PRIVACY POLICY & PROCESSING OF PERSONAL DATA

The controller of the personal data processing carried out directly by INPERIA for the administration of the Platform, account management, support, security and other purposes inherent to the service is Josias Natanael Cicka, CUIT No. 20-37095667-8, with address at Juárez Beaucheff 2448, Las Tunas, Pacheco, Partido de Tigre, Province of Buenos Aires, Argentine Republic, email [email protected].

This identification applies regardless of the fact that, for user institutions with a billing address outside the Argentine Republic, the contracting and invoicing of the service is carried out by INPERIA LLC.

With respect to the personal data that churches, ministries, networks or other organizations upload to the Platform about their members, visitors, volunteers, staff or other persons, each user institution shall be the data controller and shall determine the purposes and legal bases. INPERIA shall process that information on behalf of the user institution, in accordance with its instructions and in order to provide the service, acting as data processor under applicable law.

INPERIA LLC may process the data strictly necessary for contracting, invoicing, collection and compliance with the legal obligations relating to clients whose billing address is outside the Argentine Republic. That processing shall be limited to the information necessary for those purposes and does not mean that INPERIA LLC determines the purposes of the processing of the data of members and contacts uploaded to the Platform by user institutions.

This Policy applies to any person who uses the Platform, visits the Website or interacts with INPERIA through contact forms, information requests, technical support or any other channel made available.

Where a church, ministry, religious organization or denomination uses the Platform to manage information about its members, visitors, volunteers, staff or other related persons, that institution shall be responsible for the information it uploads and for compliance with the regulations applicable to the processing of that personal data.

INPERIA shall process that information solely to provide the service contracted, in accordance with the account holder's instructions and with the provisions of this Policy.

Depending on how the Platform is used, INPERIA may process the following categories of information:

• identification and contact details of registered users;
• data about the church or organization using the Platform;
• information uploaded by users about members, contacts, families, ministries, groups, activities and other administrative records;
• technical information relating to access to and use of the Platform;
• communications sent through contact forms or support requests.

INPERIA does not require specific categories of information about each institution's members to be uploaded. The information stored depends exclusively on how each user configures and uses the Platform. Full credit or debit card details are not stored by INPERIA. Payments are processed by specialized providers.

Personal data may be used to:

• a) create and administer user accounts;
• b) provide the services offered by the Platform;
• c) manage subscriptions, payments and technical support;
• d) maintain the security, stability and operation of the Platform;
• e) respond to queries made through the contact channels;
• f) develop new features, improve the performance of the service and produce statistics using anonymized or aggregated information;
• g) comply with legal obligations or requirements from a competent authority.

INPERIA shall not use the personal data processed through the Platform for purposes incompatible with those for which it was collected.

The Platform has been developed for use by churches, ministries, church networks and other religious organizations, so the information uploaded by users may include data that, under applicable law, is considered sensitive, including data from which a person's religious affiliation, membership or participation may be inferred.

INPERIA does not determine what information each institution uploads, nor does it decide the purposes for which that information is processed. Uploading, updating, using and deleting this data is the exclusive responsibility of the account holder and of the users the holder authorizes.

Each user institution declares that it has a sufficient legal basis to process the personal data it uploads to the Platform and that it has obtained the consents, authorizations or permissions required by applicable regulations where necessary.

Where the personal data of children or adolescents is uploaded, the user institution shall be responsible for verifying that such processing is authorized by those who hold parental responsibility or legal representation, where applicable law so requires.

INPERIA implements technical measures designed to allow access to information to be restricted through profiles, roles and permission levels defined by each user institution. Assigning those permissions correctly is the exclusive responsibility of the account holder.

In particular, with respect to processing subject to Argentine legislation, article 7, subsection 3, of Law No. 25,326 expressly recognizes that the Catholic Church and religious associations may keep a register of their members. Each user institution shall be responsible for verifying that its organization and the processing it carries out fall within that provision and for complying with the remaining obligations set out in the applicable regulations.

Access to the information stored on the Platform is subject to the system of roles, permissions and visibility levels configured by the account holder.

Each user institution may define the users authorized to access the Platform, assign them different profiles and limit access to certain information according to its own organizational structure.

INPERIA provides the tools necessary to administer those permissions, but does not intervene in their configuration or control the authorizations granted by each institution.

Linking accounts requires express action by the institutions involved, and the exchange of information is limited to the permissions they expressly grant. A link may be revoked in accordance with the features available on the Platform. Each institution shall be responsible for defining the access and permissions it grants to other accounts. INPERIA shall not determine the organizational structure or the access levels defined by user institutions.

INPERIA adopts technical and organizational measures designed to protect the information processed through the Platform against unauthorized access, alteration, loss, destruction or improper disclosure.

Among other measures, the Platform incorporates authentication mechanisms, segregation of information by account, permission management, audit logs and access controls in line with the features available.

Passwords are stored using cryptographic functions and are not kept in plain text.

Personal data shall be retained while the account remains active and for the time necessary to provide the service, allow the export or recovery of the information, comply with legal or contractual obligations, address liabilities arising from the relationship and preserve the security and integrity of the Platform.

Deleting an account shall result in the removal of its access and the interruption of existing links with other institutions.

Once the applicable periods have elapsed, the data shall be deleted or anonymized. Backup copies may be kept for limited additional periods and shall be deleted in accordance with the rotation cycles implemented by INPERIA.

Certain information, such as billing, payment, audit or security records, may be retained for the periods required by applicable law or for as long as it is necessary to address liabilities arising from providing the service.

In the event that INPERIA becomes aware of a security incident that compromises personal data processed on behalf of a user institution, it shall notify the account holder without undue delay, once the existence of the incident has been verified and to the extent necessary to allow the holder to comply with its own obligations under applicable law.

The notification shall include, to the extent that such information is available, a description of the nature of the incident, the categories of data potentially affected, the identified consequences and the measures adopted or planned to contain, investigate and mitigate its effects.

INPERIA shall reasonably cooperate with the user institution in complying with any applicable obligations to notify data subjects or supervisory authorities.

Data subjects may exercise the rights of access, rectification, updating, erasure and objection, and any other rights recognized by the applicable legislation. Where applicable, they may also request the restriction of processing, the portability of their data, the withdrawal of consent previously given and the review of decisions based solely on automated processing.

Requests may be addressed to [email protected] and shall be handled within the time limits established by the applicable regulations. The exercise of these rights may be limited where the retention or processing of certain information is required or authorized by a legal or regulatory obligation.

Where the data was uploaded to the Platform by a church, ministry, network or other user institution, the request must be addressed in the first instance to that institution, in its capacity as data controller. INPERIA shall cooperate with the user institution to implement the technical measures necessary to address the exercise of the applicable rights.

For processing subject to Argentine legislation, access requests shall be answered within ten (10) calendar days of receipt. Requests for rectification, updating or erasure shall be handled within five (5) business days, in accordance with Law No. 25,326.

Where data is used for advertising or commercial communication purposes, the data subject may request at any time the withdrawal or blocking of their data for those purposes, in accordance with applicable law.

The Platform is intended for institutions located in different countries. Consequently, certain data may be processed, stored or transferred through technology providers located in jurisdictions other than the one in which the data subject is located.

INPERIA shall adopt the contractual, technical and organizational measures required for such processing and transfers under applicable law.

The participation of INPERIA LLC in the contracting and invoicing of clients located outside the Argentine Republic may involve the processing of the data strictly necessary for those purposes, as provided in this Policy.

The Website may use cookies, pixels and other similar technologies necessary for its operation or intended, as applicable, to remember preferences, obtain statistical information, analyze use of the Website or carry out marketing activities.

Where applicable law requires the user's consent, technologies that are not strictly necessary shall not be used until that consent has been given.

Users may obtain information about the technologies used, their purposes, the third parties involved and the mechanisms for accepting, rejecting or changing their preferences in the Cookie Policy available on the Website.

INPERIA may modify this Privacy Policy to adapt it to legal, technological, operational or functional changes relating to the provision of the service. The version in force shall be published on the Website and shall state the date it was last updated.

INPERIA does not sell, rent or trade personal data.

Personal data may be disclosed or made available to third parties only in the following cases:

• a) where necessary to provide the service, including providers of technological infrastructure, cloud storage, authentication, payment processing, email delivery, messaging, monitoring, diagnostics or support;
• b) where the user institution voluntarily enables a link with another church, network, denomination or organization and expressly configures the information that may be viewed;
• c) where necessary to comply with a legal obligation, a court order or a requirement issued by a competent authority;
• d) where necessary to protect the security, integrity or availability of the Platform, prevent fraud or defend the rights of INPERIA, its users or third parties.

Providers that process data on behalf of INPERIA shall access only the information necessary to provide their services and shall be subject to confidentiality, security and data protection obligations.

Where a user institution shares information through the linking features available on the Platform, it shall be responsible for holding the authorizations and legal bases necessary for that disclosure.

With respect to the personal data that user institutions upload to the Platform about their members, contacts, visitors, volunteers or other persons, each institution shall act as data controller and INPERIA as data processor, in accordance with applicable law.

In that capacity, INPERIA shall process such data in order to provide the services contracted and in accordance with the user institution's instructions, as set out in the Terms and Conditions.

The user institution shall be responsible for holding the applicable legal bases, authorizations or consents to collect that data and upload it to the Platform.

Queries relating to this Privacy Policy or to the processing of personal data may be addressed to: Email: [email protected]

Where the query concerns personal data uploaded by a church, ministry, religious organization or denomination, INPERIA may require the request to be channelled through the relevant account holder or forward it directly to them, as applicable.

Where a person completes forms available on the Website, requests commercial information, requires technical support or contacts INPERIA by any channel made available, data such as name, email address, organization, subject of the query and any other information the user chooses to provide may be collected.

That data shall be processed exclusively to:

• a) respond to queries and requests for information;
• b) provide technical or commercial assistance;
• c) maintain communications relating to the query made;
• d) improve the quality of the service and support offered.

Data obtained through these channels shall not be used for purposes incompatible with those that prompted the contact and may only be disclosed or made available to third parties in the cases provided for in clause TWELFTH of this Policy.

The Platform may allow user institutions to send reminders for meetings or events, birthday greetings, notices relating to absences or activities, forms, attendance confirmation requests and other communications by email, WhatsApp or other enabled messaging services.

The user institution exclusively determines:

• a) the recipients of the communications;
• b) the content and purpose of each communication;
• c) their frequency and timing;
• d) the rules or conditions that trigger automated messages;
• e) the existence of consent, authorization or a sufficient legal basis to make those communications.

INPERIA acts solely as the provider of the technological tool used to configure, administer and transmit the messages. It does not determine or control their content, recipients or purpose and shall not be responsible for the decisions taken by the user institution regarding those communications.

The user institution must honour requests to unsubscribe, object to or stop communications made by their recipients and must comply with the applicable regulations on data protection, commercial communications and messaging services.

INPERIA may suspend or restrict these features where it detects manifestly unlawful, abusive or fraudulent use, or use contrary to these legal documents.