AUTHORIZATION FORMAT FOR THE PROCESSING OF PERSONAL DATA OF USERS LOCATED IN COLOMBIA – GRALCEY S.A.

I authorize Gralcey S.A., a commercial company identified with RUT No. 218765580018, domiciled at Andes 1365, office 308, Montevideo, Uruguay (ZIP 11.000) and telephone (011) 2821-0044 (the "Company"), as data controller, to collect, store, record, use, circulate and delete my personal data provided throughout the registration process in the belo.app mobile application (the "Application") and those delivered and generated thereafter, for the following purposes, either directly or with the support of third parties:

(i) Register my personal data in the Company's databases, identify me as the data subject and allow my registration, access, use and navigation in the Application and website; (ii) verify and validate my identity at the time of onboarding and throughout the contractual relationship, including the consultation and verification of my information in public or private, national or international sources, such as restrictive lists, in accordance with fraud prevention controls, identity impersonation, counterparty knowledge and compliance with regulations on the prevention of money laundering, terrorist financing and proliferation of weapons of mass destruction; (iii) provide me with the services offered through the Application and website, process my requests, operations and transactions, prepare and maintain the record of my operations and follow them up, manage services and payment processing, and prepare reconciliations and account statements; (iv) manage fraud prevention and transaction security, including transactional monitoring and detection of unusual or suspicious operations, as well as protect the rights, property and security of the Company, its affiliates, commercial partners and users; (v) respond to my requests, petitions, queries, complaints and claims and provide me with commercial, technical or administrative support; (vi) generate alerts, send me access credentials, one-time passwords (OTP) and inform about the status of operations, by email, SMS, push notifications, the Application, phone call or any other channel provided; (vii) comply with applicable legal, contractual and regulatory obligations, including reports and requirements from competent authorities, and defend the Company's interests in judicial, pre-judicial and administrative proceedings; (viii) prepare credit analysis profiles and carry out judicial and extrajudicial collection procedures, where applicable; (ix) determine, through geolocation and geofencing technology, the jurisdiction in which I am located, in order to enable or restrict Application features and ensure access to services enabled for my region; (x) carry out internal or external, national or international audit processes, and preserve their supporting documentation; (xi) transmit and/or transfer my personal data to third parties within and outside Colombia, respecting the legal guarantees applicable to each of these operations, including providers that assist the Company in providing its services, financial institutions, affiliated and/or related companies, as well as in events of merger, sale, reorganization, dissolution or audit processes; (xii) improve the services, features of the Application and website, user experience and security of the Company's technological infrastructure; (xiii) share, notify and receive my information from commercial partners, risk analysis and transactional monitoring providers, payment processors, acquiring entities, financial institutions and other third parties that participate, directly or indirectly, in the processing chain of the operations I carry out, even when there is no direct contractual relationship between such third parties and the Company, when necessary to prevent, detect, investigate or report operations linked to fraud, identity or account impersonation, money laundering, terrorist financing and proliferation of weapons of mass destruction and other illegal conduct or conduct that represents a risk to the community, as well as to respond to requests from the Company itself or from such third parties related to unusual or suspicious movements, which may imply the transfer of my personal data by the Company, both as issuer and as recipient of the information; and (xiv) any other purpose directly related to the execution of the relationship between me and the Company.

(i) Make contact for commercial, advertising or promotional purposes, of the Company or its affiliates and/or commercial partners, by email, SMS, push notifications, the Application, phone call or any other channel provided; (ii) carry out marketing activities, commercial prospecting and market studies, as well as develop internal studies on my interests and prepare profiles for commercial and promotional purposes; and (iii) develop statistical analyses aimed at designing commercial and promotional strategies and initiatives.

In any case, I declare that I have standing to share the personal data of third parties whose information I provide to the Company for regulatory compliance purposes and, where applicable, to carry out operations on digital assets.

The types of data that the Company may collect about me are: identification and contact data, user account data, transactional information, patrimonial and financial data, information collected for fraud prevention and compliance with anti-money laundering, terrorist financing and proliferation of weapons of mass destruction prevention regimes, data collected through cookies and similar technologies, geographic location data of the device, information obtained from restrictive list queries, judicial background checks and facial recording/image (the latter two being sensitive personal data). For further details on the information processed, I may consult the Colombia Annex of the Company's Privacy Policy, available at https://www.belo.app/co.

In particular, I authorize the Company to process my biometric personal data (facial recording/image), which are sensitive data, for purposes related to identity verification and authentication, fraud and impersonation prevention, validation of transactions considered high-risk, updating of personal data and processing of claims associated with the contractual relationship.

The Company will request, on a granular basis through the Application, authorization for the processing of this data and will clearly and simply inform the applicable purpose. The other information duties and minimum legal requirements applicable to such requests are understood to be fulfilled and are governed by the provisions of this format (for example, identification of the data controller, contact channels and my rights as data subject, among others).

Given that biometric personal data enable the unambiguous identification of individuals and, considering advances in fraud, identity impersonation and cybercrime techniques, the collection and processing of this personal data is necessary for the fulfillment of the aforementioned purposes.

During the registration process and/or the use of certain Application features, the Company may request, through my device, access to certain components or information thereof (for example, location, camera, storage or others), only when such access is strictly necessary to execute a specific feature or process. In such cases, the Company will dynamically request the corresponding permission and will clearly and simply inform the specific purpose associated with each access at the time it is required. The other information duties and minimum legal requirements applicable to such device access permission requests are governed by the provisions of this format (for example, identification of the data controller, contact channels and my rights as data subject, among others).

I acknowledge and authorize the Company to request additional information or personal data from me, or to update that already provided, in the following events: (i) when periodic information update processes are carried out; (ii) when, pursuant to my risk profile, the volume or nature of operations, or regulatory requirements, it is necessary to carry out due diligence processes involving the collection of additional information or documentation, including, but not limited to, financial statements, tax returns, employment certifications, supporting documentation for the origin and destination of funds, information on blockchain operations and other relevant documentation; (iii) when processing my requests related to the exercise of my rights, for which I may be required to provide documentation that allows verification of my identity; and (iv) when the Company deems it necessary to comply with legal, regulatory or contractual obligations, or to respond to requirements from competent authorities.

I declare, under oath, that the personal data and information provided to the Company during the registration process in the Application, as well as that provided thereafter, is true, complete, accurate and verifiable. I undertake to update such information immediately when it changes, or when the Company requests it as part of its monitoring, compliance or due diligence processes, especially when: (i) my identification, contact or location information changes; (ii) there is a change in the origin or destination of funds linked to transactions carried out in the Application; (iii) changes occur in my economic, financial or legal situation; or (iv) it is required pursuant to applicable regulations.

In any case, I declare that I was informed of the optional nature of allowing the processing of sensitive personal data (such as my judicial background checks and facial recording/image) for the purposes described above. I also declare that I was informed of the rights I have regarding my personal data: (i) to freely access, know, update and rectify personal data, (ii) to be informed about the use that has been made of them, (iii) to file complaints with the Superintendencia de Industria y Comercio de Colombia, once the query or complaint procedure before the Company has been exhausted, (iv) to request proof of the authorization granted, (v) to revoke such authorization, (vi) to request the deletion of personal data, and (vii) to object to processing with respect to Accessory Purposes as long as this does not affect the provision of the contracted services. These rights may be exercised by sending a communication to [email protected], which will be addressed pursuant to the procedures established in the Colombia Annex of the Company's Privacy Policy, available at https://www.belo.app/co; a site on which any material changes to the Policy will be disclosed.