PRIVACY POLICY

1. Purpose

This Privacy Policy describes how Alma Technologies LLC. (“ALMA”) collects, uses, stores, protects, shares, and, when appropriate, deletes personal data related to its websites, applications, services, artificial intelligence agents, and other technological functionalities.

ALMA recognizes that the protection of personal data is an essential component of trust, security, and responsible governance of its services.

This Policy should be interpreted in conjunction with the Terms and Conditions of Use and, when applicable, with contracts, Data Processing Agreements (“DPA”), confidentiality agreements, or other instruments entered into between ALMA and its clients.

2. Identification of ALMA

The responsible party for this Policy is:

Alma Technologies LLC.

1600 Van Lennen Ave, Suite 101

Cheyenne, WY 82001

United States

General contact: contacto@goalma.ai

Privacy: privacidad@goalma.ai

3. Scope

This Policy applies to the processing of personal data carried out by ALMA in relation to:

a. visitors to ALMA's website;

b. registered users of its services;

c. representatives, employees, and collaborators of clients or potential clients;

d. individuals who communicate with ALMA;

e. providers and other professional contacts;

f. information processed through ALMA's services when ALMA determines the purposes and means of such processing; and

g. other individuals whose personal data is processed directly by ALMA in the course of its activities.

When ALMA processes personal data contained in documents, files, databases, or other information provided by a client following their instructions, ALMA may act as a data processor, processor, service provider or equivalent figure under applicable law.

In such cases, the client may act as the data controller or controller and the specific conditions of the processing may be regulated by a DPA or other contractual instrument.

4. ALMA's Roles in Data Processing

ALMA's legal function regarding personal data will depend on the context in which it is processed.

ALMA may act as the data controller with respect to data necessary to manage accounts, handle business relationships, billing, security, support, communications, website operation, and other purposes specific to ALMA.

ALMA may act as the data processor when processing personal data on behalf of and following the instructions of a client as part of the contracted services.

The determination of these roles will be made considering the nature of the processing and the applicable legislation, and not exclusively the designation used in this Policy.

5. Personal data that we may process

Depending on the relationship with ALMA and the services used, we may process the following categories of data:

Identification and contact data: name, surname, email address, phone, company, position, and other professional data.

Account data: user identifiers, associated organization, account settings, roles, permissions, and data related to authentication and access.

Commercial and contractual data: information related to proposals, contracts, contracted services, billing, payments, and business relationship.

Technical and usage data: IP address, access logs, device, browser, security events, session information, and technical data related to the use and operation of the services.

Support and communication information: inquiries, requests, communications, and background provided when interacting with ALMA.

Information contained in documents or data provided by clients: ALMA's services allow processing of documents, files, evidence, databases, and other information that may contain personal data.

ALMA does not require clients to provide personal data that is not necessary for the purpose of the service and promotes the application of data minimization criteria.

6. Sources of personal data

ALMA may obtain personal data directly from the person, from the organization to which they belong, from clients who use our services, from interactions with our sites and applications, from technology providers used to operate the services, and from legitimately accessible sources when necessary for an authorized purpose.

When a client provides personal data of third parties, they will be responsible for having the necessary powers, authorizations, or legal bases to do so as required by applicable law.

7. Purposes of processing

ALMA may process personal data for:

a. providing and operating its services;

b. managing accounts, users, and access;

c. processing documents and information according to the requested functionalities;

d. authenticating users and protecting their accounts;

e. providing support;

f. managing business and contractual relationships;

g. processing billing and payments;

h. maintaining the security of the services;

i. detecting, investigating, and preventing fraud, abuse, unauthorized access, and incidents;

j. maintaining traceability and observability;

k. improving the reliability, security, and technical functioning of the services;

l. fulfilling legal and contractual obligations;

m. exercising or defending rights; and

n. communicating with clients, users, and professional contacts.

ALMA will limit processing to legitimate, specific, and compatible purposes with the relevant context, in accordance with applicable law.

8. Legal bases

When the applicable legislation requires identifying a legal basis for processing, ALMA may rely, as appropriate, on the execution of a contract or pre-contractual measures, compliance with legal obligations, legitimate interests of ALMA or third parties, consent of the data subject, or another legally recognized basis.

The applicable basis will depend on the nature of the data, the purpose of the processing, the relationship with the data subject, and the relevant jurisdiction.

When ALMA acts as a data processor, it will process personal data in accordance with the documented instructions of the client and the applicable contractual conditions.

9. Client Information

The documents, files, data, and other information provided by clients to ALMA are considered "Client Information" in accordance with the Terms and Conditions of Use.

The client retains the rights that correspond to them over such information.

ALMA will use the Client Information only to the extent necessary to provide the contracted services, execute the requested functionalities, maintain the security and operation of the services, and comply with applicable legal or contractual obligations.

ALMA will not use the confidential content provided by a client to develop products intended for other clients or for purposes independent of the provision of the contracted service.

10. Artificial intelligence and personal data

Certain functionalities of ALMA use artificial intelligence systems to process documents, analyze information, perform extractions, classifications, evaluations, or generate other results.

Depending on the functionality, such processing may use artificial intelligence agents, foundational models, retrieval-augmented generation (RAG) systems, knowledge bases, rules, methodologies, and other technological components.

When the processed information contains personal data, ALMA will apply the corresponding privacy, security, access, traceability, and governance controls according to the nature and risk of the processing.

The use of artificial intelligence does not modify the data protection obligations that correspond to ALMA, its clients, or its suppliers.

11. Model Training

ALMA will not use Customer Information to train, retrain, or perform fine-tuning of general foundational models, whether its own or those of third parties, unless expressly authorized by the client.

ALMA will also not use the content of documents, data, or confidential information provided by clients to develop products intended for other clients or for purposes independent of the contracted service.

This restriction does not prevent the processing of technical or operational information strictly necessary to operate, protect, monitor, and maintain the services, manage incidents, maintain traceability, perform billing, or fulfill legal or contractual obligations.

Such technical or operational information will not be used as a mechanism to reuse the client's confidential content for training or product development purposes for third parties.

12. Technical Information, Telemetry, and Records

ALMA may generate and retain technical records related to the operation of the services.

These records may include execution identifiers, system events, access logs, performance information, errors, security events, feature usage, component versions, and other information necessary to provide traceability, observability, security, and reliability.

ALMA will seek to limit the information contained in these records to that reasonably necessary for such purposes.

Technical logs will not be used as a mechanism to appropriate or reuse the client's confidential content for purposes other than those authorized.

13. Providers and subprocessors

ALMA uses technology providers to provide certain capabilities necessary to operate its services.

These may include cloud infrastructure providers, artificial intelligence, databases, storage, authentication, observability, security, processing, communications, support, and deployment.

When such providers process personal data on behalf of ALMA, their use will be subject to evaluation and management according to the nature of the service, associated risks, and applicable legal and contractual obligations.

ALMA may maintain a List of Subprocessors that is separate and updated, identifying the relevant providers for the processing of Customer Information.

The use of a particular provider may change as a result of technological evolution, security, availability, quality, risk, or operational needs.

When appropriate, ALMA will manage such changes in accordance with applicable information or contractual obligations.

14. Communication of personal data

ALMA does not sell Customer Information.

ALMA may communicate personal data when necessary to provide services through authorized providers; comply with a legal obligation or valid request from a competent authority; protect the rights, security, or integrity of ALMA, its customers, users, or third parties; investigate fraud, abuse, or security incidents; execute a legitimate corporate operation, subject to the corresponding safeguards; or when there is authorization from the data subject or the customer when necessary.

ALMA will not communicate personal data to third parties for purposes incompatible with those for which they were obtained, unless there is a legal basis that allows it.

15. International transfers

ALMA is a company incorporated in the United States and uses infrastructure and technology providers that may operate from different jurisdictions.

Consequently, certain personal data may be processed or stored outside the country where the user, customer, or data subject is located.

When applicable law establishes requirements for international transfers of personal data, ALMA will use the legal mechanisms and safeguards that correspond according to the jurisdiction, nature of the processing, and involved providers.

The location of providers or infrastructure will not be presented by ALMA as equivalent, by itself, to compliance with a specific data protection law.

16. Retention and deletion

ALMA will retain personal data for the period reasonably necessary to fulfill the purposes for which it was processed and the applicable legal, contractual, security, traceability, or rights defense obligations.

Retention periods may vary depending on the category of information, nature of the service, contractual relationship, legal requirements, and associated risks.

When ALMA processes data on behalf of a client, retention and deletion may additionally be governed by the client's instructions and the corresponding DPA or contract.

Once the need for retention has ended, ALMA will take reasonable measures to delete, anonymize, or keep the information protected when its retention continues to be legally necessary.

6. Seguridad de la información

ALMA maintains technical and organizational measures aimed at reasonably protecting personal data and Client Information against unauthorized access, use, modification, disclosure, loss, or destruction.

These measures are determined considering the nature and sensitivity of the information, technological architecture, identified risks, criticality of the service, and applicable obligations.

They may include, as appropriate, access controls, authentication, encryption, logical segregation, credential and secret management, activity logs, monitoring, backup, vulnerability management, change management, and incident response mechanisms.

No technological system can guarantee absolute security, and ALMA does not make such a guarantee.

18. Privacy and security incidents

ALMA maintains mechanisms to identify, assess, contain, investigate, and manage incidents that may compromise personal data or Customer Information.

When an incident generates a notification obligation, ALMA will make the required communications in accordance with applicable legislation, its role regarding the affected data, and the corresponding contractual obligations.

When ALMA acts as a data processor, it will reasonably collaborate with the client so that they can fulfill their corresponding obligations.

19. Rights of the data subjects

Depending on the applicable legislation and the circumstances of the processing, a person may have rights regarding their personal data, including access, information, rectification, updating, deletion, opposition, restriction, portability, withdrawal of consent, or other rights recognized by the relevant jurisdiction.

These rights are not absolute and may be subject to legal requirements, exceptions, or limitations.

Requests may be addressed to:

privacidad@goalma.ai

ALMA may request reasonably necessary information to verify the identity of the requester and protect the data against fraudulent or unauthorized requests.

When ALMA acts solely as a data processor on behalf of a client, it may forward the request to the corresponding client or collaborate with them to respond, as appropriate.

20. Automated decisions and classifications

Certain services of ALMA may perform classifications, prioritizations, assessments, or automated analyses related to documents, obligations, risks, evidence, or other elements inherent to the services.

These functions do not necessarily imply the adoption of automated decisions about individuals.

When a functionality involves automated processing of personal data that produces legal effects or significantly similar effects on an individual, ALMA will evaluate the specific obligations that apply, including, when appropriate, information requirements, human intervention, risk assessment, or other rights of the data subject.

ALMA will not presume that all technical classifications constitute profiling or an automated decision about individuals; such determination will depend on the nature, purpose, and actual effects of the processing.

21. Sensitive personal data

ALMA's services are not designed to systematically require sensitive personal data unless such data is necessary for a legitimate purpose of the service and its processing is legally permitted.

Clients should avoid providing sensitive personal data that is not necessary for the provision of the service.

When ALMA must process them, it will apply measures proportional to their nature and risk and the additional conditions established by applicable legislation.

22. Minors

ALMA's services are primarily directed at organizations and professionals and are not designed to be used directly by minors.

ALMA does not intentionally seek to collect personal data from minors through its general services.

If ALMA becomes aware that it has directly collected personal data from a minor without the required authorization under applicable legislation, it will take reasonable corresponding measures.

The above does not prevent legitimately processed documents by clients from containing information related to minors when there is a valid purpose and legal basis for such processing.

23. Cookies and similar technologies

The website and services of ALMA may use cookies and similar technologies necessary for authentication, security, functionality, preferences, measurement, or usage analysis.

When applicable legislation requires consent or another choice mechanism regarding certain cookies or technologies, ALMA will implement the corresponding controls.

Specific information about the technologies used may be provided through a notice or Cookie Policy when appropriate.

24. Commercial communications

ALMA may use professional contact data to send communications related to its services, activities, or business relationship when there is a legitimate basis for doing so.

Individuals may request to stop receiving commercial communications through the mechanisms provided in such communications or by writing to ALMA.

Operational, security, contractual, or service-related communications may continue when necessary even if an individual has opted not to receive commercial communications.

25. Applicable law and international scope

ALMA operates internationally and its activities may be subject to different data protection regimes depending, among other factors, on the location of the data subject, location of the client, nature of the processing, establishment of the parties, and territorial scope of the applicable legislation.

ALMA will evaluate the applicable obligations according to each context and does not assume that a specific legislation applies universally to all its treatments.

When applicable, ALMA will take the necessary measures to comply with the corresponding mandatory obligations.

This Policy should not be interpreted as a certification statement under a specific norm or standard nor as an assertion that all existing privacy legislations are simultaneously applicable to ALMA.

26. Privacy in Chile

As of the publication date of this Policy, the processing of personal data in Chile is mainly regulated by the Law No. 19,628 on the Protection of Private Life, without prejudice to other applicable regulations.

The Law No. 21,719, which substantially modifies the Chilean regime for the protection of personal data and creates the Agency for the Protection of Personal Data, was published and will come into effect on December 1, 2026.

ALMA will consider this new regulatory framework in its policies, procedures, contracts, and controls to incorporate the obligations that become applicable from its entry into force.

27. Privacy in the United States

Certain state privacy laws in the United States establish obligations depending, among other factors, on jurisdiction, activity performed, nature of the processing, and thresholds set by each legislation.

The existence of operations or users in a particular state does not necessarily imply that all the requirements of its general privacy legislation are applicable to ALMA.

When a state regulation is applicable, ALMA will adopt the corresponding measures and facilitate the rights that legally apply.

28. European Economic Area and other jurisdictions

When the General Data Protection Regulation of the European Union (“GDPR”) or other equivalent legislation is applicable to processing carried out by ALMA, the corresponding legal bases, transparency obligations, rights of the data subjects, requirements regarding processors, and international transfer mechanisms will apply.

The reference to the GDPR in this Policy does not imply that ALMA is subject to the GDPR regarding all its processing nor does it constitute a certification of compliance.

29. Sale and commercial use of personal data

ALMA does not sell Customer Information nor does it use its confidential content as data products for third parties.

When applicable legislation uses specific concepts such as “sale”, sharing, targeted advertising, or other legally defined processing, ALMA will evaluate its activities according to those definitions and enable the required mechanisms when appropriate.

30. Changes to this Policy

ALMA may update this Policy as a result of changes in its services, architecture, providers, processing practices, applicable legislation, or governance system.

When a change is material, ALMA will adopt reasonable mechanisms to inform affected users or customers when appropriate.

The current version will indicate its publication date.

31. Contact and privacy requests

Inquiries, requests, or complaints related to privacy or data protection may be directed to:

Alma Technologies LLC.

1600 Van Lennen Ave, Suite 101

Cheyenne, WY 82001

United States

Privacy email: privacidad@goalma.ai

General contact: contacto@goalma.ai