PRIVACY AND DATA PROTECTION POLICY

(hereinafter the “Policy”)

USER RIGHTS

TRES – CIENTO DOS – NOVECIENTOS SESENTA MIL OCHENTA Y NUEVE SOCIEDAD DE RESPONSABILIDAD LIMITADA, legal registration number 3-102-960089, with registered office in San José, Montes De Oca, San Pedro, Avenida Diez, Calle Treinta Y Siete Bis (hereinafter the “Data Controller”), for the purposes of the provisions of the Law on the Protection of Individuals with regard to the Processing of Personal Data No. 8968 (hereinafter the “LPD”) and its Regulations, hereby informs you (hereinafter the “User”) of the existence of a Personal Data Database (hereinafter the “Data”) created by the Data Controller and named “Assistmecr Clientes”

In principle, User Data will not be disclosed, communicated, or transferred to third parties; should this occur, the Data Controller will notify you immediately to obtain your consent for the transfer.

You are expressly informed that we use services from affiliated third parties; therefore, when managing these services, temporary access to your data will be granted. however, we guarantee that in order to grant this access, we require all our service providers to sign contractual documents through which they undertake, at a minimum, not to enter the data to which they are granted access into their own databases, not to use it outside of what we authorize—which is the provision of the service—and to destroy, delete, or return it under our supervision when it is no longer necessary. This does not apply to data that they are required to retain by law.

The data that the User provides to the Data Controller is collected for informational purposes, to contact the User, for commercial prospecting, and to provide the services of said platform, as well as for billing and follow-up, all of which is handled by the Data Controller or another data processor duly authorized for such purposes. This information will be treated with the privacy, confidentiality, and security stipulated by current legislation on the matter.

The User accepts this Policy by checking the box next to “I have read the privacy policy and agree,” which is found on all forms through which may collect information. Therefore, completing any of our forms—whether for registration or to contact the Data Controller—constitutes the User’s consent to the processing of their Data in accordance with the Data Controller’s privacy terms.

The Data collected is adequate, relevant, and not excessive in relation to the scope, purposes, and specific, explicit, and legitimate services of the Data Controller. However, it is entirely voluntary for the User to provide or withhold the data, and in the event that consent has been given to process their data, such consent may be revoked at any time by sending a message to data@assistmecr.com.

The sole consequence of failing to provide the Data, refusing to give consent, or revoking consent will be the Data Controller’s inability to provide the services offered to the User.

The services provided by the Data Controller or our affiliates, and in general any other activities carried out for the purpose of collecting Data, are always intended for individuals over the age of 18, unless otherwise specified in the specific terms and conditions of a particular activity or promotion, in which case the respective authorization from their parents or legal guardians will be required.

Likewise, minors are prohibited, even if they have their parents’ consent, from providing any information that: (i) is considered sensitive data under the LPD, or (ii) personal data of their parents or guardians, other than contact information solely for the purpose of verifying the authorization mentioned in the preceding paragraph.

The User may exercise the rights of access, rectification, erasure, and withdrawal of consent, all related to the processing of their Data, by sending a written communication to the Data Controller at the address indicated in the identification section of this document, or by contacting the following email address: data@assistmecr.com.

Regarding any other matter related to the protection of personal data, you may contact us via our email address: data@assistmecr.com.

Furthermore, the Data Controller informs you that your personal data is stored in a database for which it is responsible, and that appropriate technical and organizational measures are in place to ensure the integrity and security of the personal information provided, in accordance with the current state of the art.

The Data Controller maintains data protection security levels in accordance with the Regulation of the Law on the Protection of Individuals with Regard to the Processing of Personal Data No. 37554 of October 30, 2012, and its amendments, regarding security measures for databases containing personal data and has implemented all technical means at its disposal to prevent the loss, misuse, alteration, unauthorized access, and theft of the data that the User provides to the Data Controller, without prejudice to informing the User that security measures on the Internet are not infallible.

REGARDING COMMUNICATIONS WITH USERS

The processing of personal data and the sending of communications via electronic, telephone, or other means, as determined, shall comply with the regulations established in the LPD, the Regulation, and other relevant legislation.

All communications sent by the Data Controller will clearly state the sender’s name and explain how to opt out of receiving further communications.

Notwithstanding the foregoing, Users who so request may opt out of this service easily and free of charge by sending a written notice to the Data Controller’s previously established address, or by contacting the following email address: data@assistmecr.com.