Guaranteeing the custody of all personal data and confidential information in the documents handled by both the company and its clients. It also outlines the responsibilities of individuals who have access to this data, regardless of whether it is in physical or digital format, as long as it constitutes a compilation of personal information about third parties, such as records of customers, suppliers, or depending on the case or economic activity that generates this compilation of information. The only exception is that the only databases that are not considered within the scope of regulatory application.

Tenth: Duties and Commitments of the User regarding the authentication methods. THE USER agrees to:

Immediately report any security-related events involving the OTP (One-Time Password), security queries, or facial recognition.

Carefully analyze and, if necessary, seek professional advice on the Electronic Document presented for subscription and signature.

Refrain from storing the OTP on any physical medium and never send it or deliver it to third parties.

Regularly update the protection and information on their personal mobile phone and email.

Eleventh: Evidentiary Mechanisms: THE INTERVENING PARTIES agree that text messages, logs, emails, and, in general, but not limited to, any computer, electronic, or telematic record and/or file will constitute full proof and sufficient evidence of the statement of the END USER and INITIATING USER. THE INTERVENING PARTIES may reproduce, display, and/or exhibit them only to the extent necessary to clarify, explain, demonstrate, prove, and/or verify before any supervisory or controlling authority, or before any judicial, arbitral, or non-judicial tribunal, the certainty of the electronic signature.

Twelfth: Impossibility of Repudiation. THE INTERVENING PARTIES understand and agree that the authorized authentication methods provided and made available on the FIRMA SEGURO platform for signatures are reliable and secure. This means that the signature is reliable and unalterable, and as a consequence, THE USER cannot repudiate or reject it.

Thirteenth: Personal Data Processing. THE USER states that, prior to or concurrently with this agreement, they have read, understood, and accepted FIRMA SEGURO’s PRIVACY, CONFIDENTIALITY, AND PERSONAL DATA PROCESSING POLICY.

Fourteenth: Legislation and Jurisdiction for Interpretation and/or Execution. THE INTERVENING PARTIES agree that this agreement is governed by Colombian laws, their regulatory decrees, and other rules and jurisprudence that complement them. Therefore, any conflict related to this agreement will be processed and resolved by Colombian authorities, at the domicile of the INITIATING USER, without prejudice to the use of dispute resolution mechanisms.

International: However, since both the technical standards of FIRMA SEGURO and the guidelines of this agreement, as well as the PRIVACY, CONFIDENTIALITY, AND PERSONAL DATA PROCESSING POLICY, are fully compliant with the INTERNATIONAL STANDARDS updated to June 2021, they can be applied internationally as needed.

Fifteenth: The agreements stipulated and unmistakably accepted here will take effect for all documents signed, signed, or ordered, as the case may be, and will have legal effects against third parties, as provided for in Article 824 of the Commercial Code and Decree 2364 of 2012.

Sixteenth: Responsibility:

Since, legally, the unmistakable voluntary act of electronically signing this document REPLACES PERSONAL AND PHYSICAL PRESENTATION, it is imperative that each INTERVENING PARTY does so without delegating it to a third party. In other words, since, at the moment of signature, a security verification call is made to the mobile phone, it is essential that the owner of the intervening party be directly the person who provides the necessary data to the system.

It is the exclusive responsibility of the person who provides the signature, as it is their responsibility to keep control and custody of the data for signature generation in accordance with the legal, jurisprudential, and doctrinal regime, both at the Colombian and international levels.

Law 527 of 1999; Decree 2364 of 2012 (Colombia) and international standards such as Regulation (EU) No. 910/2014 of the European Parliament and of the Council of 23 July 2014 (eIDAS); the UETA Act and E-Sign Act in the US, and other directives up to 2021.

Seventeenth: This document contains the most specific aspects and is drafted in line with international standards and guidelines, making it globally applicable. On a national level, unrestricted application is given to the following sections of Decree 2364 of November 22, 2012, which stipulates:

Article 1. Definitions. For the purposes of this decree, the following definitions apply:

Agreement on the use of the electronic signature mechanism: An agreement of wills in which the legal and technical conditions to which the parties will adhere for communication, transactions, the creation of electronic documents, or any other activity through electronic data interchange are established.

Data for the creation of the electronic signature: Unique and personal data used by the signatory to sign.

Electronic signature: Methods such as codes, passwords, biometric data, or private cryptographic keys that allow identifying a person in relation to an electronic message, provided that it is reliable and suitable for the purposes for which the signature is used, taking into account all the circumstances of the case, as well as any relevant agreement.

Signatory: A person who has the data for creating the signature and who acts on their behalf or on behalf of the person they represent.

Article 2. Technological Neutrality and Equal Treatment of Electronic Signature Technologies. None of the provisions of this decree will be applied in a way that excludes, restricts, or deprives any method, procedure, device, or technology for creating an electronic signature that meets the requirements outlined in Article 7 of Law 527 of 1999 of legal effect.

Article 3. Compliance with the requirement of a signature. When the signature of a person is required, this requirement will be considered met in relation to an electronic message if an electronic signature is used that, in light of all the circumstances of the case, including any applicable agreement, is as reliable as appropriate for the purposes for which that message was generated or communicated.

Article 4. Reliability of the electronic signature. The electronic signature will be considered reliable for the purpose for which the electronic message was generated or communicated if:

The data for creating the signature, in the context in which they are used, correspond exclusively to the signatory.

Any unauthorized alteration of the electronic message made after the time of the signature can be detected.

Paragraph. The above shall be understood without prejudice to the possibility that any person:

Demonstrates in another way that the electronic signature is reliable; or Presents evidence that an electronic signature is not reliable. Article 5. Legal Effects of the Electronic Signature. The electronic signature will have the same validity and legal effects as the physical signature if it meets the requirements set forth in Article 3 of this decree.

Article 6. Duties of the signatory. The signatory must:

Maintain control and custody over the data for creating the signature.

Act diligently to prevent the unauthorized use of their data for creating the signature.

Promptly notify any person who has, has received, or will receive electronically signed documents or messages by the signatory if:

a) The signatory knows that the data for creating the signature have been compromised; or

b) The circumstances of which the signatory is aware give rise to a significant risk that the data for creating the signature have been compromised.

Paragraph. It is understood that the data for creating the signatory’s signature have been compromised when, among other things, they have been illegally disclosed by third parties, are at risk of being used improperly, or the signatory has lost control or custody of them, and, in general, any other situation that raises doubts about the security of the electronic signature or raises objections about its quality.

Article 7. Electronically signed agreement. Unless proven otherwise, it is presumed that the methods or techniques of personal identification or electronic authentication, as appropriate, agreed to by the parties through an agreement, meet the requirements of the electronic signature.

Paragraph. The party that provides the methods for electronic signature through an agreement must ensure that its mechanisms are technically secure and reliable for their intended purpose. It will be responsible for proving these requirements, if necessary.

Eighteenth: The acceptance of this agreement allows THE INTERVENING PARTIES to enjoy the excellence, security guarantee, and general benefits of FIRMA SEGURO under the highest national and international standards.

[Updated to June 7, 2022]