Privacy and Personal Data Protection Policy

1. Data controller

The controller responsible for processing your personal data is:

• Legal name: CEIBO DIGITAL S.A.
• Tax ID (CUIT): 30-71607716-7
• Address: Bouchard 680, 19th floor, CABA, Argentina. Postal code 1106.
• Privacy contact: data@ceibo.digital

The controller determines the purposes and means of processing and is the main point of contact for exercising your rights.

Group companies

Ceibo Digital operates alongside the following companies, which share commercial-management and communication tools and may access your data for the purposes described in this policy:

If this list changes, we will update this policy and publish the new version with its corresponding date.

2. What data we collect

Data you give us

When you complete a form, subscribe to our newsletter or content, register for an event, or contact our team, we may collect:

• First and last name
• Email address
• Company or organization and job title
• Phone number
• Country or city
• Any message or additional information you choose to share voluntarily

Our forms indicate which fields are required and which are optional. Required fields are the minimum we need in order to respond to you; if you do not complete them, we will not be able to process your inquiry or subscription. You can leave optional fields blank with no consequence.

Data generated by your interaction with us

We also record browsing and communication-interaction data —for example, pages visited, source of the visit, device, and opens and clicks in our emails— for statistical, measurement, and content-improvement purposes. Section 7 explains how cookies work and how you can disable them.

Data we do not request

We do not request sensitive data (racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, information regarding health or sexual life, within the meaning of Article 7 of Law No. 25.326). We ask that you not include such data in free-text fields. Should any be entered incidentally, we will delete it as soon as we detect it.

3. Why we use your data

About contact prioritization

Our marketing tools automatically assign an interest score to each contact based on their interaction with our content. This classification is used solely to decide which communications to send you and how often. It produces no legal effects on you, does not assess aspects of your personality, and does not determine the granting or denial of any service, credit, or benefit. You may object to this classification by writing to us at the address in Section 10.

We do not use your data for purposes other than those stated here.

4. Legal basis for processing

The processing of your data is based on the free, express, and informed consent you provide when completing a form or subscribing, in accordance with Article 5 of Law No. 25.326.

That consent is given by checking the specific box accompanying each form, which is always unchecked by default and independent of the form submission itself. We retain a record of the date, time, and exact text you accepted.

In addition, with respect to advertising and promotional communications, Article 27 of Law No. 25.326 permits the processing of data that you have provided yourself or that comes from unrestricted public sources.

Your consent is voluntary and you may revoke it at any time, without stating a reason and without retroactive effect, as explained in Section 10.

5. Who we share your data with

Group companies

Your personal data may be assigned to the companies listed in Section 1, for the same contact and communication purposes described in this policy. By giving your consent, you expressly accept this assignment, in accordance with Article 11 of Law No. 25.326. The assignee companies are subject to the same security and confidentiality obligations assumed by Ceibo Digital.

Providers that process data on our behalf

We engage technology providers that act as data processors, acting solely on our instructions and under contractual confidentiality and security obligations:

Unrelated third parties

Beyond the above, we do not sell, rent, or assign your data to third parties, except by legal obligation or at the request of a competent authority.

6. International data transfers

The providers mentioned in Section 5 have their headquarters or servers outside Argentina, primarily in Brazil (where our infrastructure is hosted) and in the United States of America, countries that have not been declared to provide an adequate level of personal data protection.

For these transfers to be lawful, we apply the safeguards provided by Article 12 of Law No. 25.326 and the AAIP's supplementary rules: model international-transfer contractual clauses for the provision of processing services and, where applicable, the provider's own binding corporate rules.

In addition, by giving your consent under Section 4, you expressly accept that your data be transferred to and stored in those countries for the purposes described herein.

You may request information about the safeguards applied by writing to the address in Section 10.

7. Cookies and tracking technologies

Our sites use cookies and similar technologies:

• Necessary cookies: enable the basic functioning of the site. They do not require consent.
• Analytics cookies: help us understand how the site is used (Google Analytics). They are activated only if you accept them.
• Marketing cookies: allow us to measure campaigns and personalize content. They are activated only if you accept them.

You can accept, reject, or configure them from the preferences panel that appears when you enter the site, and change your choice at any time through the "Cookie preferences" link available in the footer of our site. You can also block them from your browser settings.

Our emails include pixels that let us know whether the message was opened and whether you clicked any link. You can prevent this by disabling the automatic loading of images in your email client.

8. How long we keep your data

We keep your personal data only for as long as necessary to fulfill the purposes for which it was collected:

If you request the deletion of your data, we process the request within the timeframes indicated in Section 10, unless we must retain it due to a legal obligation or to demonstrate the exercise of your own rights (for example, the record of your opt-out, which we keep precisely so as not to contact you again).

9. Confidentiality and security

We treat your information with the same care and professionalism we apply to every project. Within our team and that of the group companies, only the people who need to for the purposes described access this data.

We apply reasonable technical and organizational measures to protect your information against unauthorized access, loss, alteration, or misuse —including profile-based access control, two-factor authentication in our tools, encryption in transit, and confidentiality agreements with our staff and providers— and we review these practices on an ongoing basis.

If a security incident occurs that affects your personal data and may pose a risk to your rights, we will notify you and inform the relevant supervisory authority without undue delay.

10. Your rights

As the data subject, you have the right to:

• Access your personal data free of charge, at intervals no shorter than six months, unless you demonstrate a legitimate interest.
• Rectify or update data that is inaccurate or outdated.
• Request the deletion of your data.
• Revoke your consent at any time, without retroactive effect.
• Object to receiving advertising communications and request the removal or blocking, in whole or in part, of your name from our database, in accordance with Article 27, subsection 3 of Law No. 25.326.

How to exercise them

Write to data@ceibo.digital indicating which right you wish to exercise. To protect your information, we may ask you to verify your identity. The process is free of charge.

Response timeframes

• Access requests: ten (10) calendar days from receipt of the request (Art. 14, subsec. 2, Law No. 25.326).
• Rectification, update, or deletion: five (5) business days from receipt of the claim (Art. 16, subsec. 2, Law No. 25.326).
• Opt-out from communications: immediately through the unsubscribe link included in each email, or within the above timeframes if you write to us.

If you believe we have not properly addressed your request, you may file a complaint with the supervisory authority of your country (see Section 13).

11. Minors

Our content, services, and communications are directed at people over 18 years of age in a professional context. We do not intentionally collect data from minors. If we become aware that we have received data from a minor without the corresponding authorization, we will delete it. If you are a parent or guardian and believe a minor in your care shared data with us, write to us and we will resolve it.

12. Changes to this policy

We may update this policy to reflect changes in our practices or in applicable regulations. We will publish the current version on our website, indicating the date of last update. When the changes are substantial and affect the purposes of processing, we will notify you by email and, where appropriate, request your consent again.

Previous versions are available upon request by writing to the address in Section 10.

13. Country-specific information

Argentina

Processing is governed by Law No. 25.326, its Regulatory Decree No. 1558/2001, and the AAIP's resolutions.

The data subject has the right to exercise the right of access to their data free of charge at intervals no shorter than six months, unless a legitimate interest is demonstrated, as established in Article 14, subsection 3 of Law No. 25.326.

THE AGENCY FOR ACCESS TO PUBLIC INFORMATION, in its capacity as the Supervisory Body of Law No. 25.326, has the authority to address the complaints and claims filed by those whose rights are affected by non-compliance with the applicable personal-data-protection regulations.

More information at www.argentina.gob.ar/aaip. Our database is registered in the National Registry of Personal Databases under number RL-2026-88121498-APN-DNPDP#AAIP.

Paraguay

If you reside in Paraguay, the processing of your data additionally complies with Personal Data Protection Law No. 7593/2025, which comes into full force in November 2027 and to which we have already been adapting our practices.

In addition to the rights in Section 10, you have the right to the portability of your data and to request the review of automated decisions. We will address your request within thirty (30) days. If you object to processing for direct-marketing purposes, we will cease within fifteen (15) business days.

The supervisory authority is the National Personal Data Protection Agency, under the MITIC.

Mexico

This document serves the function of a comprehensive privacy notice within the meaning of the Federal Law on the Protection of Personal Data Held by Private Parties published on March 20, 2025.

You may exercise your ARCO rights (Access, Rectification, Cancellation, and Objection), as well as revoke your consent and limit the use or disclosure of your data, by writing to data@ceibo.digital. We will respond within a maximum of twenty (20) business days and, if applicable, give effect to your request within the following fifteen (15) business days.

The transfers described in Sections 5 and 6 require your consent; you may object to them through the same channel. The competent authority is the Anti-Corruption and Good Governance Secretariat, before which you may file a request for the protection of rights.

United States

Our commercial communications comply with the CAN-SPAM Act: we clearly identify the sender, do not use deceptive subject lines, include our physical postal address in every send, and process opt-out requests within ten (10) business days.

We do not sell personal data or share it for cross-context behavioral advertising. If you reside in a state with comprehensive privacy legislation and wish to exercise the rights that legislation grants you, write to us at data@ceibo.digital and we will address your request.

14. Contact

If you have questions about this policy or about how we handle your information, write to us at data@ceibo.digital. We are here to help.

CEIBO DIGITAL SA · Bouchard 680, 19th floor, CABA, PC 1106 · Buenos Aires, Argentina