1. DATA CONTROLLER

ORG Auditores Independientes, S.A. (hereinafter "ORG" or the "Firm") is the data controller responsible for personal data collected through its website, electronic forms, and other digital channels managed by ORG.

ORG recognizes the importance of protecting the privacy and personal data of individuals who use its digital channels and is committed to processing such information in accordance with the laws of the Republic of Panama, particularly Law No. 81 of March 26, 2019 on Personal Data Protection and its implementing regulations under Executive Decree No. 285 of May 28, 2021, as well as all other applicable provisions and regulatory criteria.

2. WHAT PERSONAL DATA MAY WE COLLECT?

When you use our website, complete a form, request information, or communicate with ORG through digital channels, we may collect information that you voluntarily provide, including, as applicable:

• First and last name.

• Contact details.

• Telephone number.

• Email address.

• Professional or employment information.

• Information about your company or business activities.

• Information voluntarily included in messages, inquiries, requests, or documents sent to ORG.

ORG seeks to collect only personal data that is adequate, relevant, and necessary for the stated purposes.

3. HOW DO WE USE YOUR DATA?

Personal data collected through our website and digital channels may be used to:

• Respond to inquiries and requests for information.

• Contact you

• Follow up on business or professional requests.

• Provide information about ORG's services.

• Prepare proposals or quotations upon request.

• Manage requests relating to our services.

• Maintain professional or business communications.

• Comply with legal or regulatory obligations, as applicable.

• Protect the security of our systems and digital channels.

• Prevent unauthorized access or use.

• Fulfill other purposes disclosed to the data subject that are directly related to ORG's legitimate activities.

ORG will not use personal data for purposes incompatible with those for which it was collected.

4. LEGAL BASIS FOR PROCESSING

Personal data may be processed, as applicable, on the basis of the data subject's consent; the performance of a contractual or pre-contractual relationship; compliance with legal obligations or requests from competent authorities; the protection of rights and legitimate interests, where applicable; and other lawful bases recognized under applicable law.

Where processing requires consent, consent will be requested through the appropriate mechanism.

5. CONFIDENTIALITY

ORG recognizes that, due to the nature of its professional services, it may have access to personal and confidential information.

Personal data collected through the website will be processed only by individuals who require access to perform their duties and will be subject to the applicable confidentiality obligations.

6. INFORMATION SECURITY

ORG will implement reasonable and appropriate administrative, technical, and organizational measures designed to protect the personal data under its responsibility.

These measures may include access controls, individual credentials, role-based access restrictions, protection of equipment and systems, permission management, controls over the sending and receiving of information, and procedures for managing security incidents.

7. DISCLOSURE OR TRANSFER OF DATA

ORG may disclose or transfer personal data where necessary to:

• Comply with legal obligations.

• Respond to requests from competent authorities.

• Perform requested or contracted services.

• Fulfill contractual obligations.

• Engage service providers or data processors.

• Protect rights or legitimate interests.

• Fulfill other purposes permitted by applicable law.

Where applicable, ORG will seek to establish appropriate data-processing, confidentiality, and security obligations with third parties.

8. DATA RETENTION

ORG will retain personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable contractual, legal, or regulatory obligations.

The retention period may be extended where necessary to respond to requests from authorities, retain evidence of professional services, resolve disputes or claims, exercise or defend legal rights, or comply with document-retention obligations.

At the end of the applicable retention period, ORG will seek to securely delete, anonymize, or otherwise dispose of the data, as appropriate.

9. DATA SUBJECT RIGHTS

Under applicable Panamanian law, data subjects may exercise the rights recognized by Law No. 81 of 2019 and its implementing regulations, including, as applicable:

• Access: to obtain information about the personal data being processed.

• Rectification: to request the correction of inaccurate or incomplete data.

• Cancellation (erasure): to request deletion of personal data, where applicable.

• Objection: to object to processing in the circumstances permitted by law.

The exercise of these rights is subject to the conditions, exceptions, and procedures established by applicable law.

10. HOW CAN YOU EXERCISE YOUR RIGHTS?

Data subjects may submit requests concerning their personal data through ORG's designated contact channels.

A request must contain sufficient information to identify the data subject and enable ORG to reasonably determine the information or processing to which it relates. ORG may request additional information where necessary to verify the requester's identity or properly process the request.

Requests will be handled within the time limits and subject to the conditions established by applicable law.

Contact channel for personal data matters:

Data Controller: ORG Auditores Independientes, S.A.

Email: info@orgauditores.com.pa

Physical address: Avenida Balboa, Bayfront Tower, 1st Floor, Panama City, Panama.

11. DATA PROVIDED THROUGH FORMS

When you submit information through a form on our website, you should ensure that the information provided is truthful, accurate, and complete.

The data will be used for the purpose stated in the form and in accordance with this Privacy Notice and ORG's Privacy and Personal Data Protection Policy.

12. THIRD-PARTY LINKS AND SERVICES

ORG's website may contain links to, or use technology services provided by, third parties.

Where third parties have access to personal data in order to provide services to ORG, they must use that data solely for authorized purposes and in accordance with applicable obligations.

Third-party websites or services may have their own privacy policies, which we recommend reviewing where applicable.

13. UPDATES TO THIS NOTICE

ORG may amend or update this Privacy Notice as necessary to reflect changes in legislation, regulatory guidance, services, processes, technology, risks, or the Firm's internal controls.

The current version will be published on ORG's website.

Last updated: August 24, 2026.

14. CONSENT TO THE PROCESSING OF PERSONAL DATA

Where processing of your personal data requires consent, you must select the following checkbox before submitting a form:

☐ I have read the Privacy Notice of ORG Auditores Independientes, S.A. and freely, knowingly, and unequivocally consent to the processing of my personal data for the purposes described in this Notice and the corresponding form, in accordance with the company's Privacy and Personal Data Protection Policy.

☐ I would like to receive information, marketing communications, and updates about ORG's services. (Optional)

15. PRIVACY AND PERSONAL DATA PROTECTION POLICY

For more detailed information about the principles, procedures, security measures, responsibilities, retention, processing by third parties, transfers, incident management, and other provisions governing ORG's processing of personal data, please review the "Privacy and Personal Data Protection Policy" of ORG Auditores Independientes, S.A.

ORG Auditores Independientes, S.A.

Privacy Notice ORG Website