BEFORE USING THE WEBSITE AND THE SERVICES OFFERED THROUGH IT, PLEASE READ THIS PRIVACY POLICY CAREFULLY, WHICH APPLIES TO ALL ACTIVITIES CARRIED OUT THROUGH THE APPLICATION AND/OR THE WEBSITE.

The belo.app mobile application (the "Application") and the website at www.belo.app (the "Website") are the exclusive property of Gralcey S.A., RUT: 218765580018, domiciled at Andes 1365, office 308, Montevideo, Uruguay ("Gralcey"). For the purposes of this Privacy Policy, any reference to the Website shall also be understood as a reference to the Application.

This Privacy Policy is governed by the Constitution and Law No. 18,331 of Uruguay (the "Protection of Personal Data" and "Habeas Data") and the provisions issued from time to time by the Supervisory Authority, the Uruguayan regulator.

Gralcey respects and protects the privacy of users (collectively, "Users") and this Privacy Policy aims to inform them how the personal data that Users provide or that Gralcey collects when Users use the services available on the Website, whether provided by Gralcey or by external providers independent of Gralcey (the "External Providers" and the "Services"), will be used.

If you, as a User of the Website, do not wish Gralcey to collect and process information that personally identifies you, please refrain from browsing or registering on the Website or providing your personal data.

1.1. When using the Website, you may be asked to voluntarily provide certain data that identifies you. Gralcey may also collect certain personal data automatically or gather information through other sources (all of them, the "Personal Data"), such as:

(a) First name(s); last name(s); gender; address; nationality; phone number; type, number and country of issuance of the identification document; email address and physical address; Gralcey customer number; user account data and passwords.

(b) Personal Data contained in the identity document presented during the registration process, as well as facial recording/image for the purpose of conducting identity verification processes and mitigating impersonation and fraud.

(c) Transactional information about your requests, operations and purchases through the Website.

(d) Personal data of a patrimonial, financial and occupational nature; tax residency information; credit information relating to creditworthiness assessments; relevant information in the event of being a politically exposed person; declaration on the origin and lawfulness of funds; information collected from restrictive lists and publicly accessible sources for fraud prevention purposes; compliance with reporting regimes and payment methods.

(e) Personal Data and information collected through cookies and similar technologies.

(f) Personal Data published on social networks provided by you, such as those used when creating your account in the Application with Google or Apple (specifically, first name, last name and email address).

(g) Information about you when you provide information directly to Gralcey or when you interact with Gralcey and/or External Providers on the Website.

(h) Geographic location data from your device. The collection of this data requires your prior and express consent through the permissions of your device's operating system; you may reject or revoke such permission at any time from your device settings, which may limit access to certain Application features. Location data is transmitted encrypted in transit, and background access is used exclusively for the detection of entry and exit of geographic regions (geofencing).

1.2. You are not required to provide your Personal Data, but if you do not provide them, or if you provide incomplete, false or inaccurate data, Gralcey will not be able to provide its management services, or you will not be able to use the Services available on the Website, or the ability to do so may be significantly hindered or impaired.

2.1. Your Personal Data will be used for the following purposes:

(a) So that Gralcey can identify and contact you, so that you can register, access, use and navigate the Website, and to verify your identity in compliance with legal requirements.

(b) So that Gralcey can provide you with the Services it offers through the Website, process your requests and transactions, prepare and maintain a record of the operations you carry out on the Website and follow them up, manage the Services, including the payment processing service.

(c) To respond to requests and queries you have made through the Website, whether about Gralcey's products and services and/or to maintain contact with you, address your comments, complaints and suggestions, and provide you with support.

(d) To improve our Services and the features of the Website.

(e) To send you marketing and direct advertising communications, contact you in the future and inform you about products or services that we believe may be of interest to you, both from Gralcey and its affiliates and/or commercial partners. You may always request to be removed from the list for sending promotional or advertising information by sending an email to [email protected].

(f) To comply with legal obligations and requirements from competent authorities.

(g) To protect the rights, property or security of Gralcey, or any of our affiliates, commercial partners or customers.

(h) To carry out marketing, advertising, commercial prospecting and/or market research activities, develop internal studies on your interests to offer you better services and products, as well as carry out statistical studies, profiling to improve our commercial and promotional initiatives.

(i) To prepare credit analysis profiles, judicial and extrajudicial collections.

(j) To determine, through geofencing technology, the jurisdiction in which you are located and ensure that you access the financial services enabled for your region in compliance with applicable regulations, as well as to enable or restrict Application features according to your geographic location.

(k) To act in urgent circumstances to protect the security of Website Users or the public.

2.2. In any case, Gralcey will only use your Personal Data for the purposes set out herein. The use of your Personal Data for any other purpose that is not compatible with those previously detailed will be communicated to you before we proceed with its processing.

3.1. We will only share your Personal Data with third parties when this is necessary:

(a) With companies affiliated and/or related to Gralcey, to communicate with you and provide the Service.

(b) With providers that assist Gralcey in providing the Services, such as payment processing companies; computer system providers; cloud service providers; general technology service providers, call centers or customer service centers; advertising or marketing agencies; data analytics agencies; insurance, legal and/or financial consultants; agents and representatives.

(c) With financial institutions and any other company that may be necessary to carry out the purchase and sale of crypto assets through Gralcey.

(d) With providers that support Gralcey in the background check process, verification and authentication of your identity.

(e) To comply with applicable laws or regulations, with judicial or administrative processes, or to protect and defend the rights or property of Gralcey. For example, we may share your Personal Data with any competent state authority or body, government agency or court, in cases where disclosure is necessary to comply with applicable law or regulation, to exercise, establish or defend our rights, or to protect your vital interests or those of any other person, among others.

(f) During a Gralcey audit process, with auditors and their principals, always subject to confidentiality obligations.

(g) In the event of a sale of Gralcey, merger, reorganization, dissolution or similar event in which Personal Data forms part of the assets involved or transferred, we will share your Personal Data with the buyer or resulting entity.

3.2. In relation to points (a), (b), (c), (d) above, Personal Data will not be used by third-party service providers for any purpose other than that for which Gralcey transferred it to them, and they will always process it following Gralcey's instructions. In the event that such providers use your Personal Data for their own uses and purposes, such collection and processing of information will be governed by their own legal terms (e.g., authorizations, policies, privacy notices), which are independent of Gralcey, so we invite you to review them carefully before accepting them.

3.3. Personal Data may be transferred to the aforementioned third parties located within or outside Uruguay, even when the third parties are located in countries that Uruguayan legislation considers do not offer adequate protection.

4.1. Gralcey may store information on your computer or mobile device through the use of "cookies" to improve the quality of your visit to the Website. Cookies are small files that store information about the equipment of the person who accesses a website, such as the IP address, date and time of access, the IP address of the website that linked you to the Services, the file name or words searched on a webpage, items and information about the browser and operating system used. They allow the entity that places the cookie on the user's device to recognize it on different websites, devices and/or browsing sessions. Cookies serve many useful purposes, such as the following:

(a) Cookies can remember the user's login credentials so that they do not have to enter those credentials each time they log into the Website.

(b) Cookies help Gralcey understand which parts of the Website are most popular, because they help show which pages and features visitors access and how long they stay on the pages. By studying this type of information, Gralcey can better adapt the Website and provide Users with a better experience.

(c) Cookies help Gralcey understand which advertisements Users have seen so that they do not receive the same advertisement every time they access the Website.

(d) Cookies help Gralcey provide Users with relevant content and advertisements by collecting information about their use of the Website and other websites and applications.

4.2. When you use a web browser to access the Website, you can configure your browser to accept all cookies, reject all cookies, or notify you when a cookie is sent. Each browser is different, so you should check your browser's "Help" menu for information on how to change your cookie preferences. Your device's operating system may contain additional controls for cookies.

4.3. Regarding uses of cookies that are not necessary for the operation of the Website, Users may object without this affecting the Services.

4.4. However, please note that the Website may be designed to function using cookies, and that disabling cookies may affect your ability to use the Website or certain parts of it.

Gralcey may connect and interoperate with sites created and maintained by public and private organizations that may include or offer products or services from third parties and External Providers. Gralcey is not responsible for the security and privacy practices or the content of third-party websites linked to the Website. Gralcey does not control or guarantee the accuracy, relevance, adequacy or completeness of the information contained on such sites and is not responsible for their content or activities. If you click on a link to an external site, you will leave the Website and will be subject to the privacy and security policies of the owners/sponsors of the external site. The processing of Personal Data by the third parties responsible for the aforementioned websites is not covered by this Privacy Policy, so it is recommended to carefully read such privacy and security policies.

6.1. We may modify this Privacy Policy at any time. In the event that significant changes are made to the Privacy Policy, we will notify you by publishing the modified Privacy Policy on the Website and/or by sending you an email or through the Application so that you may accept it if we require your approval. We will also update the "Last updated" date that appears at the beginning of this Privacy Policy. In the event that we communicate the changes to you by email, it will be understood that the date on which we send the email is the date on which you received that message.

6.2. It is important that you read the modified Privacy Policy. Acceptance of the Privacy Policy and its updates is not mandatory, but may be a necessary requirement to use the Services provided through the Website. If you do not wish to accept the modified Privacy Policy, Gralcey may have difficulty continuing to offer you the Services on the Website and in some cases may be prevented from processing your Personal Data to provide you with the Services.

The latest version of this policy is dated September 2, 2026.

7.1. The controller of the database where your Personal Data is stored is Gralcey S.A., RUT: 218765580018, domiciled at Andes 1365, office 308, Montevideo, Uruguay (ZIP: 11,000). You have the right to request and obtain information about your Personal Data. You also have the right to request the rectification, update and, where applicable, deletion of your Personal Data.

7.2. Gralcey will delete your Personal Data when it is no longer necessary for the provision of the Services. For technical reasons, this process may take some time. In certain cases, Gralcey may retain your Personal Data when there is an obligation to maintain the Personal Data, or for the statute of limitations period of any potential action against Gralcey. However, during such time or period, the Personal Data will be kept encrypted and inactive until its deletion.

7.3. Users may contact Gralcey at any time to exercise their rights by sending an email to [email protected].

If you have any questions about this Privacy Policy, please contact us at the following email address: [email protected].

1.1. This annex (the "Annex") forms an integral part of the Privacy Policy of Gralcey S.A. ("Gralcey") and applies exclusively to the Processing of Personal Data of Users who are located in the territory of the Republic of Colombia at the time of accessing or using the Application, Website and/or Services (hereinafter, the "Colombian Users"), regardless of their nationality, domicile or place of residence.

1.2. This Annex is adopted in compliance with Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015), the instructions issued by the Superintendencia de Industria y Comercio ("SIC") and other regulations that modify, add to or supplement them (the "Colombian Regulations"). In the event of a contradiction between the provisions of the Privacy Policy and this Annex, the provisions of the latter shall prevail with respect to Colombian Users.

For the purposes of this Annex, and unless expressly stipulated otherwise, capitalized words shall have the meaning assigned to such terms as indicated below, which apply in singular and plural form, as applicable, regardless of how they are presented. Capitalized terms not defined in this Annex shall have the meaning assigned to them in the Privacy Policy:

If you are a Colombian User, the Controller of your Personal Data is:

If you are a Colombian User, Gralcey will collect and process the Personal Data described in Section 1 of the Privacy Policy.

As a Colombian User, your Personal Data will be processed for the purposes indicated below, which are separated into Necessary Purposes and Accessory Purposes.

5.1. Necessary Purposes. The following are Necessary Purposes of the Processing:

5.1.1. Register your Personal Data in Gralcey's databases, identify you and allow registration, access, use and navigation on the Website.

5.1.2. Verify and validate your identity at the time of onboarding and throughout the contractual relationship, including the consultation and verification of your information in public or private, national or international sources, such as restrictive lists, in accordance with fraud prevention controls, identity impersonation, counterparty knowledge and compliance with regulations on the prevention of money laundering, terrorist financing and proliferation of weapons of mass destruction.

5.1.3. Provide you with the Services offered through the Website, process requests, operations and transactions, prepare and maintain the record of your operations and follow them up, manage the Services and payment processing, and prepare reconciliations and account statements.

5.1.4. Manage fraud prevention and transaction security, including transactional monitoring and detection of unusual or suspicious operations, as well as protect the rights, property and security of Gralcey, its affiliates, commercial partners and Users.

5.1.5. Respond to your requests, petitions, queries, complaints and claims and provide you with commercial, technical or administrative support.

5.1.6. Generate alerts, send you access credentials, one-time passwords (OTP) and inform about the status of operations, by email, SMS, push notifications, the Website, phone call or any other channel provided.

5.1.7. Comply with applicable legal, contractual and regulatory obligations, including reports and requirements from competent authorities, and defend Gralcey's interests in judicial, pre-judicial and administrative proceedings.

5.1.8. Prepare credit analysis profiles and carry out judicial and extrajudicial collection procedures, where applicable.

5.1.9. Determine, through geolocation and geofencing technology, the jurisdiction in which you are located, in order to enable or restrict Website features and ensure access to services enabled for your region.

5.1.10. Carry out internal or external, national or international audit processes, and preserve their supporting documentation.

5.1.11. Transmit and/or Transfer your Personal Data to third parties within and outside Colombia, respecting the legal guarantees applicable to each of these operations, including providers that assist Gralcey in providing the Services, financial institutions, affiliated and/or related companies, as well as in events of merger, sale, reorganization, dissolution or audit processes.

5.1.12. Improve the Services, the features of the Website, your user experience and the security of Gralcey's technological infrastructure.

5.1.13. Share, notify and receive your information from commercial partners, risk analysis and transactional monitoring providers, payment processors, acquiring entities, financial institutions and other third parties that participate, directly or indirectly, in the processing chain of the operations you carry out, even when there is no direct contractual relationship between such third parties and Gralcey, when necessary to prevent, detect, investigate or report operations linked to fraud, identity or account impersonation, money laundering, terrorist financing and proliferation of weapons of mass destruction and other illegal conduct or conduct that represents a risk to the community, as well as to respond to requests from Gralcey itself or from such third parties related to unusual or suspicious movements, which may imply the Transfer of Personal Data by Gralcey, both as issuer and as recipient of the information.

5.2. Accessory Purposes. The following are Accessory Purposes of the Processing:

5.2.1. Make contact for commercial, advertising or promotional purposes, of Gralcey or its affiliates and/or commercial partners, by email, SMS, push notifications, the Website, phone call or any other channel provided.

5.2.2. Carry out marketing activities, commercial prospecting and market studies, as well as develop internal studies on your interests and prepare profiles for commercial and promotional purposes.

5.2.3. Develop statistical analyses aimed at designing commercial and promotional

strategies and initiatives.

As a Colombian User, you may at any time object to the Processing of your Personal Data for Accessory Purposes or revoke the Authorization granted with respect to these, without this affecting the continuity of or access to the Services, by submitting a request to [email protected] in accordance with the procedure set forth in Section 13 of this Annex.

Gralcey uses automated systems for the Processing of Personal Data of Colombian Users, including, among others, in the onboarding, identity verification and authentication, transactional monitoring, fraud prevention and profiling processes. If as a Colombian User you consider that an automated decision may have significantly affected your rights or interests, you may exercise your rights pursuant to the procedure established in this Annex, in order to know, in general terms, the criteria and factors taken into account for making the decision, without this implying the disclosure of technical information or Gralcey's internal processes.

7.1. Gralcey may collect and process your biometric data, which are Sensitive Personal Data (for example, facial recording/image) exclusively for the following specific, necessary and proportionate purposes: identity verification and authentication, fraud and impersonation prevention, validation of transactions considered high-risk, updating of Personal Data and processing of claims associated with the contractual relationship.

7.2. The background check, identity verification and authentication process may be carried out through specialized providers acting on behalf of and under the instructions of Gralcey, i.e., as Processors. In the event that such providers use your Personal Data for their own uses and purposes, i.e., as Controllers, such collection and processing of information will be governed by their own legal terms (e.g., Authorizations, policies, privacy notices), which are independent of Gralcey, so we invite you to review them carefully before accepting them.

7.3. In any case, prior to the collection and Processing of Sensitive Personal Data (e.g., judicial background checks and facial recording/image), Gralcey will request your prior, express and informed Authorization, in which the specific processing purposes and the optional nature of providing this information will be identified.

7.4. The provision of Sensitive Personal Data is optional and you are not required to authorize it or to answer questions about this type of data.

7.5. If you prefer not to use biometric data to verify your identity, please contact us at [email protected] to learn about the available verification alternatives. Such request will be addressed within the timeframes provided for responding to queries in this Annex.

8.1. Certain Website features require access to components or information on your device, such as the camera (for capturing the identity document and facial image/recording), push notifications and geographic location data. Gralcey will not access information stored on the device without your prior, express and informed Authorization, which will be requested through the device's operating system permissions prior to any collection and will be associated with the specific purposes informed in each case.

8.2. Regarding location data, Gralcey may collect approximate location, precise location and, exclusively for the detection of entry and exit of geographic regions (geofencing) for regulatory compliance purposes, background location. At all times you may reject or revoke previously granted permissions from your device settings, which will not affect the provision of the Services, except for those features that necessarily depend on the corresponding permission, which will be communicated to you.

9.1. In the development of the purposes described in this Annex, Gralcey may carry out Transmissions of Personal Data to Processors located within or outside Colombia, in which case it will execute the contractual instruments required by the Colombian Regulations.

9.2. Likewise, Gralcey may carry out Transfers of Personal Data to third-party Controllers located within or outside Colombia, including countries that do not provide adequate levels of data protection pursuant to the standards set by the SIC. In such cases, the Transfer will be carried out only on the basis of the express and unequivocal Authorization granted by you, or one of the other exceptions provided for in article 26 of Law 1581 of 2012, or through the mechanisms recognized by the SIC for that purpose.

The Services provided by Gralcey are directed exclusively to adults. Consequently, the Processing of Personal Data of children and adolescents will be limited solely to what is strictly necessary to verify the age of the person and determine their eligibility to access the Services.

In accordance with article 8 of Law 1581 of 2012 and other concordant regulations, as a Colombian User, you have the following rights:

11.1. To know, update and rectify your Personal Data with Gralcey or its Processors.

11.2. To request proof of the Authorization granted for Processing, except when expressly exempted as a requirement for Processing pursuant to article 10 of Law 1581 of 2012, as in the case of Public Personal Data.

11.3. To be informed by Gralcey or its Processors, upon request, about the use that has been made of your Personal Data. Additionally, you have the right to request an explanation of any automated decision that is unfavorable to you.

11.4. To file complaints with the SIC for violations of the Colombian Regulations.

11.5. To revoke the Authorization and/or request the deletion of your Personal Data when the constitutional or legal principles, rights and guarantees are not respected, or at the Data Subject's will. This revocation or deletion will not proceed when there is a legal or contractual duty to remain in the database.

11.6. To freely access your Personal Data that has been subject to Processing.

11.7. To refrain from answering questions about Sensitive Personal Data, in which case the response will be optional.

11.8. To object to the Processing of your Personal Data that you have authorized for Accessory Purposes to the execution of the contract or provision of the Services, without their refusal affecting the continuity of (or access to) the main service.

The exercise of these rights is free of charge and shall at all times comply with the provisions of current personal data protection legislation.

Gralcey has designated the Legal department as the internal party responsible for personal data protection and for handling queries, complaints and requests from Colombian Users related to the exercise of their rights. The channel available for the receipt, management and follow-up of this type of requests is the email address [email protected]. Communications received through this channel will be processed pursuant to the procedures established in this Annex and the Colombian Regulations.

13.1. Queries. If you are the Data Subject or one of the persons authorized pursuant to Section 13.4, you may submit queries to know and access the Data Subject's Personal Data, inquire about the use that has been made of it and obtain proof of the Authorization granted. For this purpose, you must take the following into account:

13.1.1. The aforementioned rights shall be guaranteed through the submission of queries and all information linked to the identification of the Data Subject or that which you expressly requested shall be provided.

13.1.2. The request must include: (i) the identification of the Data Subject; (ii) description of the matter subject to the query; and (iii) physical or electronic address for sending notifications to you.

13.1.3. Gralcey may request additional requirements aimed at verifying the identity of the applicant and their standing to submit the query.

13.1.4. To protect information, Personal Data will only be provided to the persons indicated in Section 13.5.

13.1.5. The query will be addressed within a maximum period of ten (10) business days counted from the date of receipt.

13.1.6. If it is not possible to address it within said period, we will inform you of the reasons for the delay and the estimated response date, which may not exceed five (5) business days following the expiration of the first period.

13.2. Complaints. If you are the Data Subject or one of the persons authorized pursuant to Section 13.4, you may submit complaints when you consider that the Data Subject's information should be corrected, updated or deleted, when you detect an alleged breach of legal duties or this Annex, as well as to request the revocation of the Authorization granted or to object to the Processing of Personal Data for Accessory Purposes. For this purpose, you must take the following into account:

13.2.1. The request must include: (i) identification of the Data Subject; (ii) description of the facts supporting it; (iii) physical or electronic address for sending notifications to you; and (iv) documents supporting the request.

13.2.2. If you submit the complaint incompletely (by failing to meet any of the above requirements), we will request within five (5) business days following its receipt that you complete it. If the requirement is not met within a period of two (2) months, it will be understood that you have withdrawn the complaint.

13.2.3. Once the complete complaint has been received, a notice stating "complaint in process" and its reason will be included in the database within no more than two (2) business days, which will be maintained until the complaint is resolved.

13.2.4. The maximum period to address the complaint will be fifteen (15) business days counted from the day following its receipt.

13.2.5. If it is not possible to address it within said period, we will inform you of the reasons for the delay and the new response date, which may not exceed eight (8) business days following the expiration of the first period.

13.3. Revocation of Authorization, objection and request for deletion of Personal Data. As a Data Subject or authorized person pursuant to Section 13.4, you may at any time request the revocation of the Authorization granted and/or the deletion of Personal Data, as well as object to Processing when it is not necessary for the fulfillment of legal, contractual or regulatory obligations, or when it involves Accessory Purposes.

However, such requests will not proceed when, as a Data Subject, you have a legal or contractual duty to remain in Gralcey's databases, or when they involve Necessary Purposes.

13.4. Standing to exercise rights. Queries and complaints may be submitted by the Data Subject directly, or by other persons authorized by Law, namely:

13.4.1. The Data Subject, who must verify their identity through the means available to Gralcey.

13.4.2. Their successors, upon proving such status.

13.4.3. The legal representative or attorney-in-fact, provided that the representation or power of attorney granted is validly demonstrated.

13.4.4. Third parties acting on behalf of or for another, when the Law permits it.

13.4.5. In the case of children and adolescents, the persons legally authorized to represent them.

13.5. Persons to whom information may be provided. To protect your information, Gralcey will only deliver or allow access to Personal Data to the following persons:

13.5.1. To Data Subjects, their successors or their legal representatives.

13.5.2. Public or administrative entities in the exercise of their legal functions or by judicial order.

13.5.3. To third parties authorized by the Data Subject or by Law.

13.6. Complaints to the data protection authority. As established by the Colombian Regulations, before submitting a complaint to the Superintendencia de Industria y Comercio, it is important that you contact Gralcey and process the respective query or complaint. Once this has been done, you may go to the authority to present your case.

The databases in which Colombian Users' Personal Data is stored will be processed for the reasonable and necessary time to fulfill the purposes described in this Annex and in the Authorizations granted by Data Subjects. Once such purpose(s) have been fulfilled and provided there is no legal or contractual duty to retain such information, it will be deleted from Gralcey's databases.

This Annex comes into force as of September 2, 2026.