WEBSITE PRIVACY POLICY

GLOBAL VERSION  Applicable to all jurisdictions in which the Veritran Group operates

In compliance with current regulations on the Protection of Personal Data, this policy describes how the Veritran Group processes users’ personal data obtained through its website, platform, social media and related services. Veritran operates in various countries and provides clear information on how it safeguards data, what it uses it for, with whom it may share it and what rights may be exercised.

SECTION ONE – INTRODUCTION AND DATA CONTROLLER

The Veritran Group processes personal data in accordance with the applicable legislation in each country or territory in which it operates, including, as applicable, Argentina, Chile, Colombia, Mexico, the United States, the United Kingdom, Spain, the European Union and Morocco.

In all cases, personal data is used solely for the purposes set out in this policy, on a valid legal basis and in accordance with the rights recognised by applicable laws.

The data controller is the Veritran Group company that determines the purposes and means of processing in each jurisdiction (see Appendix A for the full list of entities). For privacy matters: dataprotection@veritran.com

SECOND.- GLOSSARY

Personal Data: any information relating to an identified or identifiable natural person, such as name, contact details, online identifiers, location data, professional information or any other data that allows them to be identified directly or indirectly.

Data Controller: the natural or legal person who determines the purposes and means of the processing of personal data.

Data Processor: the natural or legal person who processes personal data on behalf of the Data Controller.

Data Subject: the natural person whose personal data is being processed.

Processing: any operation performed on personal data, such as collection, use, access, storage, modification, consultation, disclosure, transfer, erasure or destruction.

Cookies and similar technologies: small files, identifiers, pixels, tags, SDKs or other technologies that enable the recognition of a browser, device or interaction with the website or digital content.

Safeguards for international data transfers: safeguards that ensure international data transfers between countries are carried out securely and comply with privacy regulations. 

THIRD.- TYPES OF DATA PROCESSED

Veritran collects only the data necessary depending on the type of relationship or interaction with us. The categories of data processed are as follows:

FOURTH.- PURPOSES AND LEGAL BASES  FOR PROCESSING

In accordance with the principle of transparency, we set out below the purposes for which we process personal data, the legal basis legitimising each processing operation and the associated categories of data.

FIFTH. COLLECTION OF PERSONAL DATA

Personal data is primarily provided by the data subject or by the organisation to which they belong. It may also be collected automatically, via digital tools or through authorised third parties.

Data may be collected when the data subject: completes contact forms, downloads content, press releases, events, webinars or marketing communications; writes via email or interacts with Veritran teams; participates in meetings, in-person or virtual events, podcasts, webinars or surveys; browses the website or interacts with digital content, advertisements, campaigns or social media; accepts or configures cookies or other similar technologies; interacts with third-party platforms linked to Veritran (LinkedIn, Meta/Facebook, X, YouTube, Vimeo, Spotify); or participates in recruitment, onboarding or employment processes.

SIXTH.- RECIPIENTS OF PERSONAL DATA

Transparency regarding with whom personal data is shared is a fundamental principle for Veritran. Data is only disclosed to third parties when strictly necessary to fulfil the purposes described in this policy and always on a valid legal basis.

For the sake of clarity, there are two categories of recipients: data processors, who act on behalf of Veritran and under its instructions, and joint controllers or independent third-party controllers, who receive the data for their own purposes based on their own legal grounds.

A. Disclosure of Data to Data Processors: 

These are suppliers who access personal data exclusively to provide services to Veritran, in accordance with documented instructions and subject to the safeguards required by applicable regulations. Veritran enters into data processing agreements or equivalent instruments provided for in each jurisdiction with each of them.

Web analytics and digital accessibility Google Analytics (Google LLC / Google Ireland Ltd.): statistical analysis of website traffic and user behaviour. Data may be transferred to Google’s servers in the United States. — Google Search Console (Google LLC / Google Ireland Ltd.): analysis of the website’s performance in search engines. Processes aggregated interaction data. — AccessiBe (AccessiBe Ltd., Israel): a web accessibility tool that may collect browsing data to tailor the user experience. Israel has an adequacy decision recognised by the European Commission.

Advertising and campaign management Google Ads (Google LLC / Google Ireland Ltd.): management and measurement of advertising campaigns. Involves the use of cookies and may involve transfers to the United States. — LinkedIn Ads (LinkedIn Ireland Unlimited Company): targeted advertising on the LinkedIn platform. This involves the use of tracking pixels and may involve transfers to the United States. — Meta Pixel / Facebook Ads (Meta Platforms Ireland Ltd.): campaign performance measurement and retargeting. This may involve transfers to the United States. — X Conversion Tracking (X Corp., United States): tracking of conversions resulting from campaigns on the X platform.

Events, content and communications YouTube (Google LLC / Google Ireland Ltd.): hosting and playback of audiovisual content linked from Veritran’s website and digital channels. — Vimeo (Vimeo, LLC, United States): hosting and playback of audiovisual content. — Spotify (Spotify AB, Sweden): distribution of content in podcast format.

B. Disclosure of Data to Other Data Controllers - Transfer of data. 

In specific situations and provided there is a legitimate basis for doing so, we may disclose your data to third parties who will process it for their own purposes:

• Veritran Group companies: For internal administrative purposes, corporate management and coordination of commercial strategies, based on our legitimate interest in efficiently organising the business group’s resources.
• Professional Advisers and Auditors: Law firms, accountancy firms and consultancies that provide us with legal, tax or accounting advice, in compliance with our obligations or for the formulation and defence of claims.
• Public, Judicial or Administrative Authorities: Where a law, a court order or an administrative procedure requires us to provide the information (e.g. Tax Authority, Courts and Tribunals, Law Enforcement Agencies).
• Customers, Suppliers and Strategic Partners: Only when it is essential for the performance of a contract or the development of a joint project in which the data subject participates or is a stakeholder.
• Social Media and Third-Party Platforms: When you interact with our profiles or content hosted on platforms such as LinkedIn, Meta (Facebook), X or YouTube, these platforms also process your data as independent data controllers, in accordance with their own privacy policies.

Veritran carries out a due diligence process to select its suppliers and partners, ensuring that they offer adequate safeguards regarding data protection.

SEVENTH.-  INTERNATIONAL DATA TRANSFERS

Given the multinational structure of the Veritran Group and the use of global technology providers, personal data may be transferred, stored, consulted or accessed from countries other than the data subject’s country of residence or location. The applicable safeguards and the location of the main cross-border data flows are detailed below.

Applicable safeguards

In general, Veritran implements international transfers using one of the following mechanisms, depending on the jurisdiction of origin and destination:

1.- Adequacy decisions: where the recipient country has been recognised as providing an equivalent level of protection by the competent authority (for example, the European Commission under the GDPR, or the equivalent authorities in each country of origin).

2.- Standard contractual clauses (SCCs) or other recognised contractual instruments: adopted in accordance with the templates approved by the competent authorities in each jurisdiction.

3.- Intra-group data transfer agreements: which bind the entities of the Veritran Group and establish obligations equivalent to those required by the applicable regulations.

4.- Data processor agreements with transfer clauses: entered into with suppliers acting as data processors and involving cross-border data flows.

5.- Transfer impact assessments (TIA/LIA): carried out where required or recommended by applicable regulations, in order to assess the actual risk of processing in the recipient country and determine whether additional measures are necessary.

6.- Supplementary technical and organisational measures: encryption in transit and at rest, pseudonymisation, access controls based on the principle of least privilege, incident management and ongoing monitoring of suppliers.

Details of the main cross-border data flows

The following table sets out the most relevant international transfer flows, organised by provider, destination country or region, and applicable safeguard mechanism from the perspective of each country of origin:

EIGHTH.-  RETENTION PERIODS 

Veritran will retain your personal data only for as long as is strictly necessary to fulfil the specific purposes for which it was collected. Retention periods are determined according to the following criteria:

• Data relating to contractual relationships: This will be retained for as long as the relationship remains in force and, subsequently, for the statutory limitation periods for liabilities (tax, commercial, civil).
• Data for commercial communications: This will be retained until you withdraw your consent or exercise your right to object.
• Candidate data: This will be retained for the duration of the selection process and, with your consent, for an additional period for future vacancies.
• Browsing data: This will be retained for the periods indicated in our Cookies Policy.

Once these periods have expired, the data will be securely deleted, anonymised or blocked, in accordance with applicable regulations.

 NINTH.- INFORMATION SECURITY

Veritran has technical, organisational and administrative controls in place to protect the confidentiality, integrity and availability of personal data. These measures include, as appropriate,

access controls, identity management, infrastructure security, monitoring, encryption, backup, business continuity, incident management and supplier assessment.

Veritran has an internal programme focused on regulatory compliance, information security and the protection of personal data. Furthermore, Veritran holds security certifications including ISO 27001, amongst other applicable corporate certifications.

TEN. EXERCISE OF RIGHTS 

Data subjects may exercise rights regarding their personal data in accordance with the applicable legislation in each jurisdiction. The rights generally recognised and the specific provisions by country are described below:

ELEVENTH.- MINORS

Veritran does not direct its services at children or adolescents, nor does it intentionally seek to collect their personal data through its digital channels.

TWELFTH.- POLICY UPDATES

Veritran may amend or update this policy where necessary, for example, due to legal, regulatory, technological, operational or commercial changes. Where changes are substantial, we will endeavour to notify you via the available channels. We recommend that you consult this policy periodically to view the updated version.

THIRTEENTH.- CONTACT

For any queries regarding the processing of personal data, to exercise your rights, or for matters relating to privacy and information security, please contact dataprotection@veritran.com

Section Two – Cookie Policy

FIRST.- WEBSITE AND TECHNOLOGICAL PLATFORM

When Veritran provides technological services to its clients, it may process certain personal data on their behalf and in accordance with their instructions. In such cases, Veritran normally acts as a Data Processor, Operator or Service Provider, in accordance with applicable legislation and the provisions of the contract, SOW, DPA or other relevant agreement.

This policy primarily describes the processing of personal data carried out by Veritran through its own channels, corporate relationships and institutional activities. The processing of data carried out on behalf of clients is governed by the applicable data processing contracts and agreements.

SECOND.-  SOCIAL MEDIA

Veritran has a presence on social media and digital channels such as LinkedIn, Instagram, Facebook, X, YouTube and its own blog. These profiles may be used to share institutional information, news, content, events, campaigns, products and services.

When you interact with Veritran’s profiles, your data may also be processed by the relevant social media platform in accordance with its own privacy policies, terms and settings. Veritran does not control all processing operations carried out by these platforms.

THIRD.- COOKIES AND SIMILAR TECHNOLOGIES

The Veritran website uses cookies and similar technologies to ensure the site functions properly, improve the browsing experience, remember preferences, measure site usage, understand how users interact with content and, where appropriate, display relevant communications or advertisements.

FOURTH.- LINKS TO THIRD-PARTY SITES

The Veritran website may contain links to external sites managed by other organisations. This policy applies solely to Veritran’s channels. External sites have their own privacy policies, terms and data processing practices.

Veritran is not responsible for the privacy practices of third-party sites. We recommend reviewing their policies before interacting with them or providing personal data.

Section Three – Country-Specific Provisions

Veritran applies this policy globally, without prejudice to any specific provisions that may apply under the applicable legislation in each country or region. In the event of a conflict or inconsistency between the general provisions and the local provisions, the latter shall prevail.

ARGENTINA

Where Argentine legislation applies, the processing of personal data shall be carried out in accordance with Law No. 25,326 on the Protection of Personal Data, its supplementary regulations and the provisions of the Agency for Access to Public Information.

CHILE 

Where Chilean legislation applies, the processing of personal data shall be carried out in accordance with Law No. 19,628 on the Protection of Privacy and any legislation that amends, supplements or replaces it.

COLOMBIA 

Where Colombian legislation applies, the processing of personal data shall be carried out in accordance with Law 1581 of 2012, its regulatory decrees and the instructions of the Superintendency of Industry and Commerce.

MEXICO 

Where Mexican regulations apply, the processing of personal data shall be carried out in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties and other applicable regulations.

UNITED STATES 

Where US regulations apply, Veritran will process personal data in accordance with the relevant federal, state or sector-specific laws, including consumer privacy, security, commercial communications and personal information protection regulations as applicable. Residents of states with specific consumer privacy regulations may exercise additional rights, such as the right to opt out of certain forms of sales, sharing or targeted advertising, and not to be treated discriminatorily for exercising their rights.

UNITED KINGDOM 

Where UK law applies, the processing of personal data will be carried out in accordance with the UK GDPR, the Data Protection Act 2018 and, in relation to cookies or electronic communications, the applicable PECR regulations.

EUROPEAN UNION 

Where Spanish or European Union legislation applies, the processing of personal data will be carried out in accordance with the General Data Protection Regulation (GDPR), the LOPDGDD and, in relation to digital services, cookies and electronic communications, the applicable legislation.

MOROCCO 

Where Moroccan legislation applies, the processing of personal data shall be carried out in accordance with Law No. 09-08 on the protection of natural persons with regard to the processing of personal data and the provisions of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

APPENDIX A  Entities and Registered Offices of the Veritran Group