure and Data Deletion Strategy
MUTA recognizes the user’s right to request full deletion of their personal data. Once the formal request is received and the identity of the data subject is verified, MUTA will remove the data from all systems, including backups, within a maximum of 30 business days, unless legal obligations prevent immediate deletion.

9. Information Security
MUTA has implemented appropriate technical, administrative, and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. These measures are reviewed periodically to ensure their effectiveness.

PERSONAL DATA PROCESSING POLICY

MUTA S.A.S., in compliance with the principles of legality, transparency, security, and confidentiality, informs users about the criteria applied to the processing of personal data within the scope of its business activities.

1. Purpose of Processing
Personal data collected will be processed for the following purposes:

• Execution of SaaS service agreements signed with clients.
• Handling requests, claims, or inquiries submitted by users.
• Accounting, tax, legal, and administrative management of commercial relationships.
• Evaluation and continuous improvement of the services provided through the platform.

2. Guiding Principles
MUTA processes personal data based on the following principles:

• Lawfulness and transparency: Data is processed lawfully and transparently for the data subject.
• Specific purpose: Data is processed only for the informed purposes.
• Data minimization: Only strictly necessary data is collected.
• Accuracy: Measures are taken to keep data accurate and up to date.
• Security: Adequate protection is provided against risks.
• Storage limitation: Data is retained only as long as necessary.

3. Consent Collection
User consent is considered granted through the checking of acceptance boxes in forms, service subscriptions, contract signatures, or any other mechanism that allows a free, prior, informed, and unambiguous expression of will.

4. Channels for Exercising Rights
Any request regarding the exercise of access, rectification, erasure, objection, restriction, portability, or deletion rights may be submitted in writing to the following address:

Cra. 53 #3-05, Galapa, Atlántico, Colombia

The request must include at least the full name of the data subject, a clear description of the right they wish to exercise, and a copy of their ID document or equivalent verification method.