Target

 To provide the Policy to be followed by AVANZA CASA DE VALORES, S.A., in the collection and protection of personal data and to guarantee the adequate administration of it, from its collection, its use and with whom we share such information.

This Policy complements all previous Contracts, whether written or verbal, between the client, collaborator, supplier or person who for any other reason shares its data with AVANZA CASA DE VALORES, S.A, with respect to the collection, use and disclosure of personal, commercial or financial information.

General considerations

 This Policy is based on Law 81 of March 26, 2019 of the Republic of Panama on Personal Data Protection, which seeks the protection of the rights of natural persons in their capacity as holders of their personal data concerning the use of such data and Executive Decree 285 of May 28, 2021 which regulates it.

Law 81 of March 26, 2019, establishes the regulatory standards for the treatment of databases that store or contain personal data of nationals or foreigners residing in the Republic of Panama.

AVANZA CASA DE VALORES S.A., is also regulated by special laws such as Law 23 of April 27, 2015, Securities Market Law and Agreements issued by the Superintendence of the Securities Market of Panama, which contemplate the control and management criteria regarding data confidentiality.

Article 5 of Law 81 establishes that the storage or transfer of personal data that is sensitive, confidential or restricted, is permitted if it complies with the personal data protection standards established in that Law. However, the database of subjects regulated by special laws are exempted for purposes of the requirements contained in the aforementioned article 5, a) in the case of stock market transfers, and b) when the transfer is necessary for the preparation or execution of the stock market account contract of AVANZA CASA DE VALORES S.A., which implies that the custody relationship is carried out through a global account by means of a contractual relationship with the final custodians.

Due to the nature of the activity carried out by AVANZA CASA DE VALORES, S.A., under the license granted to it by the Superintendence of Securities Market, and based on the second paragraph of Article 5 of Law 81 of March 26, 2019, the exception to the database of subjects regulated by special laws applies to the Securities House, provided that the special laws that regulate AVANZA CASA DE VALORES S.A., establish minimum standards necessary for the correct protection and treatment of personal data. In this sense, AVANZA CASA DE

VALORES, S.A., establish minimum standards necessary for the correct protection and treatment of personal data.  In this sense, AVANZA CASA DE VALORES, S.A., the exception referred to is subject to: (a) the Securities Market Law; (b) Law 23 which adopts measures to prevent money laundering, financing of terrorism and financing of the proliferation of weapons of mass destruction; (c) Agreement 6 of 2015 which dictates the provisions applicable to financial regulated entities regarding the prevention of crimes of money laundering, financing of terrorism and financing of proliferation of weapons of mass destruction and; d) Agreement 5 of 2018 which establishes the general guidelines for information technology risk management issued by the Superintendence of the Securities Market of Panama, which together and in compliance with the provisions of the National Constitution of the Republic of Panama, AVANZA CASA DE VALORES S.A., guarantees the levels of protection of personal data. Notwithstanding the foregoing, this policy has been designed with attention to the regulations contained in Law 81 of March 26, 2019.

Pursuant to the stock exchange account contract signed by AVANZA CASA DE VALORES, S.A. with its clients, all information received is confidential and its treatment, therefore, must not be transferred or delivered by AVANZA CASA DE VALORES S.A., except in the following cases: a) when the information is in the public domain; b) when the information is required by the competent authority in accordance with the law; c) when it is requested by a third party custodian and/or correspondent in connection with the custody relationship in a global account.

Every employee of AVANZA CASA DE VALORES, S.A., subscribes at the beginning of the work relationship, an Agreement of Confidentiality of Information that establishes the assumption of obligations on the occasion of the rendering of services that will be in force during the entire work relationship and up to 2 years after the end of the work relationship.

Likewise, the collaborator of AVANZA CASA DE VALORES, S.A., who has access to and is involved in the processing of personal data, is aware of his obligation to keep the data confidential, which does not cease because he has finished his activities in this area (article 9 Law 81) and to take care of the database with the due diligence required (article 14).

Information to Third Parties. AVANZA CASA DE VALORES, S.A., may not disclose information about its clients or about their investment accounts or transactions in securities carried out, unless there is express authorization from the Client authorizing AVANZA CASA DE VALORES, S.A., to disclose information related to the details of their transactions to third parties. Such authorization will not be necessary when the information must be disclosed to official offices or agencies, in order to assist them in any investigation or audit.

The Client authorizes AVANZA CASA DE VALORES, S.A., to execute orders or instructions from global accounts through other brokerage firms, intermediaries or brokers authorized to act in stock exchanges and securities markets.

In this order of ideas, AVANZA CASA DE VALORES, S.A., uses the personal data only for the determined, explicit and lawful purposes indicated in the Stock Brokerage Contract, thus guaranteeing compliance with article 11 of Law 81.

General Principles on which we are based:

For the purposes of this Policy, AVANZA CASA DE VALORES, S.A., adheres to the definitions of the guiding principles established in the text of Law 81, which read as follows:

1. Principle of Loyalty: personal data must be collected without deception or misrepresentation and without using fraudulent, unfair or unlawful means.
2. Principle of purpose: personal data must be collected for specific purposes and not be subsequently processed for incompatible or different purposes for which they were requested, nor be kept for longer than necessary for the purposes of processing.
3. Principle of proportionality: only data that are adequate, relevant and limited to the minimum necessary in relation to the purpose for which they are required should be requested.
4. Principle of truthfulness and accuracy: personal data shall be accurate and updated so that they truthfully reflect the current situation of the data owner.
5. Principle of data security: those responsible for the processing of personal data must adopt the necessary technical and organizational measures to ensure the security of the data in their custody, especially in the case of data considered sensitive, and inform the owner, as soon as possible, when the data have been removed without authorization or there are sufficient indications that their security has been breached.
6. Principle of Transparency: any information or communication to the owner of the personal data related to the processing of such data must be in simple and clear language, and keep him/her informed of all the rights he/she has as owner of the data, as well as the possibility of exercising his/her rights.
7. Principle of Confidentiality: all persons involved in the processing of personal data are obliged to maintain secrecy or confidentiality regarding the processing of data, preventing unauthorized access or use.
8. Principle of Lawfulness: in order for the processing of data to be lawful, it must be collected and processed with the prior, informed and unequivocal consent of the data owner or on legal grounds.
9. Principle of Portability: the data subject has the right to obtain from the data controller a copy of the personal data in a structured manner in a generic and commonly used format.

Definitions

For the purposes of this Policy, AVANZA CASA DE VALORES, S.A., abides by the definitions that apply and that are established in the text of Law 81, which read as follows:

1. Data Storage: Preservation or custody of data in a database established in any medium provided, including Information and Communication Technologies (ICTs).
2. Database: An ordered set of data of any nature, whatever the form or modality of its creation, organization or storage, which allows data to be related to each other, as well as to carry out any type of processing or transmission of such data by its custodian.
3. Data Blocking: Temporary restriction of any access to or processing of stored data.
4. Collaborator: employees, personnel on leave and personnel performing outsourced functions within the Company.
5. Consent: Manifestation of the will of the owner of the data, by means of which the processing of these is carried out.
6. Global Accounts: is that account in the name of AVANZA CASA DE VALORES, S.A., in which the financial assets of several clients are grouped, under the indirect holding regime contemplated in the Securities Market Law, held in another local or foreign financial intermediary previously authorized by the Superintendence of the Securities Market of the Republic of Panama.
7. Custodian of the database: Natural or legal person, public or private law, lucrative or not, who acts on behalf and for the account of the data controller and is responsible for the custody and conservation of the database.
8. Confidential data: Data that by its nature should not be public knowledge or unauthorized third parties, including those that are protected by law, by confidentiality or non-disclosure agreements, in order to safeguard information. In the cases of the Public Administration, are those data whose processing is limited to the purposes of this administration or if the express consent of the owner is given, without prejudice to the provisions of special laws or regulations that develop them. Confidential data will always have restricted access.
9. Personal data: Any information concerning natural persons, which identifies them or makes them identifiable.
10. Sensitive data: Data that refers to the intimate sphere of its owner or whose improper use may give rise to discrimination or entail a serious risk for the owner. By way of example, personal data that may reveal aspects such as racial or ethnic origin; religious, philosophical and moral beliefs or convictions; union membership or political opinions; data relating to health, life, sexual preference or orientation, genetic data or biometric data, among others, subject to regulation and aimed at univocally identifying a natural person, are considered sensitive.
11. Deletion or cancellation of data: the permanent deletion or cancellation of data stored in databases, regardless of the procedure used for such deletion or cancellation.
12. Accessible source: Databases that are not of restricted access or contain any reservation for consultation, or that are of public access such as official government publications, the media, telephone directories and the list of persons belonging to a group of professionals containing only name, title or profession, activity, work or business address, as well as information indicating their membership in organizations.
13. Data Modification: Any change in the content of data stored in databases.
14. Disassociation or anonymization procedure: Any data processing that prevents the information available in the database from being associated with a specific or determinable natural person.
15. Supplier: Natural or legal person rendering professional services to AVANZA CASA DE VALORES, S.A.
16. Responsible for data processing: Natural or legal person, public or private law, for profit or not, who is responsible for the decisions related to the processing of data and who determines the purposes, means and scope, as well as issues related to these.
17. Data owner: Natural or legal person to whom the data refers.
18. Transfer of data: Making known, disclosing, communicating, exchanging and/or transmitting, in any form and by any means, from one point to another, intra or extra-border, the data to natural or legal persons other than the holder, whether determined or undetermined.
19. Data processing: Any operation or complex of operations or technical procedures, whether automated or not, that makes it possible to collect, store, record, record, organize, elaborate, select, extract, confront, interconnect, associate, dissociate, communicate, assign, exchange, transfer, transmit or cancel data, or use them in any other way.

Information Collection and Personal Data Processing Procedure.

As a brokerage firm, we collect personal data as part of our professional activities in order to serve our clients and comply with the legal regulations that apply to us.

We never collect personal data without your knowledge and consent. We do not use your personal data for purposes other than those stated, nor do we disclose or sell your personal information or business contact information to third parties to enable them to market their products and services.

When the client requests a service or quote for a service, AVANZA CASA DE VALORES, S.A., may collect your information and data as part of the introduction process to assist you in your financial investment needs, thus complying with the obligations established in the regulations and also to verify that the information provided is correct and up to date. We only collect data through legal and consensual means.

Basically personal data is collected to identify the customer, such as full name, date of birth, nationalities, passport number, and identity card. Contact data, physical address, e-mail address, telephone numbers. Information necessary to comply with the Due Diligence Law mandated by the legislation in force in Panama that regulates the matter and the AVANZA CASA DE VALORES, S.A. Know Your Customer Policy, which include a copy of the identification document, proof of address, among others.

AVANZA CASA DE VALORES, S.A., uses personal data only in our regular professional activities and to comply with the contracts and agreements signed to provide services, perform verifications for possible conflicts or anti-money laundering searches.

We will keep personal data for a minimum of five (5) years after the end of the business or contractual relationship.

Our website www.avanzacv.com does not collect personal data through cookies or similar methods. However, the website uses the Google Analytics service, which is operated by Google Inc. based in California, USA. Google Analytics provides reports on the use of our website and general statistics about the people who visit us, such as country, browser type, general interests, etc. At no time do these reports allow us to identify a specific person through these reports. We use the service in order to optimize the performance and security of the technology platform, as well as to provide more relevant content.

If the client, through the contact form, provides us with his contact data to communicate with AVANZA CASA DE VALORES, S.A., his data will be passed to the person indicated to attend his message. It is not used for any other purpose. If a commercial relationship does not materialize, your data will be discarded after an appropriate period of time.

By visiting the social networks of AVANZA CASA DE VALORES, S.A., on Twitter (X now) and Instagram, the person or visitor will have accepted the Data Protection Policies of these networks. AVANZA CASA DE VALORES, S.A., does not collect data from the person or offer advice through social networks.

When dealing with a supplier of ours, we may ask you for general information about your business in order to perform due diligence and assess the risk of a contractual relationship. We will store the personal data you provide to us in the course of the business relationship for a minimum of 5 years after termination of the contractual relationship. All our suppliers have signed a confidentiality agreement.

In the case of an employee (collaborator) or employee candidate, we collect the information you provide in your resume. Additionally, if required, we may collect additional information through forms, interviews or references. This information is used for the purpose of evaluating candidates to fill a job position in AVANZA CASA DE VALORES, S.A. If you are not hired, we keep your data for a period of 12 months and then we delete it. In case you are hired, your information will be part of the database of collaborators (employees) and your personal file, so additional information may be requested and stored in order to develop the employment relationship.

Every employee of AVANZA CASA DE VALORES, S.A., subscribes at the beginning of the work relationship, an Agreement of Confidentiality of Information that establishes the assumption of obligations on the occasion of the rendering of services that will be in force during the entire work relationship and up to 5 years after the end of the work relationship.

In the course of our business relationship, we provide information to AVANZA CASA DE VALORES, S.A. personnel for reasonable business purposes and to provide services to you. Our staff is trained to maintain the confidentiality and security of your data.

As long as there is a business relationship, the customer shall at all times provide updated personal information and shall notify changes in order to proceed to update the database.

All our employees have signed a confidentiality agreement and receive continuous training on confidentiality policies and protocols, data protection and code of conduct, among others.

In order to provide some of our services we may sometimes resort to external service providers or professionals who work with us, such as translators, consultants, IT service providers, banks and others, who may have access to personal data. AVANZA CASA DE VALORES, S.A., and requests these providers to comply with practices and policies that ensure the security and confidentiality of personal data and that they are not used for purposes other than those specified in this document.

AVANZA CASA DE VALORES, S.A., has the obligation to provide information such as personal data and basic information to governmental authorities when requested and must be delivered according to the law.

Regarding the security of the information, AVANZA CASA DE VALORES, S.A., collects information that is used strictly for the indicated purposes. The access of our collaborators to the information is restricted and limited only to those who have authorization and training in the proper handling of personal data information.

AVANZA CASA DE VALORES, S.A., has adopted physical, electronic and procedural security protections, among others, to guarantee that the information is kept confidential and secure as required by law and our policies.

Data Controller

AVANZA CASA DE VALORES, S.A., is the entity responsible for the processing of personal data, and therefore, it is responsible for the decisions related to the processing of personal data obtained from all persons, with whom it relates, determining the purposes, means and scope of the processing of personal data obtained.

Validity and Change Control.

This Data Protection Policy has been approved by the Board of Directors of AVANZA CASA DE VALORES, S.A. and is effective as of the date indicated in its heading. Furthermore, it may be modified or updated at any time by decision of the Board of Directors of AVANZA CASA DE VALORES, S.A. Any modification will be applicable as of its approval.