GENERAL POLICY ON THE PROTECTION AND PROCESSING OF PERSONAL DATA FOR CLIENTS, SUPPLIERS, AND THIRD PARTIES OF APOLO ABOGADOS LAW FIRM – APOLEXSA S.A.

APOLO ABOGADOS is a law firm founded in 1948 that provides comprehensive legal services in various cities throughout Ecuador, including Guayaquil, Quito, Manta, Machala, and the Galápagos, as well as internationally in Madrid, Spain.

Our firm, across all of its locations, respects and protects the privacy and personal data of all individuals with whom we interact in the course of our business activities, as well as the data and information entrusted to us by the companies or corporate groups that are our clients. Accordingly, as a law firm, we are strictly committed to complying with the principles and provisions established in the Political Constitution of the Republic of Ecuador, the Organic Law on the Protection of Personal Data and its General Regulations, the Organic Code of the Social Economy of Knowledge, and any other regulations that may be enacted in the future by the Superintendency for the Protection of Personal Data, as well as the provisions contained in international treaties to which Ecuador is a party governing privacy and data protection.

DATA CONTROLLER:

APOLO LEX APOLEXSA S.A. acts as the data controller for the personal data of its clients, prospective clients, suppliers, prospective suppliers, business partners, and employees or job applicants. All of these individuals shall be referred to simply as DATA SUBJECTS for purposes of this Policy.

DATA SUBJECTS may, at any time, submit any requests or inquiries for information and assistance to APOLO LEX APOLEXSA S.A., using the following contact information:

GENERAL STATEMENTS:

The personal data processed by our firm is provided directly by the DATA SUBJECTS or is obtained and processed pursuant to the lawful bases established under the Organic Law on the Protection of Personal Data. We also note that some of the personal data we process may originate from publicly accessible sources.

APOLO ABOGADOS processes the personal data of DATA SUBJECTS in a lawful, fair, transparent, adequate, relevant, proportionate, and limited manner, and in accordance with the legitimate purposes and objectives detailed further below in this Policy.

This General Personal Data Protection Policy shall apply without exception across all of our offices, as well as to all of our employees, partners, associates, and suppliers. However, each office may, depending on the jurisdiction in which it operates and where deemed necessary to comply with applicable local regulations, issue specific Personal Data Processing Policies, as well as privacy and data protection notices, in order to ensure adequate protection of the personal data entrusted to it.

OBJECTIVE OF THE GENERAL POLICY:

To establish rules and procedures that ensure compliance with the provisions and principles set forth in Ecuador’s Organic Law on the Protection of Personal Data. Through this instrument, we regulate the data processing practices carried out by our law firm and inform DATA SUBJECTS about how personal data is protected, retained, and processed within our firm.

PRINCIPLES GOVERNING PROCESSING:

All processing of personal data shall be governed by the principles of lawfulness, fairness, transparency, relevance, data minimization, confidentiality, quality, accuracy, purpose limitation, security, and proactive accountability. All such principles shall be understood in accordance with the terms and conditions established in the Organic Law on the Protection of Personal Data.

PURPOSES AND CATEGORIES OF DATA:

Our firm collects and processes only the personal data and information strictly necessary to offer and provide the legal services requested or contracted by our clients.

In addition, we may process personal data for the marketing, billing, and collection of fees for services provided, as well as, where necessary or requested, to send security notices, advertising, promotional materials, commercial communications, newsletters, and personalized content to our clients and suppliers. All of this is carried out for the purpose of addressing commercial, pre-contractual, and contractual requirements, complying with legal and contractual obligations, and exercising the rights available to us.

The personal data we routinely process includes information that enables us to identify and contact DATA SUBJECTS. We may also process commercial and credit-related information voluntarily and directly provided by DATA SUBJECTS for business purposes. Data processing is carried out to ensure the efficient provision of our services.

In addition to the purposes described above, APOLO ABOGADOS processes the following categories of personal data for the following purposes:

PURPOSE	DATA COLLECTED
Comply with legal, pre-contractual and contractual obligations.	Full name, identification number, email address and telephone number of the data subject.
Generate offers and prepare quotations for the provision of legal advisory and legal representation services.	Full name, identification number, email address and telephone number of the data subject.
Sell and market legal services, as well as address after-sales requests.	Full name, identification number, email address, telephone number and residential address of the data subject.
Develop, manage and maintain the contractual relationship.	Full name, identification number, email address, telephone number and residential address of the data subject.
Manage, address and respond to requests and inquiries submitted by our clients or their legally authorized representatives, especially those related to the exercise of their rights regarding their personal data, as well as requests submitted by the competent authorities.	Full name, identification number, email address, telephone number and residential address of the data subject.
Promote and disseminate updated information about our services.	Full name, identification number, email address, telephone number and residential address of the data subject.
Carry out and manage billing and collection processes, as well as the recovery of outstanding receivables arising from the marketing and sale of legal services.	Full name or company name, identification number, email address, telephone number, residential address of the buyer, and bank account details. Contact and identification information of guarantors.
Process payments.	Full name or company name, identification number, email address, telephone number, residential address and bank account number of the creditor.
Update the client's profile.	Full name, identification number, email address, telephone number of the data subject, marital status, date and place of birth, age, sex and nationality.
Provide various services.	Full name, identification number, email address and telephone number of the data subject.
Comply with tax and administrative regulations.	Full name, identification number, email address, telephone number of the data subject, and taxpayer identification number.
Manage and control access to the organization's facilities and infrastructure.	Images, sounds and biometric data captured through electronic devices.
Contact our clients through data messages, SMS, chats and social media to send information related to the services offered by APOLO ABOGADOS and contracted by our clients, as well as through email.	Full name, identification number, email address and telephone number of the data subject.
Provide telephone or virtual assistance to our clients.	Full name, identification number, email address and telephone number of the data subject.
Carry out the identity verification processes of our clients that may be required under applicable laws and regulations.	Full name, identification number, email address and telephone number of the data subject.

As established under the Organic Law on the Protection of Personal Data, APOLO ABOGADOS does not require authorization or consent from DATA SUBJECTS to process personal data obtained from publicly accessible sources or when its processing is required for the following purposes:

Where it is necessary to obtain and process personal data from publicly accessible or indirect sources in order to provide our legal advisory and representation services, the professional responsible for such services or their assistant shall notify the relevant DATA SUBJECTS of this circumstance within a period not exceeding thirty (30) days, counted from the business day following the date on which the data was collected. Notification shall be made by email to the address registered in our records. Through such electronic notification, we shall provide the information required under Article 12 of the Organic Law on the Protection of Personal Data.

LEGAL BASES FOR DATA PROCESSING:

The processing of DATA SUBJECTS’ personal data shall be based, as applicable, on the following lawful bases:

a. The consent of the DATA SUBJECT;
b. Compliance with a legal obligation or court order;
c. The performance of pre-contractual measures or compliance with contractual obligations;
d. The pursuit of APOLO ABOGADOS’ legitimate interests, provided that such interests do not override the fundamental rights or interests of the DATA SUBJECTS.

DATA RETENTION AND SECURITY:

The retention period for personal data may vary depending on the type of data, the purpose of the processing, the applicable lawful basis, or the time required to address any potential liabilities that may arise from fulfilling the purposes for which the data and information were collected. However, data shall not be retained for longer than the minimum period necessary to fulfill the purposes and legal and contractual obligations for which the data was collected. Every two years, the Board of Directors of APOLO ABOGADOS shall review the applicable data retention criteria and retention periods.

Once the purposes of processing have been fulfilled and there is no legal obligation to retain the data, personal data shall be anonymized, destroyed, blocked, or returned to the DATA SUBJECTS. In the case of returning the data, a prior written request from the interested party shall be required.

All personal data shall be properly stored in duly identified files, records, databases, or other repositories. Various security measures and safeguards shall be regularly applied to such repositories in order to protect the availability, confidentiality, and authenticity of the stored information and personal data, in accordance with recommendations issued by specialized organizations and authorities, both for physical files and documents and for digital storage media.

HANDLING OF REQUESTS AND INQUIRIES:

If DATA SUBJECTS submit a request, petition, complaint, or claim regarding their personal data, it shall be addressed within a maximum period of fifteen (15) days from the date of submission. In order to properly process and respond to such requests, the identifying and contact information provided by the DATA SUBJECT shall be used, including their full name, email address, or landline or mobile telephone number.

If the DATA SUBJECT considers that their requests, petitions, complaints, or claims have not been satisfactorily resolved in accordance with the criteria, deadlines, and procedures established under the Organic Law on the Protection of Personal Data and its General Regulations, they may submit their complaint or claim to the Superintendency for the Protection of Personal Data.

DATA DISCLOSURE AND TRANSFER:

Personal data shall not be disclosed, shared, or transferred to third parties outside APOLO ABOGADOS, whether domestic or foreign, except where there is a legal right or obligation requiring such disclosure, an order issued by a competent authority, a legitimate interest supporting such disclosure, or the client’s express authorization.

The personal data collected may be disclosed, transferred, or communicated to third parties outside our organization upon prior authorization from the DATA SUBJECT or where a lawful basis exists to carry out one or more of the purposes of the processing. In such cases, the DATA SUBJECT shall be duly notified of such disclosure, transfer, or communication.

RIGHTS OF DATA SUBJECTS:

All DATA SUBJECTS have the right to obtain, free of charge, information and personal data concerning themselves. They also have the right to freely exercise their rights of access, erasure, rectification, updating, objection, cancellation, restriction of processing, and the right not to be subject to a decision based solely on automated data processing.

To exercise these rights, DATA SUBJECTS may submit a duly substantiated written request to the following address: Av. Junín 105 y Malecón, “Apolo Rivertower” Building, or by email to apolo@apolo.ec. The requesting party must attach a simple copy of the front side of their identity or citizenship card, or a copy of the identification page of their passport, as well as any other documents that may be required depending on the circumstances. The grounds stated in the request and the documents submitted must comply with the criteria and requirements established under the Organic Law on the Protection of Personal Data.

ACCURACY AND AUTHENTICITY OF PERSONAL DATA:

DATA SUBJECTS are responsible for the accuracy and authenticity of the data and information they have provided to us and that we have consequently collected, recorded, and stored in any of our physical or digital repositories. Accordingly, for processing purposes, we consider such data to be accurate, complete, precise, verifiable, clear, and up to date. Notwithstanding the foregoing, validation procedures shall be carried out at the time of collection to identify and correct spelling errors, transposition of numbers, incorrect codes, incomplete or inconsistent data, and other errors that may affect data quality.

Publicly accessible personal data, regardless of its nature, shall, where necessary, be collected, recorded, and stored under the same terms and conditions in which it was originally published. Under no circumstances shall personal data of minors or persons with disabilities be collected, stored, or processed without first obtaining the free, express, and informed consent of their legal representative or guardian.

Maintaining accurate and up-to-date information is essential to properly provide the services requested from us in accordance with the terms and conditions agreed with our clients and suppliers. Accordingly, APOLO ABOGADOS shall rectify or update inaccurate or outdated data contained in its records upon a written request submitted by the DATA SUBJECT or their legal representative and in accordance with applicable law.

Likewise, DATA SUBJECTS may, at any time, request the updating of the information and personal data they have provided to us or that are contained in our records, databases, or files.

If incorrect data requiring rectification is identified, DATA SUBJECTS may submit a request and exercise their applicable rights through our website or by sending their request to our email address. Likewise, APOLO ABOGADOS may, at any time, rectify personal data where, upon cross-checking the information recorded against publicly accessible data and sources, an error is identified, as described above.

USE OF DATA:

The information and personal data collected in accordance with this Policy are for the exclusive use of APOLO ABOGADOS. The firm undertakes to create and maintain a secure environment to protect the personal data and information of DATA SUBJECTS through the implementation of appropriate security measures and policies designed to prevent unauthorized or fraudulent alteration, loss, deterioration, consultation, use, or access.

UPDATES AND AMENDMENTS:

We reserve the right to make any modifications or updates to this General Personal Data Protection Policy of APOLO ABOGADOS that we deem appropriate or necessary at any time. If material changes are made to this Policy, DATA SUBJECTS shall be notified by electronic communication and shall be required, at that time, to review, expressly accept, or reject the conditions set forth herein.

If DATA SUBJECTS reject the conditions set forth in this Policy, they shall be informed of the consequences of such rejection with respect to the provision of our services or the marketing of our products.

PRIVACY NOTICE FOR THE GENERAL PUBLIC / CLIENTS AND SUPPLIERS

Welcome to our website. Through this notice, we inform you of relevant aspects regarding the processing of personal data carried out by us, including who collects the data, what data is collected, how and for what purposes it is collected, as well as how you may withdraw your consent and exercise your rights as a DATA SUBJECT.

1. DATA CONTROLLER:

APOLO LEX APOLEXSA S.A., with registered address at Av. Junín 105 y Malecón, “Apolo Rivertower” Building, Floors 6 and 7, Province of Guayas, and Taxpayer Identification Number (RUC) 0993149136001, acts as the Data Controller for the personal data of its clients, prospective clients, suppliers, prospective suppliers, business partners, and employees or job applicants.

Accordingly, this “Privacy Notice” (hereinafter, the “Notice”) is issued for the purpose of informing and making available to the general public the terms and conditions under which, in accordance with applicable law, personal data is processed within our organization.

2. LAWFUL BASES:

The data processing activities we carry out are, in the first instance, based on the prior, express, voluntary, unequivocal, and informed authorization of the DATA SUBJECTS; therefore, the primary lawful basis is Consent. In certain cases, we process personal data pursuant to one or more of the lawful bases established under the Organic Law on the Protection of Personal Data. In such cases, the applicable lawful basis shall be duly and timely communicated to the DATA SUBJECT.

All personal data processing activities we carry out shall have a specific purpose. Where multiple purposes exist, we will always seek the DATA SUBJECT’s consent for the processing of their data for each individual purpose. We process personal data in a lawful, fair, transparent, adequate, relevant, proportionate, and limited manner, and in accordance with the legitimate purposes and objectives detailed in our General Personal Data Protection Policy and this document.

3. PERSONAL DATA SUBJECT TO PROCESSING:

The personal data subject to processing includes the following:

4. PROCESSING AND PURPOSES:

The processing of personal data carried out by APOLO LEX APOLEXSA S.A. includes various operations, such as obtaining, collecting, compiling, organizing, recording, retaining, using, administering, safeguarding, storing, deleting, and facilitating the exercise of the rights of DATA SUBJECTS. These activities shall be carried out for the following primary and secondary purposes:

FP: To comply with pre-contractual requirements, existing legal and contractual obligations, as well as requests and requirements issued by the competent public authorities.
FP: To prepare offers and quotations for the provision of services.
FP: To promote and disseminate updated information regarding our services.
FP: To sell and market legal advisory and legal representation services, as well as address post-sale requirements.
FS: To develop, manage, and maintain the business relationship.
FP: To manage, address, and respond to requests and requirements submitted by our clients or their duly authorized legal representatives, particularly those related to the exercise of their rights regarding their personal data, as well as requests made by competent authorities.
FP: To manage and process billing and collections, as well as payment processing and the recovery of outstanding receivables arising from the commercialization of our products.
FP: To update the client profile.
FP: To conduct video surveillance and to ensure security, as well as manage and control internal and external fraud.
FP: To manage and control access to the organization’s facilities and infrastructure.
FS: To contact our clients by telephone calls, electronic messages, SMS, chats, and social media for the purpose of sending information related to the services offered by APOLO ABOGADOS and contracted by our clients, as well as to evaluate the quality of the products and services provided.
FP: To provide assistance to our clients through our designated personnel.
FP: To carry out any identity verification processes for our clients that may be required under applicable law.

5. RIGHTS OF THE DATA SUBJECT:

We also remind you that DATA SUBJECTS whose personal data we process have the right to:

(i) Be informed, in accordance with the principles of fairness and transparency and by any means, of the information detailed in Article 12 of the Organic Law on the Protection of Personal Data.
(ii) Access and obtain, free of charge, the personal data we have collected and processed.
(iii) Have their personal data rectified and updated when such data is inaccurate or incomplete, provided that the relevant supporting documentation is submitted together with the corresponding request.
(IV) Have their personal data deleted or erased from our records free of charge when any of the grounds established under Article 15 of the Organic Law on the Protection of Personal Data are met.
(V) Object to or refuse the processing of their personal data in the cases set forth in Article 16 of the Organic Law on the Protection of Personal Data.
(VI) Have the processing of their personal data suspended when any of the conditions set forth in Article 19 of the Organic Law on the Protection of Personal Data are met.
(VII) Withdraw their authorization and/or request the deletion of their personal data, provided that there is no legal or contractual obligation preventing us from deleting such data.

All of these rights may be exercised by submitting a duly substantiated written request to the following address: Av. Junín 105 y Malecón, “Apolo Rivertower” Building, Floors 6 and 7, or by email to apolo@apolo.ec. The request must be accompanied by a simple copy of the front side of the applicant’s identity or citizenship card, or a copy of the identification page of their passport, as well as any other documents that may be required depending on the circumstances.

6. ACCESS OUR PRIVACY AND PERSONAL DATA PROCESSING POLICY:

For further information regarding the processing of personal data carried out by us, you may access, at any time, our General Personal Data Protection Policy, which is published in full on our website: https://apolo.ec.

If you do not wish to provide your consent to the processing of your personal data for one or more of the purposes described above, you may send an email stating your decision to apolo@apolo.ec. Your refusal may limit, in whole or in part, the provision of our services or the commercialization of our products, particularly where the personal data is essential for compliance with a legal or contractual obligation.

Once you have been duly informed, we kindly ask you to indicate your acceptance of the contents of this document, as well as of the Personal Data Protection and Processing Policy that has been presented and explained to you through the following link:

OPTION FOR OBTAINING CONSENT – VIRTUAL MODALITY