4U APP

PRIVACY POLICY AND PERSONAL DATA PROCESSING

Effective Date: May 6, 2026 — Version 1.0

In accordance with Law 1266 of 2008, Law 1581 of 2012, and Decree 1377 of 2013, 4U App hereby discloses its personal data processing policy.

P1. Data Controller

Name: Lukas Esteban Aristizabal (Operator of 4U App)

Habeas Data email: datos@4u.social

Support email: soporte@4u.social

Country: Colombia

P2. Personal Data Collected

4U App collects the following data depending on the type of user:

1. Identification data: full name, date of birth, identity document number.
2. Contact data: email address, phone number, delivery address.
3. Verification data: photographs of identity documents (only when applicable for security or fraud prevention).
4. Transaction data: order history, requested products, amounts paid.
5. Technical data: IP address, device type, operating system, app usage data (cookies and similar technologies).
6. Payment data: processed directly by the payment gateway; 4U App does not store full card data.

P3. Purposes of Processing

Personal data will be used to:

1. Operate the platform and manage requested orders.
2. Verify user identity and prevent fraud, money laundering, and terrorism financing.
3. Process payments and issue transaction receipts.
4. Send communications about order status, updates, and support.
5. Send commercial and advertising communications (the user may revoke this consent at any time).
6. Conduct statistical analysis and business intelligence to improve the platform.
7. Comply with legal obligations and report to competent authorities when required by law.
8. Manage the onboarding of agents, partners, and suppliers.
9. Handle requests, complaints, and claims (PQRS).

P4. Data Transfer and Transmission

Personal data may be shared with:

1. Agents who manage Consumer orders.
2. Payment gateways (PAYU, Stripe, or others enabled) for transaction processing.
3. Technology service providers (cloud storage, data analytics) under confidentiality agreements.
4. Judicial, administrative, or supervisory authorities when required by law.
5. Shareholders and affiliates of the Operator for internal administrative purposes.

International data transfers (to countries outside Colombia) will only be made to countries with an adequate level of protection, or under contractual clauses that guarantee standards equivalent to those of Colombian law.

4U App does not sell personal data to third parties for their own commercial purposes.

P5. Data Retention Period

Personal data will be retained for the duration of the contractual relationship and for the additional time required by Colombian law for evidentiary or regulatory compliance purposes. Identity document images will be deleted within twelve (12) months following account deactivation, unless there is a legal obligation to retain them.

P6. Use of Cookies and Tracking Technologies

4U App uses first-party and third-party cookies to improve user experience, analyze traffic, and personalize content. By creating an account or using the platform, the user accepts the use of cookies.

The user may manage or disable cookies through their device or browser settings, although this may limit some platform functionalities.

For tracking on mobile devices, 4U App complies with the privacy policies of Google Play (Android) and App Store (iOS), including Apple's App Tracking Transparency (ATT) guidelines when applicable.

P7. Rights of the Data Subject (Habeas Data)

The personal data subject has the right to:

1. Access, update, and correct their personal data.
2. Request proof of the authorization granted for data processing.
3. Be informed of how their personal data has been used.
4. File complaints with the Superintendence of Industry and Commerce (SIC) for violations of data protection regulations.
5. Revoke authorization and/or request deletion of their data, within legal limits.
6. Access their personal data in 4U App's databases free of charge.
7. Request deletion of their account and associated data.

P8. How to Exercise Your Rights

To exercise any of the above rights, the data subject must send a written request to:

Email: datos@4u.social

The request must include: full name, identity document number, clear description of the right being exercised, and if acting as a representative, proof of such capacity.

The Operator will respond within the timeframes established by Law 1581 of 2012: ten (10) business days for inquiries and fifteen (15) business days for claims.

Rights of minors will be exercised exclusively by their legal representatives, who must demonstrate such capacity.

P9. Information Security

The Operator implements technical, human, and administrative measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These include data encryption in transit and at rest, role-based access control, and periodic audits.

In the event of a security incident affecting personal data, the Operator will notify the affected data subjects and the Superintendence of Industry and Commerce in accordance with current regulations.

P10. Modifications to the Privacy Policy

This Policy may be modified at any time. Substantial changes will be notified to users via email or in-app notification with at least five (5) days' advance notice. The current version will always be available on the platform.

Cookie and Tracking Policy 4U App uses cookies and similar tracking technologies to improve user experience, analyze traffic, and personalize content. By using the platform, the user accepts the use of cookies. The user may manage or disable cookies through their device or browser settings, although this may limit some platform functionalities.

For mobile tracking, 4U App complies with Google Play (Android) and App Store (iOS) privacy policies, including Apple's App Tracking Transparency (ATT) guidelines. Users on iOS will be asked for permission before any cross-app tracking occurs. Users may change their tracking preferences at any time in their device settings under Privacy → Tracking.