Personal Data Processing and Protection Policy

Línea Base

Version 1.0 · Effective September 2, 2026

Governing language. This policy is published in Spanish and English. The Spanish version is the sole governing version. In the event of any discrepancy, contradiction or question of interpretation between the two, the Spanish text prevails. The English version is provided as a courtesy translation only. The Spanish text is available at /legal/politica-datos-linea-base.

Línea Base collects two very different things: a small amount of your personal data, and a detailed description of how a process in your company operates. The second category is the most sensitive in the entire system, even though technically it is not personal data. This policy treats both with the same rigor.

If anything is unclear, write to us at ai@fundders.com.

1. Data controller

Fundders S.A.S. NIT 901.373.509-5 Address: Carrera 54C # 143A-90, Bogotá, Colombia Email for personal data matters: ai@fundders.com Phone: +57 317 515 0019

2. Legal framework

• Law 1581 of 2012, Colombia's general personal data protection regime.
• Decree 1074 of 2015, in relation to Decree 1377 of 2013.
• Law 2300 of 2023, on commercial contact.
• The principles of legality, purpose, freedom, truthfulness, transparency, restricted access, security and confidentiality.

If you are located outside Colombia, see section 22.

3. Scope

This policy applies exclusively to the Línea Base diagnostic, available at fundders.com/linea-base.

The AI Assistant at fundders.com/diagnostico has its own policy, available at /en/legal/privacy-policy-ai-chat.

4. The two moments of authorization

Línea Base collects information before knowing who you are.

Moment 1 · When starting the diagnostic

What it authorizes: that Fundders stores and processes the operational information you describe, the files you upload, the conversations with the agents and the session's technical data, in order to generate the diagnostic.

At this moment the session is anonymous. We do not have your name, your email or your phone number. There is a random session identifier not associated with any person.

What it does NOT authorize: that we contact you, because we could not.

Moment 2 · At the identification stage, before the report is generated

What it authorizes: that Fundders associates your identity with the session, sends you the report, and contacts you commercially.

When this second authorization occurs, all the operational information collected in Moment 1 becomes linked to an identified person, and from that point receives the treatment of associated personal data.

We record proof of each authorization, with the exact timestamp, the version of the text accepted and the session identifier, under article 2.2.2.25.2.4 of Decree 1074 of 2015.

If you leave before Moment 2, the session is deleted within 72 hours. See section 17.

5. Identification data

Requested at the identification stage, before the report is generated.

6. Company context data

7. Operational information about the process

This is the most sensitive category Fundders collects. It is not your personal data: it is business data describing an organization's internal operation. We treat it with the same level of protection we apply to personal data, and with reinforced confidentiality.

Specific commitments regarding this information:

• It is not shared with third parties other than the Processors listed in section 15.
• It is not used to benefit a competitor of yours.
• It is never published in identifiable form.
• Internal access is restricted to personnel involved in analyzing your case.
• All Fundders personnel are bound by confidentiality agreements.
• It is incorporated into the aggregate dataset only after irreversible anonymization. See section 13.

8. Conversations with the agents

Two stages of Línea Base are conversational: process mapping and clarifications.

They are stored in full. All messages, yours and the agents', with timestamps. Not only the structured data we extract from them.

This means that if you write something in those conversations, it is stored, even if it is a side comment, a proper name or a clarification you later correct. That is why the Terms ask you not to include credentials, sensitive data or third-party confidential information.

9. Files you upload

File upload is optional.

9.1 What we receive

• Process documents: PDF, DOCX, images.
• Tabular exports with timestamps: CSV, XLSX.
• Screenshots of reports or dashboards.
• Samples of the deliverable the process produces.

9.2 What we do with them

1. They are stored encrypted, in restricted-access storage.
2. They are processed to extract structured variables: times, volumes, steps, rates.
3. Those variables feed the diagnostic.
4. The original file is deleted 30 calendar days after the report is generated. The extracted variables persist with the report.
5. Files are not incorporated into the aggregate dataset described in section 13.

9.3 If you upload something you should not have

The Terms and Conditions expressly exclude personal data of customers or employees, contracts, financial statements, credentials and material under confidentiality agreements.

That exclusion is an instruction to you, not a technical guarantee. It may happen that you upload something you should not have. This is what we do when it happens:

1. We do not process the excluded content for any purpose.
2. We delete the file from our systems, without waiting for the 30-day period.
3. We inform you at the registered email address, where one exists, stating what was deleted and why.
4. If we detect credentials, we inform you immediately and recommend that you rotate them. We do not use them, do not test them and do not retain them.
5. If the file contained third-party personal data, we delete it and do not incorporate it into any database.
6. We keep a record of the deletion, with date, type of content and reason, without retaining the deleted content.
7. If the diagnostic depended on that file, we tell you so you can upload an anonymized version.

Detection combines automated review and human review. It is a reasonable effort, not an absolute guarantee. Anonymize before uploading.

10. Data we generate

You do not supply this data. Fundders produces it from your information.

11. Technical and traceability data

Collected automatically.

On token consumption: this is an infrastructure cost metric. It does not describe the content of what you wrote, only its volume.

12. What we use your information for

Diagnostic operation

1. Generate the report, the calculation, the assumptions and the simulator.
2. Maintain your session state while you complete it.
3. Send you the report at the registered email address.

Commercial management, only with the Moment 2 authorization 4. Contact you in relation to your diagnostic. 5. Prepare a proposal or a working session. 6. Track the commercial opportunity in our internal systems.

Service improvement 7. Analyze sessions to improve diagnostic quality, calibrate the calculation model and correct errors. 8. Understand where users abandon and improve the flow.

Aggregate use and industry publications 9. Build a proprietary dataset on operational inefficiencies by sector, country and process type. 10. Publish analyses, benchmarks and industry reports based on that dataset.

Purposes 9 and 10 constitute a secondary use, which is why we describe them separately and in detail in section 13.

Compliance and security 11. Retain proof of your authorizations. 12. Detect and prevent abuse or automated use. 13. Respond to requirements from competent authorities.

We do not use your information to: sell it, transfer it to third parties for those third parties' own commercial purposes, third-party advertising, or train external providers' artificial intelligence models.

13. Aggregate use of the information

We disclose this explicitly because it is not evident and because it goes beyond generating your report.

What we do: we incorporate the structured variables of your diagnostic, following irreversible anonymization, into a proprietary Fundders dataset on operational inefficiencies by sector, country and process type. Based on that dataset we publish and will publish analyses and industry reports.

What enters the aggregate dataset: structured variables such as process type, sector, country, organization size range, volume, times, rework rate, number of approvals, inefficiency patterns.

What does NOT enter:

• Your name, email, phone number or role.
• Your company's name.
• The internal name of your process.
• Free-text descriptions.
• Conversations with the agents.
• The files you uploaded.
• Any personal data.

Guarantees we apply, without exception:

1. Irreversible anonymization before aggregation. The link to the individual record is broken and is not technically reversible.
2. An individual case is never published. Only distributions, medians, ranges and patterns.
3. Minimum case threshold. We do not publish a segment by sector, country or size if the case count is low enough to allow an individual case to be inferred. The operational threshold is at least 10 cases per segment.
4. Re-identification testing. Before publishing, we verify that no combination of variables allows the organization to be deduced.
5. No personal data in the dataset. The aggregate dataset is not a personal database.

How to opt out: write to us at ai@fundders.com. If you request it before aggregation occurs, your information is not incorporated. If you request it afterwards, we cannot reverse the aggregation because the data is no longer attributable to you or separable from the dataset, but we do delete everything else.

Identifiable use: if we ever wished to use your case with your company name, for example as a case study, we would ask you separately and in writing. It is not covered by this policy.

14. Third-party data within your operational information

In describing a process it is practically inevitable that you will mention people: who performs a step, who approves, a supplier, a customer. We do not ask for it, but it arrives.

When that happens:

• We treat that information with the same level of protection.
• We do not use it to contact those people.
• We do not build profiles about them.
• We do not add them to our commercial databases.
• They do not enter the aggregate dataset.
• They are retained only within your diagnostic record, under the periods in section 17.

We ask you to use roles instead of names. "The billing coordinator" works just as well as a proper name for diagnostic purposes, and protects that person better.

You are responsible for having the authorization or legal basis to share third-party data, under the Terms and Conditions.

15. Processors and international transfers

15.1 Processors

With each of them we have agreements requiring confidentiality, security measures and processing limited to our instructions.

On model training: we use language model services under contractual conditions in which the content sent is not used to train or improve the provider's models. We verify this condition upon contracting and upon any change of provider.

15.2 International transfer

Your information is stored and processed outside Colombia, mainly in the United States.

The United States has not been declared by the Colombian Superintendence of Industry and Commerce (SIC) as a country with an adequate level of protection. Accordingly, the transfer is carried out on the basis of article 26, literal a) of Law 1581 of 2012: your express and unambiguous authorization.

By accepting this policy you expressly authorize the international transfer and transmission of your data and of the operational information you describe to the providers mentioned, for the purposes in section 12.

If you do not want your information transferred internationally, we cannot provide you with this service in its self-service form. Write to us at ai@fundders.com to explore alternatives.

16. Automated evaluation and profiling

In addition to the report you receive, Fundders internally produces an automated evaluation of your case. It is distinct from the report and is not part of it.

16.1 What we do

• A commercial qualification score for your case.
• A criteria-based assessment, which may include verbatim quotes of what you wrote in the conversational stages.
• An inferred customer profile.
• A routing decision on how Fundders follows up on your case.

16.2 What effect it has

It determines how Fundders conducts commercial follow-up on your case. It produces no legal effects on you, does not condition access to a contracted product, does not affect economic conditions, is not shared with third parties, and does not alter the content or the figures of the report you receive.

The report you receive is the same regardless of your score.

16.3 This information is not disclosed within the diagnostic

We want this to be unambiguous:

• The score and the assessment are not displayed at any stage of the flow.
• They do not appear in the report, in the simulator, or in the email that delivers it to you.
• The conversational agents will not reveal them if you ask for them during the diagnostic. They are not designed to do so and this is not the appropriate route to deliver them.

The reason is that this is an internal prioritization tool, calibrated for our commercial process and expressed in language that only makes sense within it. Mixing it into the report would conflate two different things: the analysis of your process, which is for you, and our commercial prioritization, which is about us.

The fact that it is not disclosed within the diagnostic does not mean you have no right to know it. You do.

16.4 How to request it, and what you receive

How: write to ai@fundders.com indicating the email address you used for the diagnostic, and expressly request to know your evaluation.

What we provide:

1. The qualification score assigned.
2. The criteria evaluated and the result for each.
3. The verbatim quotes that supported each criterion.
4. The inferred customer profile.
5. The routing decision taken.
6. A plain-language explanation of what each of these elements means.

Timeframe: maximum 10 business days, under section 21. Free of charge.

16.5 Your other rights regarding the evaluation

• Correction. You may request correction of the information supporting it. If the correction is warranted, the evaluation is recalculated.
• Review of the evaluation. If you believe the evaluation does not reflect your situation, you may request that a member of the Fundders team review the result and the quotes supporting it. We respond with the conclusion of that review, which may be the correction or the deletion of the evaluation.
• Deletion. You may request deletion of the derived evaluation, with or without the rest of your information.
• Revocation. You may revoke your authorization, upon which we cease all processing, including the evaluation, and delete your information under section 21.

16.6 Automation is not separable from the service

Línea Base is a free service, and it is free because it operates in a fully automated manner end to end: process mapping, calculation, report generation and the internal evaluation all run without case-by-case human intervention.

For that reason, Fundders does not offer a free version of Línea Base without automated processing, and cannot replace it with a manual analysis of each process. Doing so would entail an operational burden that makes it unviable to provide the service at no cost.

This limitation applies only to Línea Base. It does not describe Fundders as a company: Fundders provides professional diagnostic and consulting services that are not automated, contracted separately and governed by their own agreement.

If you do not wish to be subject to this processing, you have three paths, all available at any time:

1. Do not use Línea Base and contact us in writing. Write to ai@fundders.com stating that you wish to be attended without going through the automated diagnostic. Your request will be handled by a member of the team. This channel is always open and does not depend on Línea Base.
2. Contract a professional service from Fundders. Fundders provides consulting and implementation services that do not depend on Línea Base or its automated processing. These are paid services, governed by a separate contract, with scope agreed case by case.
3. Revoke your authorization. We cease processing and delete your information under section 21.

17. How long we keep your information

The periods differ by type of data. This is intentional.

Once the period expires, the information is deleted or irreversibly anonymized.

If you revoke your authorization or request deletion, we proceed ahead of these periods, unless a legal or contractual retention duty exists. In that case we inform you and block the data from any other use.

18. Security

• Encryption in transit, via TLS, on all communications.
• Encryption at rest in the database and in file storage.
• Salted hashing of the IP address.
• File storage with restricted access and short-lived signed links.
• Role-based access control. Only staff involved in your case can see your information.
• Access logging for operational information and identification data.
• Confidentiality agreements with all personnel and with providers.
• Periodic review of permissions and dependencies.

No security measure is infallible. If an incident occurs that compromises your information, we will inform you and report it to the Superintendence of Industry and Commerce in accordance with applicable regulations.

19. Sensitive data and minors

Línea Base does not request sensitive data and must not be used to enter it. If detected, it is deleted under section 9.3.

The service is not directed at minors. If we detect data relating to minors, we delete it.

20. Your rights

1. Know what information of yours we hold, free of charge.
2. Update and rectify inaccurate, incomplete or outdated data.
3. Request proof of the authorization you granted.
4. Be informed about the use we have made of it.
5. File complaints with the Superintendence of Industry and Commerce, after exhausting the procedure with us.
6. Revoke your authorization and request deletion.
7. Request deletion of an uploaded file, at any time and without waiting for the 30-day period.
8. Opt out of the aggregate use, under section 13.
9. Request review of the automated evaluation associated with your diagnostic, under section 16.

21. How to exercise your rights

Single channel: ai@fundders.com

Include: your full name, the email address you used for the diagnostic, a description of your request and a document evidencing your identity.

Response timeframes:

• Queries: maximum 10 business days. If not possible, we inform you of the reasons and respond within the 5 business days following expiry.
• Claims: maximum 15 business days from the day after receipt. If not possible, we inform you of the reasons and respond within the 8 business days following expiry.
• If the claim is incomplete, we tell you within the following 5 days. If you do not complete it within 2 months, it is deemed withdrawn.
• Deletion of uploaded files: maximum 5 business days.

About this channel: requests received at ai@fundders.com may be triaged and prepared with the support of automated systems. However, every decision on a data subject request, including the delivery of information, correction, deletion and revocation, is reviewed and approved by a member of Fundders' Artificial Intelligence Team before being executed. No habeas data request is resolved in a fully automated manner.

22. Data subjects outside Colombia

Fundders operates in Latin America and the United States. If you are located outside Colombia:

• We apply the standard described in this policy to all data subjects, regardless of origin.
• If the law of your jurisdiction grants you additional rights, you may exercise them through the same channel and we will address them to the extent applicable.
• By using Línea Base, you understand that your information will be processed in Colombia and in the United States.

23. National Database Registry

Fundders registers its databases in the National Database Registry (RNBD) of the Superintendence of Industry and Commerce, when and to the extent this is required under the criteria in force.

24. Term and changes

This policy is effective from September 2, 2026 and remains in force for as long as Fundders processes information through Línea Base.

We may update it. The version in force will always be the one published on this page, with its version number and date visible. Material changes, in particular those expanding the purposes, the recipients or the scope of the aggregate use, will be communicated at least 10 calendar days in advance to data subjects whose email address we hold, and announced on the site.

Language. This policy is published in Spanish and English. The Spanish version is the sole governing version. In the event of any discrepancy, contradiction or question of interpretation between the two versions, the Spanish text prevails. The English version is provided as a courtesy translation only.

25. Contact

Fundders S.A.S. NIT 901.373.509-5 Carrera 54C # 143A-90, Bogotá, Colombia

Single contact and data subject channel: ai@fundders.com Phone: +57 317 515 0019

Area responsible for handling data subject requests: Artificial Intelligence Team

Document updated September 2, 2026. Version 1.0. Courtesy translation of the Spanish original.