Personal Data Processing Policy — THOMAS by Bitsideas

Drafting note: this document is a translation of the authoritative Spanish version (`politica-de-privacidad.md`); in the event of any discrepancy, the Spanish version governs, since Colombian law is the base framework chosen below. This policy uses Colombia's Law 1581 of 2012 (its implementing decree, now compiled in Title 25 of Unified Regulatory Decree 1074 of 2015, and SIC Circular 002 of 2024) as its base framework, since it is the most developed regime in this text and the Service's country of regulatory origin (see Terms and Conditions, clause 3.2). Bitsideas LLC provides the Service to Clients in Colombia and other Latin American countries; clause 2A explains how the Colombian regime applies to data subjects in Colombia and why, for data subjects in other countries, local data protection law may also apply — something that must be reviewed country by country as Bitsideas onboards Clients outside Colombia (Mexico, Peru, Chile, Brazil and other countries in the region each have their own regime, distinct from one another and from Colombia's). Clause 5 addresses the international transfer implied by the Controller itself being domiciled in the United States. Bitsideas LLC's identifying data were taken from its public record with the Florida Division of Corporations (Sunbiz.org, filing L21000359862) — verify it is still current before publishing. It remains for Bitsideas' team to verify whether it exceeds the SIC threshold for mandatory registration in the National Database Registry (RNBD, clause 11). A final review by licensed counsel in each country where Bitsideas has active Clients is recommended before publication.

Last updated: November 1, 2026 Data Controller: Bitsideas LLC, a limited liability company organized under the laws of the State of Florida, United States of America, EIN 61-2001549 (state filing L21000359862), with its principal address at 7630 NW 25 Street # 2B, Miami, FL 33122, United States. Contact for personal data matters: [email protected]

1. Purpose

This policy governs the processing of personal data that Bitsideas LLC ("Bitsideas", "we") collects through the THOMAS by Bitsideas platform (the "Service"), provided to Client companies in Colombia and other Latin American countries. As a general framework, this policy is built on Colombia's personal data protection regime — Law 1581 of 2012, its implementing decree (compiled in Title 25, Part 2, Book 2 of Decree 1074 of 2015) and the circulars of the Superintendency of Industry and Commerce (SIC) as the control authority — as the Service's country of regulatory origin, without prejudice to any data protection law that may equally apply in each Client's country of domicile under clause 2A.

2A. Territorial scope: a Controller domiciled abroad, and Clients in multiple countries

Bitsideas LLC is a company organized in the United States, with no domicile in any Latin American country. The personal data protection regime of each country where Bitsideas offers the Service applies, in principle, to data subjects located in that country, because the processing takes place in the context of offering goods or services there. Accordingly:

• With respect to data subjects in Colombia (Colombian Client companies

and their workers), Bitsideas assumes the obligations of Law 1581 of 2012 and its implementing decrees on the same terms as if it were domiciled in Colombia.

• With respect to data subjects in other countries where Bitsideas has

active Clients, local personal data protection law may equally apply (for example, the LFPDPPP in Mexico, the Personal Data Protection Law in Peru, Law 19.628 in Chile, or the LGPD in Brazil, each with its own requirements, distinct from one another). Bitsideas will assess and document that applicability on a country-by-country basis as it onboards Clients in each jurisdiction, and may supplement this policy with local addenda where required.

Bitsideas designates as its contact point for all these purposes the email address indicated at the beginning of this policy.

2. Roles: Controller vs. Processor

It is important to distinguish two different roles, which coexist in the operation of the Service:

• Bitsideas LLC acts as Data Controller with respect to the data of the

client company's contact persons (name, email, position, phone) collected during registration, the commercial relationship and billing, as well as with respect to navigation data on THOMAS's public site.

• Bitsideas LLC acts as Data Processor with respect to the data that each

client company (the "Client") enters about its own workers, contractors and third parties within the Service (behavior observations, incidents, risk matrix, medical fitness, driving licenses, contractor documentation, etc.). In this second case, the Client is the Controller of that data and determines the purposes of its processing; Bitsideas only processes it following the Client's instructions, reflected in the normal use of the Service's features, and under the terms of the data processing agreement constituted by this policy and the Terms and Conditions.

Accordingly, if you are a worker or contractor of a company that uses THOMAS and have questions about your own data, you should first contact that company (your employer or contracting party), not Bitsideas directly — see section 6.

3. Data collected

3.1. Account and billing data (Bitsideas as Controller)

Company name, tax ID, name, position, email and phone of the account administrator and other Users the Client registers, subscription and payment history (payment is made in Bitsideas One, through Stripe, without Bitsideas storing full card numbers; THOMAS does not charge or receive card data), IP address and technical access logs for security and audit purposes.

3.2. Operational occupational health and safety data (Bitsideas as Processor, on the Client's instructions)

Depending on the modules the Client uses, this may include:

• Name, national ID number, position, worksite and contact data of the

Client's workers and contractors.

• Safe/unsafe behavior observations, with or without identification of the

observer (the module allows anonymous reports).

• Investigation of workplace incidents and accidents, including root-cause

analysis and action plans.

• Medical fitness, category and validity of driving license (Road Safety

module).

• Compliance documentation of contractor companies uploaded through the

Contractor Self-Service Portal: workers' compensation affiliation, payroll contribution filings, insurance policies, PPE matrix, induction certificates and job competency certifications.

• Photographic and documentary evidence associated with observations,

incidents or inspections.

• Inventory of chemical substances and safety data sheets (SDS), and records

of hazardous waste disposal, which may include data of the person managing or certifying the disposal.

Some of this data — particularly data related to health and medical fitness — is considered sensitive data under article 5 of Law 1581 of 2012 and receives enhanced protection: it is only processed when necessary for the Client's occupational health and safety purposes, its processing is not subject to Bitsideas' authorization but to the authorization the Client itself obtains from its workers, and the Client is solely responsible for having that authorization before entering it into the platform.

3.3. Contractor Self-Service Portal data

When a Client's contractor company uses the Self-Service Portal (access via a unique link, without needing to create an account — see Terms and Conditions, clause 3.4), the data uploaded there is entered directly by that contractor company and is processed under the same rules as section 3.2: the Client that hired that company is the Controller of that data, and Bitsideas acts as Processor. Access to that portal is protected by a unique possession token and rate limiting to make unauthorized access attempts more difficult.

3.4. Public site navigation data

When visiting THOMAS's public site (before logging in), basic technical navigation data is collected (IP address, browser type, pages visited) for security purposes, abuse prevention (rate limiting) and aggregated site-usage analytics. See also section 10 on cookies.

4. Purposes of processing

• Providing the contracted Service (occupational health and safety

management, generating indicators, regulatory reports, notifications to supervisors and administrators).

• Processing payments and managing the subscription and billing.
• Sending operational communications: reminders about expiring licenses or

documents, incident notifications or pending review requests, payment confirmations, and service notices.

• Preventing fraud, abuse, and unauthorized access to the platform.
• Improving and providing technical support for the Service.
• Complying with legal obligations and responding to requests from competent

authorities.

5. Sub-processors used by Bitsideas

To operate the Service, Bitsideas uses the following providers, which act as sub-processors under Bitsideas' instructions and subject to contractual confidentiality and security obligations:

All of the above providers operate, in whole or in part, outside Colombia. More importantly still, Bitsideas itself — as both Controller and Processor — is domiciled in the United States, so that simply providing the Service implies, in practice, a continuous international transfer and transmission of Client Data to the United States, within the meaning of article 26 of Title 25 of Decree 1074 of 2015. Bitsideas ensures that this transfer has a valid legal basis — principally, the performance of the services agreement between the Client and Bitsideas, which necessarily requires processing outside Colombia given the nature of the Service — and applies the same security measures described in clause 9 to the data regardless of the country where it is processed. The Client, by accepting the Terms and Conditions and contracting the Service, expressly authorizes this international transfer and transmission as a condition inherent to the nature of the contracted Service.

5A. Artificial intelligence assistants connected by the Customer

On the Professional and Enterprise plans, an administrator of the Customer can create one or more MCP (Model Context Protocol) servers in THOMAS and connect them to an artificial intelligence assistant that the Customer has chosen and contracted on its own, such as Claude (Anthropic, PBC), ChatGPT (OpenAI), Microsoft Copilot (Microsoft Corporation) or Gemini (Google LLC).

How it works and what data leaves THOMAS:

• Each person authorizes their own connection: they sign in with their

Bitsideas One account and accept a permissions screen. The assistant acts with that person's permissions and only receives information from the modules the administrator enabled on the server and that the person can see according to their plan, their role and the modules assigned to them by the Customer.

• The assistant receives the information THOMAS returns in response to what the

person asks, for example a list of incidents, the status of contractors or the dashboard indicators. That information may contain personal data of workers, contractors and drivers, such as names, job titles and identification numbers. Identification numbers are masked (only the last four digits are shown) unless the administrator turns that option off.

• Health data is not provided to assistants: there is no access to absenteeism;

for an incident, the affected person and the incapacity are not provided, and its account is sent without the registered names and identification numbers; for a driver, medical fitness, restrictions and blood type are not provided.

• An assistant can only propose new records or changes (for example, an

observation, an incident or a task) when the server and the person's role allow it. Nothing is saved until the person confirms it, and the record is marked as made with an artificial intelligence assistant, with the name of the person who confirmed it. An assistant never approves, deletes, or changes users or roles.

• The administrator can pause or delete a server and remove access for any

connected person at any time.

Who is responsible for that data. Assistant providers are not processors or sub-processors of Bitsideas: Bitsideas does not choose them, does not engage them for this function and does not instruct them. The Customer decides to connect them, and information is delivered to the assistant on the Customer's instruction, as data controller. What the assistant provider does with that information —where it stores it, for how long, and whether it uses it to train its models— is governed by the contract and terms between the Customer (or its users) and that provider, which may operate outside Colombia. The Customer is responsible for having a legal basis for that transmission, informing data subjects of it where required, and choosing a service that offers adequate safeguards.

What Bitsideas processes to provide this function: the data of each connection (server, person, assistant and dates) and an activity log recording which tool was used, by whom and with what result, without storing what was asked or what was answered. That log is kept for one hundred eighty (180) days. The access credentials issued to the assistant are stored as a cryptographic hash, never in clear text.

6. Data subject rights

Every data subject has the right to: know, update and rectify their personal data; request proof of the authorization granted for its processing; be informed about the use given to their data; file complaints with the Superintendency of Industry and Commerce (SIC) for violations of the law; revoke the authorization and/or request deletion of the data when no legal or contractual duty prevents it; and access their personal data free of charge.

If you are a worker, contractor or third party whose data was entered by a company that uses THOMAS, your request to exercise these rights should first be directed to that company (your employer or contracting party), which is the Controller of that data under section 2. Bitsideas will cooperate with the Client, in its capacity as Processor, to handle the request within applicable legal deadlines (fifteen business days for inquiries and fifteen business days for complaints, extendable as provided by law).

If your request relates to data for which Bitsideas is the direct Controller (section 3.1: account, billing or navigation data), you may exercise your rights by writing to [email protected].

7. Authorization

Bitsideas' processing of personal data is based on the data subject's prior, express and informed authorization, obtained:

• Directly by Bitsideas, with respect to the data in section 3.1, through

acceptance of this policy during registration for the Service; and

• By the Client, with respect to the data in sections 3.2 and 3.3, as

Controller of that data vis-à-vis its own workers and contractors — the Client represents and warrants to Bitsideas, in the Terms and Conditions, that it has that authorization before entering information into the Service, particularly for sensitive data under section 3.2.

8. Retention period

Data will be retained while the contractual relationship with the Client is in effect, and for the additional time needed to meet legal, accounting, tax or legal-defense obligations. In particular:

• Client Data is retained for the duration of the subscription and up to

thirty (30) days after its termination, a period during which the Client may request its export (Terms and Conditions, clause 11). After that period, it is deleted from production systems, without prejudice to its temporary retention in encrypted backup copies under Bitsideas' backup rotation policy.

• Certain occupational health and safety records may be subject to minimum

retention periods under sector-specific regulations applicable to the Client (for example, those related to occupational medical records under Resolution 1995 of 1999 and its amendments). Compliance with those minimum periods is the Client's responsibility as Controller of that data; the Client must export the relevant information before requesting its deletion if it needs to retain it longer than described in the previous paragraph.

• Billing data is retained for the period required by Colombian accounting

and tax regulations.

9. Information security

Bitsideas implements reasonable technical and organizational measures to protect the personal data processed in the Service, including:

• Per-company data isolation through Row-Level Security in the PostgreSQL

database engine, so that no Client can access another Client's data.

• Encryption at rest of the disk that holds the database (256-bit AES,

managed by Microsoft Azure) and encryption in transit via TLS/HTTPS between the browser and the server.

• Access exclusively through Bitsideas One (OpenID Connect), with a mandatory

second factor. THOMAS does not store passwords. Cryptographically signed sessions.

• An audit trail of data-modification operations, and automated backup

rotation.

• Rate limiting on public access points, including the Contractor

Self-Service Portal.

No security measure is infallible; in the event of any security incident that compromises personal data, Bitsideas will notify affected Clients and, where required by law, the SIC, without undue delay.

10. Cookies and similar technologies

THOMAS's site uses strictly necessary technical cookies for the Service to function, particularly to keep authenticated Users' sessions active. These cookies are not used for advertising or cross-site tracking purposes. If analytics or third-party cookies are added in the future, this policy will be updated to disclose their purpose and offer visitors a way to manage them.

11. National Database Registry (RNBD)

Under Law 1581 of 2012 and Decree 90 of 2018, Data Controllers whose databases exceed the thresholds set by the SIC must register them in the National Database Registry (RNBD). Pending action: verify, before processing real data, whether Bitsideas LLC exceeds those thresholds as of the publication date and, if so, complete the corresponding registration with the SIC. This is a factual determination about Bitsideas' data volume that no contractual text can resolve on its own.

12. Minors

The Service is directed exclusively at companies and at adult individuals acting on their behalf or as their workers. THOMAS is not directed at minors and does not intentionally collect data from minors; should the Client enter data of a minor in the context of an employment relationship exceptionally permitted by law, such processing is subject to the enhanced safeguards of article 7 of Law 1581 of 2012, under the Client's responsibility.

13. Changes to this policy

Bitsideas may update this policy to reflect regulatory or Service changes. Material changes will be notified to account administrators by email at least fifteen (15) calendar days before they take effect.

14. Control authority and contact

Data subjects may file complaints related to the processing of their personal data with the Superintendency of Industry and Commerce (SIC), as Colombia's data protection control authority, once the direct inquiry or complaint process before the relevant Controller has been exhausted (Bitsideas or the Client, per section 6). To contact Bitsideas about personal data matters: [email protected].