Privacy Policy and Personal Data Processing

01Data Controller

Damorus Projects, an engineering, science, and artificial intelligence studio operating from Bogotá D.C. (Colombia) and Berlin (Germany), is the controller responsible for the processing of personal data governed by this Privacy Policy (the "Policy").

The contact channel for matters related to this Policy and for data subjects to exercise their rights is the email address Alejandro@damorus.com.

02Scope

This Policy applies to the data that Damorus Projects processes as controller through its website and associated pages (the "Site"), forms, messages, and meetings, and in its precontractual and contractual relationships with clients, suppliers, and their contact persons.

It does not apply to processing that Damorus Projects carries out as a processor on behalf of its clients, which is governed by their instructions and the corresponding data processing agreement, nor to third-party sites or services linked from the Site.

03Definitions

For purposes of this Policy, and without prejudice to applicable legal definitions, the following terms mean:

• ▸Data subject: a natural person whose personal data is processed (referred to as "interesado" under Regulation (EU) 2016/679, the GDPR).
• ▸Personal data: information linked to, or that may be associated with, an identified or identifiable natural person.
• ▸Processing: any operation performed on personal data, such as its collection, storage, use, disclosure, or deletion.
• ▸Controller and processor: the party that decides the purposes and means of processing, and the party that carries it out on behalf of the controller, respectively.
• ▸Authorization: the data subject's prior, express, and informed consent to the processing of their data.
• ▸Transfer and transmission: the sending of personal data to a recipient acting as controller, or to a processor handling it on the controller's behalf, respectively.

04Categories of Personal Data

Providing data is voluntary, but without the necessary data it is not possible to respond to a request or enter into a contract. Damorus Projects does not request sensitive data, and data subjects must refrain from including it in the information they submit.

Damorus Projects processes data that is adequate, relevant, and limited to what is necessary, within the following categories:

• ▸Identification: name and, where applicable, the organization the data subject represents.
• ▸Contact: email address and phone or messaging service number.
• ▸Project information: description of the need, plan, or service of interest, estimated timeline, and materials the data subject provides.
• ▸Billing: identification number, tax address, and payment data, when a contractual relationship exists.
• ▸Communications: the content of exchanged messages and the date, time, and time zone of meetings.
• ▸Technical data: IP address, browser, device, date and time of access, and the referring page of requests, strictly necessary for the operation and security of the Site, and aggregated browsing information that does not identify the data subject. Our own measurement, which does not use IP addresses, also records the time zone and local time of the browser and, when the link carries it, the originating campaign (utm parameters).
• ▸Reading data: to learn which parts of each page get read, we anonymously measure how far a person scrolls, how long they read, and which sections they reach, without linking it to their identity.

05Purposes of Processing

Damorus Projects does not sell or rent personal data. Data is processed exclusively to:

• ▸Respond to requests and messages, schedule meetings, and prepare proposals, mockups, and quotes.
• ▸Enter into, perform, and administer contracts, including warranty, support, and enhancement services.
• ▸Invoice, manage collections and payments, keep accounting records, and comply with legal and tax obligations.
• ▸Send communications about the request or project and, with authorization where required by law, information about its own services.
• ▸Protect the security and operation of the Site and prevent fraud and unauthorized use.
• ▸Respond to requests from authorities and bring, exercise, or defend legal claims.

06Legal Bases for Processing

Depending on the case and the applicable law, processing is based on:

• ▸The data subject's consent or authorization, given in writing, orally, or through unambiguous conduct, such as voluntarily submitting a form or message after having had the opportunity to review this Policy.
• ▸The implementation of precontractual measures requested by the data subject, or the performance of a contract to which the data subject is a party.
• ▸Compliance with legal obligations, in particular commercial, accounting, and tax obligations.
• ▸The legitimate interest in the security of the Site, the management of relationships with contact persons of clients and suppliers, and the defense of legal rights, provided the data subject's rights do not override that interest.

07Applicable Legal Framework

Depending on the data subject's location, processing is subject, in particular, to:

• ▸Colombia: Law 1581 of 2012 (Colombia) and Decree 1377 of 2013 (Colombia), compiled into Sole Regulatory Decree 1074 of 2015 (Colombia), and any rules amending or replacing them.
• ▸European Union and Germany: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation (GDPR), and the Bundesdatenschutzgesetz (BDSG), Germany's Federal Data Protection Act. Under the GDPR, the legal bases described above correspond to Article 6(1)(a), (b), (c), and (f).
• ▸United States, State of California: the California Consumer Privacy Act (CCPA) of 2018, as amended by the California Privacy Rights Act of 2020, when its applicability requirements are met.

08Data Subject Rights

Subject to the terms and limits of applicable law, data subjects have the right to:

• ▸Know and access their data free of charge and be informed about its use.
• ▸Rectify and update inaccurate or incomplete data.
• ▸Request the deletion of their data.
• ▸Object to processing based on legitimate interest or carried out for commercial purposes.
• ▸Request restriction of processing.
• ▸Receive the data they provided in a structured, commonly used, and machine-readable format, and transmit it to another controller (data portability).
• ▸Revoke their authorization or withdraw consent, without affecting the lawfulness of processing carried out before that withdrawal.
• ▸Request proof of the authorization given.
• ▸File complaints with the Superintendencia de Industria y Comercio (Colombia) or with the competent supervisory authority in the European Union, such as the Berliner Beauftragte für Datenschutz und Informationsfreiheit (the Berlin Commissioner for Data Protection and Freedom of Information).

09Limits on These Rights

Deletion and revocation are not available when the data subject has a legal or contractual duty to remain in the database. In Colombia, filing a complaint with the Superintendencia de Industria y Comercio requires first exhausting the inquiry or claim procedure before the controller, a requirement that does not exist in the European Union.

Under the CCPA, the exercise of these rights will not result in discriminatory treatment. Damorus Projects does not sell or share personal data within the meaning of that law.

10Procedure and Response Deadlines

Requests must be sent to Alejandro@damorus.com with the identification of the data subject or their representative or successor, proof of that status, a description of what is being requested, a notification address, and supporting documents. Reasonable additional information may be required to verify the requester's identity, and manifestly unfounded or excessive requests may be denied as permitted by law. Response deadlines are:

• ▸Colombia: inquiries, ten (10) business days from receipt, extendable by up to five (5) business days; claims, fifteen (15) business days from the day after receipt, extendable by up to eight (8) business days, in both cases with reasoned notice of the extension. If a claim is incomplete, the data subject will be asked within five (5) days of its receipt to correct it, and the claim will be deemed withdrawn if two (2) months pass with no response.
• ▸European Union: without undue delay and, at the latest, within one (1) month of receipt, extendable by two (2) further months depending on the complexity and number of requests, which will be communicated within the first month.
• ▸California, when applicable: forty-five (45) calendar days, extendable for an equal period when reasonably necessary, with notice to the requester.

11Data Retention

Data is retained for as long as necessary for its purposes and then deleted or anonymized, unless there is a legal duty to retain it, in which case it remains blocked from further use. Applicable criteria:

• ▸Requests that do not result in a contractual relationship: up to twelve (12) months from the last communication with the data subject.
• ▸Contractual relationships: for the term of the contract and, afterward, for the periods set by commercial, accounting, and tax rules and the statute of limitations for related claims.
• ▸Technical security data: for short periods, unless needed to investigate incidents or respond to requests from authorities.

12Processors and Recipients

Data may be disclosed to financial and payment institutions, professional advisors bound by confidentiality, and authorities, when required by contract or law. Third-party messaging and scheduling services that the data subject chooses to use may process their data as independent controllers.

Data may also be disclosed to processors bound by confidentiality and security obligations, in the following categories:

• ▸Web hosting, cloud infrastructure, and security.
• ▸Email and transactional email delivery.
• ▸Meeting scheduling and video conferencing.
• ▸Instant messaging.
• ▸Productivity, file storage, and software development, including artificial intelligence tools.

13International Transfers and Transmissions

Because Damorus Projects operates from Colombia and Germany, and some of its providers are located in other countries, including the United States of America, international transfers and transmissions of data may occur.

In Colombia, transmissions are based on the data subject's authorization or on data transmission agreements, and transfers are made to countries with an adequate level of protection or under the exceptions allowed by law. Under the GDPR, transfers to third countries rely on adequacy decisions, standard contractual clauses, or other appropriate safeguards or, where applicable, the derogations for specific situations, about which the data subject may request information.

14Security Measures

Damorus Projects adopts technical, human, and administrative measures proportional to the risk to protect data against loss, alteration, and unauthorized access or use, such as encryption of communications, access controls, strong authentication where available, backup copies, and confidentiality duties.

No system is invulnerable, and absolute security cannot be guaranteed. In the event of an incident affecting personal data, Damorus Projects will adopt containment measures and make the notifications required by applicable law.

15Minors

The Site and its services are directed at adults and organizations. Damorus Projects does not knowingly collect data from minors and will delete any such data received without the authorization of the minor's legal representative, who may request its deletion through the contact channel.

16Automated Decisions

Damorus Projects does not make decisions based solely on automated processing, including profiling, that produce legal effects on the data subject or similarly significantly affect them. The software tools used for support operate with human intervention.

17Changes

Damorus Projects may amend this Policy to reflect regulatory, technical, or operational changes, and will publish the current version on the Site with its update date. Material changes will be communicated before they take effect when required by law, and if they affect the purpose of processing, new authorization will be requested when necessary.

18Effective Date

This Policy is effective as of September 16, 2026, and supersedes all prior versions. Databases will remain in effect for as long as the purposes of processing and the applicable retention periods continue to apply.