Privacy and personal data processing policy

1. Objective

In this Privacy and Personal Data Processing Policy, “we”, “us”, “El Dorado” or “the Company” refers to EL DORADO LABS PY INC or its affiliates, subsidiaries or related companies (as specified in the table in Annex A hereto), and “our” shall be interpreted accordingly.

El Dorado is a company that respects the Personal Data provided by its current and potential clients, employees, candidates, business partners, suppliers, shareholders, investors and other persons interested in El Dorado's Services, and for this reason it has implemented this Privacy and Personal Data Processing Policy (hereinafter, the “Policy”), which explains what Personal Data is processed, what it is processed for, what the rights of the Personal Data Holder are, and the mechanisms available to exercise them.

The use of the El Dorado Platform, the execution of employment contracts, commercial alliances or the provision of services, and/or the express and unequivocal acceptance of this Policy, imply that the Holder accepts that his Personal Data be processed in accordance with what is established herein.

EL DORADO adopts this Policy in accordance with the general principles of personal data protection and the right to privacy and informational self-determination.

2. Scope

This Policy applies to all Personal Data that EL DORADO, in its capacity as a virtual asset service provider, collects, receives or processes within the framework of the development of its corporate purpose and its commercial activities, present or future, regardless of the specific services through which said activities are carried out.

The Policy also includes data of legal entities when it is appropriate to process the data of their legal representative, attorney or shareholders, for the purposes of corporate compliance, identity verification (KYC) and prevention of money laundering, terrorist financing and proliferation of weapons of mass destruction (ML/TF/FPADM).

3. Definitions

“Authorization”: is the prior, express and informed consent that the Holder grants to El Dorado for the Processing of his Personal Data.

“Database”: an organized set of Personal Data that is processed by El Dorado.

“Non-Public Personal Information (NPI)” : refers to the non-public financial and transactional information of users, obtained within the framework of the provision of the Visa Prepaid Card service.

“Consultation”: a request made by the Holder to find out what information El Dorado has about him in its Databases.

“Personal Data”: any information relating to a natural person that identifies or makes him or her identifiable.

“Sensitive Data”: data that affects the privacy of the Data Subject or whose misuse may generate discrimination, such as racial or ethnic origin, political orientation, religious or philosophical beliefs, trade union membership, health data, sexual life and biometric data.

“Data Processor”: natural or legal person, public or private, who alone or in association with others carries out the Processing of Personal Data on behalf of and following the instructions of El Dorado, in its capacity as Controller.

“Purpose”: the purpose for which El Dorado processes the Holder’s Personal Data.

“Platform”: El Dorado website and application through which the Services are provided.

“Claim”: request from the Holder to exercise their rights related to their Personal Data.

“Data Controller”: natural or legal person who decides on the Processing of Personal Data, that is, who determines its purpose.

“Services”: services provided by El Dorado to its users, which can be accessed through its website and application.

“Data Subject”: natural person whose Personal Data is subject to Processing.

“Processing”: any operation on Personal Data, such as collection, storage, use, circulation, transmission, transfer, updating, correction or deletion, whether at the national or international level.

“Transmission”: delivery of Personal Data to a Processor, inside or outside of Panama, so that the Processor may carry out the Processing following the instructions of El Dorado.

“Transfer”: delivery of Personal Data to another Data Controller, within or outside of Panama, for the latter to process them autonomously.

4. Principles of Personal Data Processing

The processing of personal data by El Dorado is governed by the following principles:

  • Loyalty: Personal Data is collected without deception, falsehood and without resorting to fraudulent means.
  • Purpose: Personal Data is collected for specific purposes and is not subsequently used for purposes incompatible with those purposes.
  • Proportionality: only Personal Data that is adequate and necessary for the purpose of the Processing is collected.
  • Truthfulness and accuracy: El Dorado takes measures to keep Personal Data up to date, so that the purpose for which it was collected is not affected.
  • Data Security: El Dorado adopts the necessary technical, human and administrative measures to guarantee the custody of Personal Data.
  • Transparency: The information that El Dorado communicates to the Holder regarding the Processing of their Personal Data is provided in simple and clear language.
  • Confidentiality: Everyone involved in the Processing of Personal Data must keep this confidential, even after their relationship with El Dorado has ended.
  • Legality: The Processing of Personal Data requires the prior, informed and unequivocal consent of the Data Subject, except for the exceptions provided for by law.
  • Portability: The Holder has the right to obtain from El Dorado a copy of their Personal Data in a generic and commonly used format.

In turn, the processing of Non-Public Personal Information (NPI) associated with the Visa Prepaid Card service will also be done in compliance with applicable regulations in the United States.

5. Identification of the Data Controller

The Data Controller for the Personal Data covered by this Policy is EL DORADO LABS PY INC, a company incorporated under the laws of the Republic of Panama, and identified with RUC No. 155778564-2-2026.

EL DORADO LABS PY INC may transmit and/or transfer Personal Data, nationally and internationally, to the Processors and Controllers with whom it is related for the development of its activities, for which it will adopt the relevant legal and contractual mechanisms that guarantee the principles indicated in this Policy, as detailed in Section 9.

6. Collection and Types of Personal Data

6.1 When do we collect your Personal Data?

El Dorado collects Personal Data from Data Subjects, among others, in the following cases:

  • When the Holder registers on the Platform or makes use of the Services.
  • When the Data Subject provides Personal Data voluntarily, for example, by filling out physical or digital forms.
  • When the Holder provides their Personal Data so that El Dorado can perform identity validation (KYC) and verification in public or restricted databases.
  • When the player is interested in joining the El Dorado team.
  •  When a third party has referenced the Personal Data of a Data Subject.
  • When the Holder enters into a contract with El Dorado, whether it is an employment contract, a service contract, a commercial alliance contract or any other type of contract.

6.2 Data we collect from all Data Subjects

In general, from all Data Subjects, El Dorado may collect, among other things: names and surnames or company name/denomination, depending on whether it is a natural or legal person; country and city of residence or domicile; telephone number; email address; and the type and number of the identity document or the company's incorporation registration; as well as any other data necessary to fulfill the purposes described in this Policy.

6.3 Customer and user data of the Platform

In addition to the general data indicated in section 6.2, the following information may be collected from Platform clients and users: commercial and transactional profile information; data on the account(s) or wallet(s) used to operate on the Platform; P2P transaction history; browsing history on the Platform; history of open cases with customer service; information contained in national and international restricted lists; age; type and number of identity document, along with a legible and valid image thereof; biometric verification of the client's liveness; and information on their economic activity and the origin of their funds. When the client is a legal entity, the following information may also be collected: company name, address, email address, company registration number and tax identification number; description of its economic activity and, where applicable, the type of license, registration number or authorization and the issuing authority; name, address and email address of its Compliance Officer; Identification of its ultimate beneficial owners, shareholders, and whether any of them are politically exposed persons or subject to international sanctions; information on its geographic scope, its clients, and its program for the prevention of money laundering, terrorist financing, and proliferation of weapons of mass destruction (ML/TF/WMD); and supporting documentation such as recent financial statements, certificate of incorporation, articles of association or partnership agreement, register of shareholders, register of directors or officers, and proof of address, as well as any other type of information required for the fulfillment of the Processing purposes stated in Section 7 of this Policy, and the proper provision of El Dorado's Services.

6.4 Data on candidates, workers, shareholders and investors

In addition to the general data indicated in section 6.2, the following documents may be collected from candidates, workers, shareholders and investors of El Dorado: resume or curriculum vitae; personal and work references; academic records and certifications; personal identity card or passport; proof of address; and, where applicable, shareholder or social participation certificate and documentation on the origin of the funds contributed or invested.

6.5 Data on partners and suppliers

In addition to the general data indicated in section 6.2, the following documents may be collected from El Dorado's partners and suppliers, among others: notice of operation, articles of incorporation or certificate of incorporation duly registered in the Public Registry (or equivalent entity); Unique Taxpayer Registry number (RUC) (or equivalent tax identification document); commercial references; personal identity card of the legal representative or attorney; the power of attorney or document that accredits said representation; and other documentation necessary for the execution of the corresponding contract or commercial relationship.

6.6 Sensitive data and its processing

Given the characteristics of the Service, El Dorado may process some Sensitive Data, such as the image of the Holder's identity document and their photograph, obtained through biometric verification of proof of life carried out as part of the identity verification process (KYC), as well as any other Sensitive Data that is necessary for the fulfillment of the purposes described in this Policy and the proper provision of the Services.

El Dorado will only collect and process Sensitive Data in permitted cases and will always inform the Data Subject that they are not obligated to provide it or authorize its processing. If the Data Subject does not grant such authorization, El Dorado will not be able to continue with the identity verification process and, consequently, will not be able to provide the Services.

6.7 Image Data

By participating in videoconferences, events, activities, experiences, activations, campaigns, contests, promotional or marketing activities, events sponsored or supported by El Dorado, as well as in any other activity organized, produced, sponsored or disseminated by El Dorado, the Holder authorizes El Dorado, free of charge and on a non-exclusive basis, to capture, record, reproduce, use, edit, adapt, communicate, publish and disseminate their name, image, voice and/or participation, as appropriate, in photographs, videos, recordings, transmissions, interviews, testimonials and other audiovisual or graphic content generated on the occasion of said activities.

This authorization includes the use of these contents in advertising pieces, communication and marketing campaigns, social networks, websites, digital platforms, audiovisual material, printed material, commercial communications, presentations, events, brand activations, promotional dynamics, contests, institutional publications and other means or channels of communication, current or that may be developed in the future, for informative, institutional, promotional, advertising or commercial purposes related to El Dorado, its products, services, activities, initiatives or brand.

In principle, the Holder's participation and authorization to use their name, image, voice, and/or participation will not entitle them to any remuneration, royalty, compensation, or other consideration. However, the parties may agree in good faith, before or after a specific activity, to a specific economic consideration or condition when, due to the characteristics, scope, duration, nature, or purpose of the participation or the use of the content, they deem it appropriate. Any agreed-upon consideration must be specified in the terms defined by the parties for the corresponding activity.

The Owner understands and accepts that the content may be used individually or jointly with other content, as well as edited, cut, adapted or incorporated into different pieces or formats, provided that its use does not imply an illegitimate impairment of his honor, good name or dignity.

 

6.8. Non-Public Personal Information (NPI) – Visa Prepaid Card Service:

For the provision and administration of the Visa Prepaid Card service, and in compliance with applicable regulations in the United States, El Dorado may collect, use and process Non-Public Personal Information (NPI) from users.

Non-Public Personal Information (NPI) includes, but is not limited to, financial and transactional information related to the use of the product. Non-Public Personal Information collected in connection with the Visa Prepaid Card will be used exclusively for routine business purposes, including, but not limited to:

  • The issuance, activation and administration of the Visa Prepaid Card.
  • The processing, authorization, and settlement of transactions.
  • The maintenance and operational management of the services associated with the card, including its support.
  • Fraud prevention, compliance with obligations regarding the prevention of money laundering and terrorist financing, and other applicable legal and regulatory obligations.
  • Other associated purposes.

For these purposes, the Company shares the NPI with Bridge Ventures LLC and Lead Bank (in its capacity as the issuing bank of the Visa Prepaid Card), solely for the business purposes described above.

6.9. User rights and limitations on the use of the NPI

Users have the right to opt out of sharing their Non-Public Personal Information (NPI) with unaffiliated third parties for marketing or non-essential purposes.

Non-Public Personal Information and any other personal data collected specifically for the Visa Prepaid Card will not be sold, rented or shared with third parties for their own marketing purposes, without prejudice to disclosures permitted or required by applicable law or necessary for the provision of the service.

All collection, use and disclosure of the NPI will be carried out in accordance with applicable legislation, agreements with the issuing bank and the principles of confidentiality, security and data minimization

7. Purposes of the Processing

7.1 Purposes common to all Data Subjects

El Dorado will process Personal Data to: fulfill its corporate purpose and provide its services; maintain and manage information related to the employment, civil, or commercial relationship with the Data Subjects; comply with legal, accounting, commercial, and regulatory obligations; control and preserve the security of El Dorado's persons, assets, and information; store Personal Data on its servers or those of its Processors; disclose information when necessary to comply with legal processes, prevent fraud, or protect the security of El Dorado or third parties; prevent and verify the commission of crimes, for which it may consult national and international databases and restricted lists; comply with regulations on the prevention of money laundering, terrorist financing, and the proliferation of weapons of mass destruction (ML/TF/WMD); maintain direct communication with the Data Subjects for contractual and informational purposes; conduct statistical, commercial, financial, and administrative analyses; and address inquiries, requests, and complaints.

7.2 Specific purposes for clients and users of the Services

For customers and users of the Platform, El Dorado will also process Personal Data for:

  • The proper provision, management, administration, operation, maintenance and improvement of the Services offered by El Dorado, as well as the products, functionalities and solutions that are available through the Platform.
  • Verify, validate, update and maintain the identification, contact, profile and other information provided by the Holder, as well as manage the processes of registration, linking, authentication, access and data update.
  • Consult, verify and validate the Holder's information in public, private sources, databases, information centers, public and restrictive lists, national or international, and determine or update their risk profile in accordance with the policies and procedures for the prevention of money laundering, financing of terrorism and proliferation of weapons of mass destruction (ML/FT/FPADM) of El Dorado and other applicable legal or regulatory obligations.
  • Perform due diligence processes, know your customer (KYC), risk management and administration, prevention and detection of fraud, unusual transactions, illicit activities, identity theft and other conduct that may affect the security, integrity or proper provision of the Services.
  • To comply with the legal, regulatory, contractual and supervisory obligations applicable to El Dorado, as well as to respond to requirements, requests, orders or actions of administrative, judicial, regulatory, fiscal, police or any other competent authorities.
  • To manage, process, administer, monitor and track the operations, requests, orders, movements, products and services used by the Holder through the Platform.
  • To provide customer service, manage requests, inquiries, complaints, claims, petitions, suggestions and other communications from the Owner, as well as to monitor and evaluate the quality of service and the Services.
  • Implement and maintain security measures, authentication, identity verification, access control, prevention of unauthorized access and protection of accounts, funds, assets, information, technological infrastructure and other resources associated with the Services.
  • To detect, prevent, investigate, manage and mitigate risks related to fraud, money laundering, terrorist financing, financing of the proliferation of weapons of mass destruction, cybercrime, identity theft, abuse of the Services, illicit activities or any other irregular behavior or behavior contrary to the terms of use of the Platform.
  • Perform statistical, financial, transactional, operational and behavioral analyses, as well as segmentation, profiling, analytical modeling, market research, usage trends and behavioral patterns, for the purpose of understanding, evaluating and improving the user experience and the functioning of the Services.
  • Develop, evaluate, test, implement and improve new products, services, features, tools, technologies and solutions offered by El Dorado or related to the Platform.
  • Perform business prospecting activities, customer segmentation, preference and interest analysis, commercial profiling and evaluation of business opportunities, in accordance with applicable regulations.
  • Send communications related to the provision, operation, security, maintenance, updating or modification of the Services, including operational, technical, security, legal and administrative notices.
  • To send, when appropriate and in accordance with applicable regulations, commercial, advertising or promotional communications about products, services, benefits, news, events, campaigns, contests, promotions, activities and opportunities offered by El Dorado or by third parties with whom El Dorado maintains commercial relationships.
  • Design, organize, manage and execute marketing campaigns, promotions, contests, events, activations, loyalty programs, benefits, incentives and other commercial dynamics aimed at clients and users.
  • To evaluate eligibility, participation and compliance with conditions to access products, services, promotions, benefits, campaigns, programs, functionalities or other initiatives offered by El Dorado.
  • Conduct surveys, satisfaction studies, market research, feedback activities and user experience analysis, in order to understand the needs, preferences and perceptions of customers and users regarding El Dorado and its Services.
  • Generate statistical, aggregated, anonymized or dissociated information for the purposes of analysis, management, research, product development, decision making, strategic planning and measurement of the performance of the Services, provided that such information does not allow the direct identification of the Holder when the purpose so requires.
  • To manage contractual, commercial and legal relationships with the Owner, including the management of collections, payments, billing, claims, disputes and other actions arising from the relationship with El Dorado.
  • To manage, document and preserve the records, media, evidence and traceability of the activities, operations and communications carried out through the Platform, when necessary for the proper provision of the Services, compliance with legal obligations or the protection of the rights and interests of El Dorado.
  • Perform auditing, internal control, quality review, risk management, compliance, research and improvement processes for El Dorado's processes and services.
  • Sharing or allowing access to Personal Data with suppliers, contractors, strategic partners, related entities, Processors and third parties that provide services to El Dorado, when such access or Processing is necessary for the fulfillment of the purposes provided for in this Policy and in accordance with applicable regulations.
  • To carry out any other activities that may be necessary, related or complementary for the proper provision of the Services, the development of the relationship with the Owner, the protection of the rights and interests of El Dorado and compliance with applicable legal, regulatory and contractual obligations.

7.3 Purposes for candidates, employees, shareholders and investors

Evaluate and advance the personnel selection process, based on the resume, references and educational documentation provided by the candidate; verify the identity and contact information of candidates, employees, shareholders and investors using their personal identity card or passport and proof of address; accredit the status of shareholder or investor, based on the shareholder or social participation certificate, and facilitate the exercise of their corporate rights; and verify the origin of the funds contributed or invested, in accordance with the policies for the prevention of money laundering, financing of terrorism and proliferation of weapons of mass destruction (ML/FT/WMD) applicable to El Dorado.

7.4 Purposes for partners and suppliers

Formalize the commercial relationship with partners and suppliers, verifying their legal existence based on the social pact or certificate of incorporation and their Unique Taxpayer Registry number (RUC) (or the tax identification number that replaces it); evaluate their commercial suitability based on the commercial references provided; verify the identity and powers of the legal representative or attorney based on their personal identity card and the corresponding power of attorney; and manage the execution of the contract, including the payment of the sums, commissions or withholdings that may be due and the issuance of invoices and other contractual or commercial records.

8. Data Processors

8.1 Role of the Managers

To fulfill the purposes described in this Policy, El Dorado may use Data Processors, that is, third parties who process Personal Data on behalf of El Dorado and exclusively following its instructions. The actions of a Data Processor do not relieve El Dorado of its responsibility as the Data Controller towards the Data Subject.

Notwithstanding the foregoing, depending on the type of relationship the Data Processor has with El Dorado, and when deemed appropriate given the nature of that relationship, the Processor may contract directly with the Data Subjects to offer its own services. In such cases, the Processor will act as the Data Controller with respect to the Personal Data it processes by virtue of that direct relationship, which will be governed by its own terms and conditions and its own privacy policy, for which El Dorado will not be responsible.

8.2 Guarantees required of the Processors

El Dorado contractually requires all its Data Processors to: (i) process Personal Data exclusively for the authorized purposes and following El Dorado's instructions; (ii) implement technical, human, and administrative security measures equivalent to those required of El Dorado; (iii) maintain confidentiality regarding Personal Data, even after the contractual relationship has ended; (iv) not subcontract the Processing without prior authorization from El Dorado; (v) delete or return Personal Data upon termination of the contractual relationship, unless legally obligated to retain it; and (vi) collaborate with El Dorado to promptly address the Inquiries and Complaints of Data Subjects.

9. Transmission and transfer of Personal Data

9.1 Transmission to Processors

By accepting this Policy, the Holder authorizes El Dorado to transmit their Personal Data, within or outside of Panama, to the corresponding Processors under the terms described in Section 8.2, so that they may provide El Dorado with the operational, technological, compliance or administrative support necessary for the provision of the Services.

9.2 Transfer to third parties and international transfers

El Dorado may transfer Personal Data to third-party Data Controllers, within or outside of Panama, when authorized by the Data Subject, when permitted by law, or when required by an administrative or judicial order. Personal Data may be transferred, among other cases, for: (i) the proper provision of El Dorado's Services; (ii) compliance with requirements of governmental, judicial, or regulatory authorities, including competent authorities regarding digital assets; and (iii) the provision of services by technology or infrastructure providers located outside of Panama.

If El Dorado transfers Personal Data to a Processor, the Processor will process it in accordance with this Policy. If El Dorado transfers Personal Data to another Controller, the Personal Data will be processed in accordance with that new Controller's data protection policy, which El Dorado will endeavor to inform the Data Subject of.

9.3 Guarantees for international transfers

For all international transfers of Personal Data, El Dorado will adopt the necessary contractual and technical measures to ensure that the receiving third party is aware of and agrees to observe the principles of this Policy, guaranteeing that the information received is used only for the purposes authorized by the Data Subject and related to the provision of the Services.

10. Authorization and consent of the Data Subject

El Dorado requires the free, prior, express and informed consent of the Data Subject for the Processing of their Personal Data, except in cases where the law does not require it.

Authorization may be obtained through electronic documents, data messages, forms on the Platform or any other mechanism that allows the unequivocal verification of the Holder's consent.

When El Dorado substantially modifies the purposes of the Processing, it will publish the changes on the Platform and request new authorization from the Data Subject when necessary. If the Data Subject does not agree with the new purposes, they may revoke their authorization and request the deletion of their Personal Data, provided there is no legal or contractual obligation preventing such deletion.

11. Rights of the Holder

The Holder has the following rights:

11.1 Main rights:

  • Access: to know if El Dorado processes your Personal Data and, if so, to access it.
  • Rectification: request the correction or updating of your Personal Data when it is inaccurate, incomplete or outdated.
  • Cancellation: request the removal or deletion of your Personal Data from El Dorado's Databases, when the Processing does not respect the applicable principles, rights and guarantees.
  • Opposition: to oppose, on legitimate grounds relating to your particular situation, the Processing of your Personal Data for specific purposes.
  •  Portability: request and obtain from El Dorado a copy of your Personal Data in a generic and commonly used format.

11.2 Other rights

  • Request proof of the authorization granted for the Processing of your Personal Data.
  • To be informed, upon request, regarding the use that has been made of your Personal Data.
  • Please refrain from answering questions about Sensitive Data, without this obligating you to authorize said Processing.
  • Submit inquiries and complaints to El Dorado in accordance with the procedure described in Section 12 and, once this process is exhausted, submit your complaints or reports to the competent authority.

The request for cancellation of information and the revocation of authorization will not proceed when the Holder has a legal or contractual duty to remain in the El Dorado Database.

12. Procedure for exercising rights

The Data Subject who wishes to exercise their rights must send an email to support.admin@eldorado.io, addressed to EL DORADO LABS PY INC, specifying: (i) name and identification of the Data Subject or the authorized person; (ii) precise and complete description of the facts that give rise to the Inquiry or Complaint; (iii) claim; (iv) email address to send the response; and (v) the relevant documents and other evidence.

12.1 Queries

When the Data Subject wishes to consult the information held in the Database, El Dorado will respond to the request within a maximum period of fifteen (15) business days from its receipt. If it is not possible to respond to the request within this period, the Data Subject will be informed of the reasons for the delay and the date on which it will be addressed, which in no case may exceed five (5) business days following the expiration of the first period.

 12.2 Claims

When the Data Subject believes that their Personal Data should be rectified, canceled, or objected to, or when they notice a suspected breach of this Policy, they may file a Complaint with El Dorado. If the Complaint is incomplete, El Dorado may request the Data Subject to complete it within five (5) business days of receiving it; if two (2) months elapse without the Data Subject providing the required information, it will be understood that they have withdrawn the Complaint.

El Dorado will address the Claim within a maximum of fifteen (15) business days from the day following its receipt. If it is not possible to address it within this period, the Holder will be informed of the reasons for the delay and the new date of service, which may not exceed eight (8) business days following the expiration of the first period.

The removal or cancellation of Personal Data will not be permitted when there is a legal or contractual obligation to remain in the El Dorado Database.

12.3 Security reports and incidents

Any incident related to information security breaches will be reported internally to the Compliance Officer or Data Protection Officer of El Dorado, who will coordinate with the Technology area the adoption of the relevant corrective measures and, when appropriate, will inform the competent authorities and the affected Data Subjects.

13. Duties of El Dorado as Data Controller

  • To guarantee at all times the full and effective exercise of the rights of the Holders.
  • Request and keep a copy of the authorization granted by the Holder.
  • Properly inform the Data Subject about the purpose of the collection and their rights.
  • Keep the information under secure conditions that prevent its alteration, loss, unauthorized consultation, use or access.
  • Ensure that the information is truthful, complete, accurate, up-to-date, verifiable, and understandable.
  • Update and correct the information when appropriate, and promptly communicate any changes to your Managers.
  • Provide the Processors only with Personal Data whose Processing has been previously authorized.
  • Require the Processors to respect the security and privacy conditions of the Data Subject's information.
  •  Process in a timely manner the inquiries and complaints made by the holders.
  • Appoint a Data Protection Officer.
  • Register your Databases with the competent authority, when such registration is required in accordance with the applicable regulations.

14. Duties of the Data Processors

  • To guarantee the Holder, at all times, the full and effective exercise of his or her rights.
  • Process Personal Data only for the purposes and instructions authorized by El Dorado.
  • Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, use or unauthorized or fraudulent access.
  • To promptly update, rectify or cancel the Personal Data as indicated by El Dorado.
  • Maintain confidentiality regarding the information processed, even after the contractual relationship with El Dorado has ended.
  • Inform El Dorado when there are violations of security codes or risks in the management of the information of the Holders.
  •  Collaborate with El Dorado in handling inquiries and complaints from account holders within the timeframes indicated by El Dorado.

15. Validity of the authorization and temporality of the data

El Dorado will process the Holder's Personal Data from the moment the Holder grants their authorization until the purpose for which it was collected is fulfilled, or until El Dorado is dissolved and liquidated, whichever occurs first. However, once the purpose has been fulfilled, El Dorado may retain the information for the period necessary to comply with legal, contractual, accounting, tax, or reporting obligations to authorities, including those related to the prevention of money laundering, terrorist financing, and the proliferation of weapons of mass destruction (ML/TF/WMD).

In any case, the Holder may revoke their authorization at any time through the institutional channels indicated in Section 12, after verification of their identity.

16. Security and cybersecurity measures

El Dorado implements reasonable and proportionate human, administrative, and technical safeguards to ensure the confidentiality, integrity, and availability of Personal Data, preventing its alteration, loss, unauthorized or fraudulent access, use, or disclosure. These measures include, among others: an access management system with differentiated privileges based on user role; encryption of sensitive information both in transit and at rest; the definition of internal responsibilities for the preservation and protection of Personal Data; and the existence of mechanisms for managing security incidents.

By accepting this Policy, the Data Subject expressly accepts these protection measures and declares that they consider them appropriate and sufficient for the protection of their Personal Data.

17. Cookies and similar technologies

A cookie is a file that is downloaded to the user's device when accessing the Platform. Cookies allow, among other things, the storage and retrieval of information about the user's browsing habits. El Dorado uses its own and third-party cookies to personalize the browsing experience, remember preferences, generate metrics and analytics, and track consumption habits within the Platform.

The Owner may reject the use of cookies by configuring their browser.

18. Data Protection Officer / Delegate

El Dorado has appointed Catalina Ortega Osorio as its Data Protection Officer, who can be contacted at catalina@eldorado.io . Any questions, inquiries, or complaints related to this Policy can be directed to Ms. Ortega or to the institutional email address support.admin@eldorado.io.

19. Changes to this Policy

Any modification, update or adjustment to this Policy will be notified to the User in a timely manner through the application, also referred to as the Platform.

The User accepts and acknowledges that it is their responsibility to periodically review the application for any changes. Continued use of the Platform, or express acceptance within it, will be understood as full and binding acceptance of the new Policy terms.

 Last modified: September 11, 2026

THE LATINO DREAM:

El Dorado Dollar Dream $