Personal Data Processing and Protection Policy

Fundders AI Assistant

Version 1.0 · Effective September 2, 2026

Governing language. This policy is published in Spanish and English. The Spanish version is the sole governing version. In the event of any discrepancy, contradiction or question of interpretation between the two, the Spanish text prevails. The English version is provided as a courtesy translation only. The Spanish text is available at /legal/politica-datos-chat-ia.

This policy explains what data we collect when you talk to our AI Assistant, what we use it for, who we share it with, how long we keep it and how you can exercise your rights.

It is written to be understood. If anything is unclear, write to us at ai@fundders.com.

1. Data controller

Fundders S.A.S. NIT 901.373.509-5 Address: Carrera 54C # 143A-90, Bogotá, Colombia Email for personal data matters: ai@fundders.com Phone: +57 317 515 0019

2. Legal framework

This policy is issued in compliance with:

• Law 1581 of 2012, Colombia's general personal data protection regime.
• Decree 1074 of 2015, in relation to Decree 1377 of 2013.
• Law 2300 of 2023, on commercial contact.
• The principles of legality, purpose, freedom, truthfulness, transparency, restricted access, security and confidentiality.

If you are located outside Colombia, see section 16.

3. Scope

This policy applies exclusively to the AI Assistant available at fundders.com/diagnostico and to the data collected through it.

The "Línea Base" diagnostic has its own policy, available at /en/legal/privacy-policy-linea-base. Other Fundders surfaces (contact forms, newsletters, partner portal) are governed by the Company's general policy.

4. The two moments of authorization

We want to make this explicit because it is not obvious.

The Assistant collects data at two distinct moments, under two distinct authorizations.

Authorization 1 · To have the conversation

When: before you send your first message. How: by checking the acceptance box shown when the conversation starts. What it authorizes: that Fundders stores and processes the content of the conversation, together with the session's technical data, in order to operate the Assistant, generate its responses and understand your need. What it does NOT authorize: that we contact you.

If you accept this first authorization and then leave the conversation without giving the second, we retain the conversation under the retention periods in section 12, but we do not contact you, because at that point we normally have neither your identity nor your authorization to do so.

Authorization 2 · To contact you

When: at the point where the Assistant asks for your name, email and phone number. How: through an affirmative and unambiguous action on your part, separate from the previous one. What it authorizes: that Fundders associates your identity with the conversation, contacts you through the channels you provided, and conducts commercial follow-up.

Both authorizations are revocable at any time. See section 14.

We record proof of each authorization, including the exact timestamp, the version of the text you accepted and the session identifier, as required by article 2.2.2.25.2.4 of Decree 1074 of 2015.

5. What data we collect

5.1 Identification data

Requested at the moment of Authorization 2.

5.2 Business context data

Collected during the conversation, based on what you describe.

This data is primarily business information, not personal data. However, once associated with your identity, it receives the same treatment and the same protection as your personal data.

5.3 Technical and traceability data

Collected automatically.

On the full conversation: we store everything you write, not only the structured data we extract. If you write something in the chat, it is stored. That is why the Terms ask you not to share credentials, sensitive data or third-party confidential information.

On the IP address: we apply a salted hash function before storing it. This lets us detect abuse and duplicate sessions without retaining a network identifier directly attributable to you.

5.4 Data we generate

You do not supply this data. Fundders produces it from the conversation. We disclose it because it is also your data and you have the right to know it.

5.5 If you schedule a session

If at the end of the conversation you decide to schedule a session with the team, we additionally process:

• The date and time you selected.
• An event created in Google Calendar, in which your email address is recorded as a guest.
• A Google Meet link associated with that event.

This means your email is shared with Google as calendar infrastructure provider, and is visible to the Fundders team members invited to the event. See section 10.

5.6 Data we do not collect

We neither request nor want:

• Sensitive data: health, ethnic or racial origin, sexual orientation, political or religious beliefs, union membership, biometric data.
• Data relating to minors.
• Personal financial data, card numbers or bank accounts.
• Access credentials of any kind.

If we detect that you entered any of this data, we proceed under section 7.

6. What we use your data for

We process your data solely for the following purposes:

Service operation

1. Generate the Assistant's responses and maintain the conversation thread.
2. Understand your need and guide you on whether Fundders can help.

Commercial management, only with Authorization 2 3. Contact you through the means you provided, in connection with your inquiry. 4. Prepare a proposal or a working session. 5. Schedule and manage meetings. 6. Track the commercial opportunity in our internal systems.

Service improvement 7. Analyze conversations to improve the Assistant's quality, correct errors and adjust its behavior. 8. Produce aggregate statistics on inquiry types, sectors and needs.

Compliance and security 9. Retain proof of your authorizations. 10. Detect and prevent abuse, fraud or automated use of the service. 11. Respond to requirements from competent authorities.

We do not use your data to: sell it, transfer it to third parties for those third parties' own commercial purposes, third-party advertising, or train external providers' artificial intelligence models. See section 10.

7. Third-party data and data that should not have been shared

7.1 When you mention other people

In describing your situation you will likely mention people: a manager, a team, a supplier, a customer. We do not ask for this, but it happens naturally.

When it does:

• We treat that data with the same level of protection as yours.
• We do not use it to contact those people.
• We do not build profiles about them.
• We do not add them to our commercial databases.
• We retain it only within the conversation record, under the periods in section 12.

You are responsible for having the authorization or legal basis to share that data, under the Terms and Conditions.

7.2 When something arrives that should not have

If you share sensitive data, data relating to minors, credentials or information the Terms expressly exclude:

1. We do not process it for any of the purposes in section 6.
2. We delete or mask it from the conversation record as soon as we detect it, through automated review and human review.
3. If it involves credentials, we inform you through the available channel so you can rotate them immediately.
4. We record the deletion, without retaining the deleted data.

This detection is a reasonable effort, not an absolute guarantee. The safest way to protect that information is not to enter it.

8. Automated evaluation and profiling

We want to be explicit about this because it happens in the background and is not visible in the interface.

8.1 What we do

An automated system analyzes your conversation and produces:

• A qualification score for your case.
• A criteria-based assessment, which includes verbatim quotes of what you wrote.
• A classification of the customer type your organization represents.
• A routing decision on how Fundders follows up on your case.

8.2 What effect it has

This evaluation produces no legal effects on you. It does not determine access to a contracted product or service, it does not affect economic conditions, it is not shared with third parties and it generates no consequences outside the commercial relationship with Fundders. Its only effect is to organize our internal follow-up and decide with what priority and through which path we respond to you.

8.3 This information is not disclosed within the conversation

We want this to be unambiguous:

• The score and the assessment are never displayed at any point during the conversation.
• The Assistant will not reveal them if you ask for them in the chat. It is not designed to do so and this is not the appropriate channel to deliver them.
• They also do not appear in any email, report or automated commercial communication.

The reason is that this is an internal prioritization tool, calibrated for our commercial process and expressed in language that only makes sense within it. Delivering it without context, in the middle of a conversation, would be more confusing than useful and could lead you to mistaken conclusions about your own case.

The fact that it is not disclosed in the conversation does not mean you have no right to know it. You do.

8.4 How to request it, and what you receive

You may ask us at any time to provide this information, and we will provide it.

How: write to ai@fundders.com indicating the email or phone number you used with the Assistant, or the approximate date of the conversation, and expressly request to know your evaluation.

What we provide:

1. The qualification score assigned.
2. The criteria evaluated and the result for each.
3. The verbatim quotes from your conversation that supported each criterion.
4. The inferred customer profile.
5. The routing decision taken.
6. A plain-language explanation of what each of these elements means.

Timeframe: maximum 10 business days, under section 14. Free of charge.

8.5 Your other rights regarding the evaluation

• Correction. You may request correction of the information supporting it. If the correction is warranted, the evaluation is recalculated.
• Review of the evaluation. If you believe the evaluation does not reflect your situation, you may request that a member of the Fundders team review the result and the quotes supporting it. We respond with the conclusion of that review, which may be the correction or the deletion of the evaluation.
• Deletion. You may request deletion of the derived evaluation, with or without the rest of your data.
• Revocation. You may revoke your authorization, upon which we cease all processing, including the evaluation, and delete your data under section 14.

8.6 The automated evaluation is not separable from the service

The Assistant is a free service, and it is free because it operates in a fully automated manner end to end. The evaluation described in this section is part of how the system works, not an additional module that can be switched off for a particular user.

For that reason, Fundders does not offer a free version of the Assistant without automated evaluation, and cannot replace it with a manual analysis of each case. Doing so would entail an operational burden that makes it unviable to provide the service at no cost.

This limitation applies only to the Assistant. It does not describe Fundders as a company: Fundders provides professional services that are not automated, contracted separately and governed by their own agreement.

If you do not wish to be subject to this processing, you have three paths, all available at any time:

1. Do not use the Assistant and contact us in writing. Write to ai@fundders.com stating that you wish to be attended without going through the Assistant. Your request will be handled by a member of the team. This channel is always open and does not depend on the Assistant.
2. Contract a professional service from Fundders. Fundders provides consulting and implementation services that do not depend on this Assistant or its automated evaluation. These are paid services, governed by a separate contract, with scope agreed case by case.
3. Revoke your authorization. We cease processing and delete your data under section 14.

9. Data processors

We share your data with the following types of providers, which act as Processors and may only process it following our instructions:

With each of them we have agreements requiring confidentiality, security measures and processing limited to our instructions.

On model training: we use language model services under contractual conditions in which the content sent is not used to train or improve the provider's models. We verify this condition upon contracting and upon any change of provider.

This list is kept up to date. If it changes, we update this policy.

10. International transfers

Your data is stored and processed outside Colombia, mainly in the United States, by the providers listed in section 9.

The United States has not been declared by the Colombian Superintendence of Industry and Commerce (SIC) as a country with an adequate level of protection. Accordingly, this transfer is carried out on the basis of article 26, literal a) of Law 1581 of 2012: your express and unambiguous authorization.

By accepting this policy you expressly authorize the international transfer and transmission of your data to the providers mentioned, for the purposes in section 6.

In addition, we require each provider to give contractual guarantees of confidentiality and security equivalent to those we apply ourselves.

If you do not want your data transferred internationally, we cannot provide you with this service. You may contact us by email at ai@fundders.com as an alternative.

11. Security

We apply reasonable technical, human and administrative measures to protect your data:

• Encryption in transit, via TLS, on all communications.
• Encryption at rest in the database.
• Salted hashing of the IP address.
• Role-based access control. Only staff who need to see a conversation can see it.
• Access logging for identification data.
• Confidentiality agreements with all personnel and with providers.
• Periodic review of permissions and dependencies.

No security measure is infallible. If an incident occurs that compromises your data, we will inform you and report it to the Superintendence of Industry and Commerce in accordance with applicable regulations.

12. How long we keep your data

The periods differ depending on the type of data and on what happened with your conversation.

Once the period expires, data is deleted or irreversibly anonymized.

If you revoke your authorization or request deletion, we proceed ahead of these periods, unless a legal or contractual retention duty exists. In that case we inform you and block the data from any other use.

13. Your rights

As the data subject you have the right to:

1. Know what data of yours we hold, free of charge.
2. Update and rectify inaccurate, incomplete or outdated data.
3. Request proof of the authorization you granted.
4. Be informed about the use we have made of your data.
5. File complaints with the Superintendence of Industry and Commerce for breaches of Law 1581 of 2012, after exhausting the query or claim procedure with us.
6. Revoke your authorization and request deletion of your data, where no legal or contractual retention duty exists.
7. Access your data free of charge.
8. Request review of the automated evaluation associated with your conversation, under section 8.

14. How to exercise your rights

Single channel: ai@fundders.com

Include in your message:

• Your full name.
• The email or phone number you used with the Assistant.
• A description of what you are requesting.
• A document evidencing your identity, or that of your representative if you act through one.

Response timeframes:

• Queries: maximum 10 business days. If not possible, we inform you of the reasons and respond within the 5 business days following expiry.
• Claims: maximum 15 business days from the day after receipt. If not possible, we inform you of the reasons and respond within the 8 business days following expiry.
• If the claim is incomplete, we tell you within the following 5 days so you can complete it. If you do not do so within 2 months, it is deemed withdrawn.

Revoking the contact authorization: you may also do this by replying to any of our communications, or using the unsubscribe link in our emails. It takes effect within a maximum of 5 business days.

About this channel: requests received at ai@fundders.com may be triaged and prepared with the support of automated systems. However, every decision on a data subject request, including the delivery of information, correction, deletion and revocation, is reviewed and approved by a member of Fundders' Artificial Intelligence Team before being executed. No habeas data request is resolved in a fully automated manner.

15. Minors

The Assistant is not directed at minors and we do not knowingly collect their data. If we detect that a minor has entered personal data, we delete it. If you believe a minor under your responsibility entered data, write to us at ai@fundders.com.

16. Data subjects outside Colombia

Fundders operates in Latin America and the United States. If you are located outside Colombia:

• We apply the standard described in this policy to all data subjects, regardless of origin.
• If the law of your jurisdiction grants you additional rights, you may exercise them through the same channel, and we will address them to the extent applicable.
• By using the Assistant, you understand that your data will be processed in Colombia and in the United States.

17. National Database Registry

Fundders registers its databases in the National Database Registry (RNBD) of the Superintendence of Industry and Commerce, when and to the extent this is required under the criteria in force.

18. Term and changes

This policy is effective from September 2, 2026 and remains in force for as long as Fundders processes personal data through the Assistant.

We may update it. The version in force will always be the one published on this page, with its version number and date visible. Material changes, in particular those expanding the purposes or the recipients, will be communicated at least 10 calendar days in advance to data subjects whose email address we hold, and announced on the site.

Language. This policy is published in Spanish and English. The Spanish version is the sole governing version. In the event of any discrepancy, contradiction or question of interpretation between the two versions, the Spanish text prevails. The English version is provided as a courtesy translation only.

19. Contact

Fundders S.A.S. NIT 901.373.509-5 Carrera 54C # 143A-90, Bogotá, Colombia

Single contact and data subject channel: ai@fundders.com Phone: +57 317 515 0019

Area responsible for handling data subject requests: Artificial Intelligence Team

Document updated September 2, 2026. Version 1.0. Courtesy translation of the Spanish original.