Annex VI: General Data Privacy Policy

1.Privacy commitment and scope 1.1.DeepThink Software SLU (hereinafter, "DeepThink"), as the owner of the rights to the SWPANEL software, declares its firm commitment to protecting the privacy and security of the personal data of all Users, regardless of their country of residence or establishment. 1.2.This annex sets out DeepThink's general practices regarding the collection, use, storage, retention, transfer, communication, and protection of personal data in the context of the use of any of the SWPANEL modalities (SaaS, Self-Hosted, or mobile applications). 1.3.These practices apply globally, subject to the specific annexes that set out the particular requirements of each jurisdiction: 1.3.a.Annex III: Data Protection Policy (GDPR – EU). 1.3.b.Annex IV: California Consumer Privacy Rights (CCPA). 1.3.c.Annex V: Compliance with other International Data Privacy Legislation. 1.4.In the event of a conflict between the provisions of this Annex VI and the provisions of the aforementioned annexes, the strictest or most protective regulations for the User shall always prevail.

2.Organizational context and communications within the business group 2.1.DeepThink is part of the business group Prime Quad Partners SL (hereinafter, "Prime Partners"), made up of several companies specializing in technology services, IT infrastructure, and digital solutions. 2.2.DeepThink may share certain personal data of the User with other companies in the group, only when such communication: 2.2.1.Is necessary and legitimate for the fulfillment of the contract with the User. 2.2.2.Contributes to improving the quality of the service or attention provided. 2.2.3. Allows the offering of complementary products or services that may be integrated or useful to the User. 2.2.4. Facilitates second or third level technical support, especially in situations requiring specialized or multi-component intervention. 2.2.5. Results in the improvement of the user experience through advice, integration, or additional services compatible with SWPANEL. 2.3.These communications will be made exclusively between entities contractually linked within the Prime Partners group, under confidentiality and data processing agreements that guarantee compliance with applicable regulations.

3.Categories of personal data collected 3.1.Identification and contact details: 3.1.1.Name, surname, email address, telephone number. 3.1.2.Postal address and country. 3.1.3.Name of the company or organization represented. 3.1.4.Tax and billing information, including tax ID number, bank or card details. 3.2.Account credentials: 3.2.1.Username and encrypted password. 3.2.2.Additional authentication mechanisms, where applicable. 3.3.Technical and browsing data: 3.3.1.IP address used. 3.3.2.Browser, operating system, and device type. 3.3.3.Cookies and similar technologies (see Annex VII). 3.3.4.Information about browsing and actions within SWPANEL. 3.4.Data derived from the use of the software: 3.4.1.Actions within the platform. 3.4.2.Settings, preferences, and customizations. 3.4.3.Third-party data managed by the User (in which case DeepThink acts as data processor, in accordance with Annex II).

4.Purposes of processing and legal bases 4.1.Execution of the contract: 4.1.1.Account registration and management. 4.1.2.Payment, billing, and subscription management. 4.1.3.Access to contracted features. 4.1.4.Provision of technical support. 4.2.Security and control: 4.2.1.Access and activity monitoring. 4.2.2.Prevention of fraud or misuse. 4.2.3.Protection of systems and infrastructure. 4.3.Service improvement: 4.3.1.Statistical and technical analysis. 4.3.2.Error resolution and performance improvement. 4.3.3.Development of new features or services. 4.4.Legal compliance: 4.4.1.Tax, accounting, and administrative obligations. 4.4.2.Response to regulatory or legal requirements. 4.5.Operational communications: 4.5.1.Scheduled maintenance. 4.5.2.Contractual or policy changes. 4.5.3.Technical or critical service notices. 4.6.Legitimate commercial communications: 4.6.1.Sending information about complementary services offered by Prime Partners or the Prime Partners group. 4.6.2.Exercise of the right to object or withdraw consent, where applicable.

5.Communication and transfer of personal data 5.1.DeepThink will only transfer personal data in the following cases: 5.1.1.To suppliers or sub-processors under contract, in accordance with Annex II. 5.1.2.To competent authorities, upon legal request. 5.1.3.To companies in the Prime Partners group, for legitimate purposes related to the service. 5.1.4.In corporate transactions (merger, sale, spin-off), provided that the acquirer complies with this policy. 5.2.In the case of international data transfers: 5.2.1.The use of valid legal mechanisms, such as standard contractual clauses approved by the European Commission, or equivalent protection measures, shall be ensured.

6.Retention of personal data 6.1.DeepThink shall retain personal data: 6.1.1.During the contractual relationship. 6.1.2. After termination, for the mandatory legal retention periods (5-10 years). 6.1.3. For as long as legal liabilities may arise. 6.1.4. Until consent is revoked, in the case of voluntary processing. 6.2. After these periods, the data will be: 6.2.1.Safely deleted, or 6.2.2.Irreversibly anonymized.

7.Security measures 7.1.DeepThink implements appropriate technical and organizational measures, including: 7.1.1.Data encryption (in transit and at rest). 7.1.2.Access control and secure authentication. 7.1.3.Access logging and auditing. 7.1.4.Firewalls and anti-malware protection. 7.1.5.Backup and contingency plans. 7.2.The User is responsible for: 7.2.1.Maintaining the confidentiality of their credentials. 7.2.2.Using secure passwords. 7.2.3.Reporting unauthorized access.

8.User rights and exercise 8.1.The User may exercise the following rights, in accordance with applicable legislation: 8.1.1.Access. 8.1.2.Rectification. 8.1.3.Erasure. 8.1.4.Restriction of processing. 8.1.5.Objection. 8.1.6.Portability. 8.2.These rights may be exercised by: 8.2.1.The SWPANEL user panel. 8.2.2.Email to [email protected]. 8.3.The User may also: 8.3.1.Withdraw consent at any time. 8.3.2.Lodge a complaint with the competent supervisory authority.

9.Updates and validity 9.1.DeepThink may update this policy in the event of: 9.1.1.Changes in legislation or regulations. 9.1.2.The introduction of new technologies or processes. 9.1.3.Changes in the services provided. 9.2.The User will be informed when: 9.2.1.It is required by law. 9.2.2. The change significantly affects their rights or the processing of their data. 9.3. In the event of a regulatory discrepancy, the following shall prevail: 9.3.1. The most up-to-date version of this annex, or 9.3.2. The most protective regulation according to the User's jurisdiction.