At Synopsis, we establish guidelines to guarantee the protection of personal data throughout the organization's operations based on compliance with Law 29733 on Personal Data Protection and its regulations.

Synopsis guarantees the fundamental right to the protection of the personal data of our clients, suppliers, collaborators, and applicants; as well as that of any natural person who, through their commercial activities, enters into a relationship with us, both in the public and private spheres, establishing policies and procedures for the appropriate handling of the personal data that these entities have entrusted to us.

A. Principles

• a. Legality: Processing authorized by law or with the consent of the data subject.
• b. Purpose: Use only for the purposes declared to the ANPDP (Ministry of Justice) when collecting the data.
• c. Proportionality: Processing limited to what is necessary for the purpose.
• d. Quality: Accurate, up-to-date, and complete data.
• e. Security: Technical measures based on ISO 27001:2022 and organizational measures designed to protect the data.
• f. Confidentiality: Access restricted to authorized personnel.

B. Key Obligations

• a. Registration of the database with the ANPDP (National Authority for the Protection of Personal Data).
• b. Obtaining express, prior, informed, and unequivocal consent from the data subjects.
• c. Confidentiality clauses in employment contracts and with third parties.
• d. Development of the personal data protection and privacy policy.
• e. Development of the ARCO procedure for Access, Rectification, Cancellation, and Opposition for personal data subjects.

Synopsis S.A. informs that, within the framework of the management of its activities, the personal data provided by collaborators, applicants, and business partners will be incorporated into its institutional database and used exclusively for purposes related to the corresponding employment, contractual, or pre-contractual relationship.

Authorization for the processing of this data is mandatory for the proper development of activities within the organization. In the event of refusal, certain procedures may not be carried out. The validity of this authorization will be indefinite, unless the data subject decides to exercise their rights through the ARCO procedure.

1. WHAT ARE ARCO RIGHTS?

ARCO rights (Access, Rectification, Cancellation, and Opposition) allow you to obtain information about your own data and learn how SYNOPSIS S.A. processes it; for example: How was your personal data recorded? What is the purpose of the processing? How is your personal data being communicated or shared? Among others.

2. DEFINITIONS:

Owner of the personal data database: The owner of the personal data database is SYNOPSIS S.A., with RUC No. 20265913769, with legal address at Av. Dionisio Derteano 184, interior 403, district of San Isidro, province and department of Lima.

Owner of personal data: Natural person to whom the personal data pertains.

Personal Data: All information about a natural person that identifies or makes them identifiable (names, address, ID, nationality, marital status, occupation, completed studies, email address, telephone number, fingerprint, face, iris, or other biometric data, among others) through means that can be reasonably used.

Processing of Personal Data: Any technical operation or procedure, automated or not, that allows the collection, recording, organization, storage, conservation, processing, modification, extraction, consultation, use, blocking, deletion, communication by transfer or dissemination, or any other form of processing that facilitates access, correlation, or interconnection of personal data.

3. WHAT RIGHTS DO YOU HAVE AS THE HOLDER OF PERSONAL DATA?

3.1. Objection:As the holder of personal data, unless otherwise provided by law and when you have not given your consent for the processing of your personal data, you may object to the processing of your data, provided there are well-founded and legitimate reasons related to a specific personal situation.
If the objection request is justified, SYNOPSIS S.A. will proceed with the deletion of your personal data.
You may request to object to the processing of your personal data by submitting the Request Form for the Exercise of ARCO Rights attached to this document.

3.2. Deletion or cancellation: As the data subject, you have the right to request the deletion or cancellation of your personal data from a SYNOPSIS S.A. database in the following cases:

• When the data is no longer necessary or relevant for the purpose for which it was collected.
• When the established processing period has expired.
• When you have revoked your consent for processing.

Note: Requests for deletion or cancellation of your Personal Data will be inadmissible in the event of contractual relationships between SYNOPSIS S.A. and the Data Subject that justify the processing of the same, as well as in other cases established by applicable law. You may request the deletion or cancellation of the processing of your personal data by submitting the “ARCO Rights Exercise Request Form” attached to this document.

3.3. Rectification: As the owner of personal data, you have the right to have your data modified if it is inaccurate, erroneous, or false. You may request rectification of your personal data at the main office of SYNOPSIS S.A., located at Av. Dioniso Derteano 184, interior 403, in the district of San Isidro.

3.4. Inclusion: As the owner of personal data, you have the right to request the inclusion of your Personal Data in the SYNOPSIS S.A. Personal Data Bank, or to request the inclusion of certain Personal Data that complements those previously registered. You may request the inclusion of your personal data at the SYNOPSIS S.A. Office, located at Av. Dioniso Derteano 184, interior 403, in the San Isidro district.

3.5. Update: As the owner of personal data, you have the right—through rectification—to update data that has been modified as of the date you exercise this right. The update request must specify which personal data it refers to, as well as the modification to be made to it, accompanied by documentation that supports the origin of the requested update. You may request the update of your personal data at the SYNOPSIS S.A. Office, located at Av. Dioniso Derteano 184, interior 403, in the San Isidro district.

3.6. Revocation: As the owner of personal data, you may revoke your consent to the processing of your personal data for purposes other than those that give rise to its authorized processing, without affecting the relationship that gives rise to the consent you have granted or revoked. If the revocation affects the entire processing of your personal data that was being carried out, SYNOPSIS S.A. will apply the rules for cancellation or deletion of personal data. You may request revocation of your consent to the processing of your personal data by submitting the Request Form for the Exercise of ARCO Rights attached to this document.

3.7. Information: As the owner of personal data, you have the right—through access—to be provided with all the information indicated in Article 18 of the Personal Data Protection Law, Law No. 29733, and Section 4 of Article 12 of its regulations. SYNOPSIS S.A. will provide the following information:

• The identity of the person responsible for the processing of the Personal Data Bank where your personal data is stored.
• The purpose or purposes of the processing of your personal data.
• The identity of the recipients, if applicable.
• The existence of the personal data bank where your data is stored.
• The national and international transfer of data that is carried out, if applicable.

You may request the right to information about your personal data by submitting the Request Form for the Exercise of ARCO Rights attached to this document.

3.8. Access: As the owner of personal data, you have the right to obtain information about the processing of your personal data in SYNOPSIS S.A. databases, the manner in which your data was collected, the reasons for its collection and, at the request of whom it was collected, as well as the transfers made or planned to be made of your data. You may request the Right of Access to your personal data by submitting the Request Form for the Exercise of ARCO Rights attached to this document.

3.9. Prevent the provision: As the owner of personal data, you have the right to prevent your data from being provided to third parties, especially when this affects your fundamental rights.

3.10. The owner of personal data may request the right to prevent the provision of their personal data by submitting the 'ARCO Rights Exercise Request Form' attached to this document.

3.11. Note: The right to prevent provision does not apply to the relationship between the owner of the personal data database and the person responsible for processing personal data for the purposes of processing such data.

4. PROCEDURE FOR THE EXERCISE OF RIGHTS CONTAINED IN THE PERSONAL DATA PROTECTION LAW

To exercise your rights, you must download and complete the ARCO right exercise form from the SYNOPSIS S.A. website, or request it at the main office, Av. Dionisio Derteano 184, interior 403, in the San Isidro district.

You must sign it and direct your request through the following channels:

• If your request is submitted in person, you can submit it at the office reception: Av. Dionisio Derteano 184, interior 403, in the San Isidro district, presenting a document that proves your identity (DNI/foreigner's card).
• If your request is sent by email, You must download, complete, sign, and send the ARCO Rights Exercise Request Form, attaching all required documents, to the following email address: rrhh@synopsis.ws. Note: The subject line must read: ARCO Rights – indicate the type of rights you wish to request.

5. WHAT IS THE TIME TIME FOR PROCESSING MY REQUEST?

Your request will be processed free of charge within the following timeframes:

• Right to information: 8 calendar days.
• Right of access: 20 calendar days.
• Right to cancellation, deletion, and/or objection: 10 calendar days.
• Right of revocation: 5 calendar days.

Submit your request and remember to attach the necessary documents.

SYNOPSIS S.A. will receive all submitted requests, recording their receipt. If the request does not meet the aforementioned requirements, SYNOPSIS S.A. will make observations for non-compliance that cannot be remedied ex officio, inviting the Data Subject to Correct them within five (5) days. If the Holder does not correct them within the established period, the application will be deemed not submitted.