1. Introduction 

We are committed to our purpose of providing technological and operational control and security to safeguard the personal data of our customers, suppliers, partners, and collaborators. We must ensure that the access and information security policies deemed relevant by MAAKAL are implemented. This includes the implementation of processes and policies, communication channels, and the unique identification of MAAKAL users.

2. Objective 

To define guidelines that promote the proper treatment and protection of information based on international Habeas Data standards, aiming to secure the management and control of access within MAAKAL, INC. among all people working for the Company and its stakeholders.

3. Scope

We promote values of respect, adherence to legality, confidentiality, availability, and the proper handling of personal information used by the company to fulfill corporate and business objectives. These policies aim to ensure that the natural and legal persons interacting with the company are aware of the purposes and conditions of use and Treatment of personal data, are informed about who is responsible for their data, and have the tools to exercise their right to control and decision-making over the use and destination of their personal data.

• Additional Policies
• These policies also include basic normative aspects, annexes with the purposes for which personal information is obtained by the company, procedural schemes that allow data authorization by its Holder, and guarantees and instruments to ensure the validity of the fundamental rights protected by the mentioned provisions.

4. General Policies and Guidelines

All the norms and procedures described below are part of the elements that compose the policy:

1. IDENTIFICATION OF THE PARTY RESPONSIBLE FOR INFORMATION PROCESSING

 MAAKAL, INC., legally constituted through a private document, registered in the State of Florida, United States.

Email: legal@maakal.com

Website: www.maakal.com

Integrated Policy: At MAAKAL, INC., we strive for customer satisfaction through innovative and sustainable processes within the organization, fostering commitment and growth of our human talent. We work towards compliance with legislation and applicable requirements for occupational safety and health.

2. DEFINITIONS

 For the purposes of this policy, the definitions established by the current regulations are listed below.
*

• Authorization: Prior, express, and informed consent of the Holder to carry out the Processing of personal data.
• Database: An organized set of personal data that is subject to Processing.
• Personal Data: Any information linked or that can be associated with one or more determined or determinable natural persons.
• Data Processor: A natural or legal person, public or private, who alone or in association with others processes personal data on behalf of the Data Controller.
• Data Controller: A natural or legal person, public or private, who alone or in association with others decides on the database and/or the Processing of data.
• Holder: A natural person whose personal data is subject to Processing.
• Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.
• Privacy Notice: Verbal or written communication generated by MAAKAL, INC., directed to the Holder of personal data, informing them of the existence of the information Processing policies that will be applicable to them, the way to access them, and the purposes of the Processing intended for personal data.
• Public Data: Data related to the civil status of people, their profession or trade, and their status as a merchant or public servant; those that by their nature are not subject to protection.
• Sensitive Data: Sensitive data is understood as data that affects the privacy of the Holder or whose misuse can lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations, human rights organizations, or those promoting the interests of any political party or guaranteeing rights, as well as data related to health, sexual life, and biometric data.
• Transfer: The transfer of data occurs when MAAKAL, INC., located in the United States, sends the information to its clients with sensitive work data, executions that in turn are Data Controllers and are located inside or outside the country.
• Transmission: Transmission occurs when MAAKAL, INC., in its capacity as the controller, communicates the data within or outside the territory of the United States to a processor acting on behalf of MAAKAL, INC., with the objective of Processing.

3. PRINCIPLES

For the collection, management, and deletion of personal data, MAAKAL, INC. will act in accordance with the principles established by U.S. law.

• Legality: For the Processing of personal data, MAAKAL, INC. will adhere to the provisions established by law and other regulations.
• Purpose: MAAKAL, INC. will inform the Holder of the purpose of the Processing given to personal data, which must be legitimate in accordance with the constitution and the law.
• Freedom: MAAKAL, INC. will process personal data only with the prior, express, and informed consent of the Holder; or by legal or judicial mandate.
• Veracity or Quality: The information subject to Processing of personal data must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The Processing of partial, incomplete, fractioned, or misleading data is prohibited.
• Transparency: MAAKAL, INC. guarantees the Holder the right to obtain information at any time and without restrictions about the existence of their data.
• Restricted Access and Circulation: The Processing that MAAKAL, INC. gives to personal data will adhere to the provisions established by law and the Constitution; personal data cannot be made available on the internet or other mass communication means, except for public data or those whose access is technically controllable to provide restricted knowledge to the Holder or authorized third parties.
• Security: The information subject to Processing by MAAKAL, INC. will be protected through the use of technical, human, and administrative measures necessary to provide security to the records, preventing their alteration, loss, consultation, unauthorized use, or fraudulent access.
• Confidentiality: The people involved in the Processing of personal data that are not public are obligated to ensure the confidentiality of the information provided, even after their relationship with any of the tasks comprising the Processing has ended. MAAKAL, INC. will guarantee the necessary means to maintain such confidentiality.

4. PURPOSES OF DATA PROCESSING

This policy applies to all processes and procedures developed within the framework of MAAKAL, INC.’s corporate purpose. The company collects, stores, uses, manages, transfers, transmits, and deletes personal data for the following purposes:

• In relation to the nature and business management of MAAKAL, INC.

The Processing of personal data will be carried out with the aim of developing its main corporate purpose, which consists of providing services inherent to energy and water management in public services. For this purpose, the company may carry out all activities of a civil, commercial nature and the necessary judicial or administrative procedures for the effective provision of these services, including consultancy, consulting, import and export of products and services, event organization, training, and required procedures both domestically and internationally. The company may generally carry out all operations of any nature related to the mentioned corporate purpose, as well as any similar, related, or complementary activities that facilitate or develop the company’s trade or industry.

• In relation to the operation of MAAKAL, INC.

 4.2.1 HUMAN TALENT MANAGEMENT:

The Processing of personal data will be carried out for the selection, hiring, performance management, and communications, termination, or conclusion of legal relationships with employees, former employees, job applicants, interns, and others.

4.2.2 MANAGEMENT OF OCCUPATIONAL SAFETY AND HEALTH

The Processing of personal data will be carried out for the implementation of the requirements established by regulations and the execution of Occupational Safety and Health Management programs.

Employee Database: The Processing of personal data specifically for the company’s employees will be conducted not only for the selection and hiring processes but also to develop all types of training and development programs that enhance employee performance. Additionally, personal data may be used for the initiation and development of disciplinary processes as provided for in the company’s regulations.

4.2.3 FINANCE AND ACCOUNTING MANAGEMENT:

The Processing of personal data will be carried out for all types of collection, payment, inquiry, verification, control, and payment methods enablement activities. Similarly, it will be used for the payment of employees, suppliers, and contractors.

4.2.4 PHYSICAL AND TECHNOLOGICAL INFRASTRUCTURE MANAGEMENT:

The Processing of personal data will be carried out for the planning and execution of preventive maintenance of infrastructure and equipment. Additionally, the processing will be carried out to identify the need for support and manage alternative solutions.

Supplier and Contractor Database: The Processing of data will be carried out for purposes related to the development of the contractual management process of products and services that MAAKAL, INC. requires for its operation in accordance with current regulations. The Processing of data will be carried out for the development of payment activities, collections, credit management, and other activities necessary for the company’s operation.

4.2.5 COMMERCIAL MANAGEMENT (GVT) – SALES AND BILLING.

The Processing of personal data will be carried out for the execution of the company’s commercial strategy. During visits to validate customer needs, offer the business portfolio, or any type of commercial proposal, personal data of various types will be collected. Additionally, in the process of formalizing the purchase and registering the customer in the company’s internal systems for billing and dispatch, personal data processing will also take place.

4.2.6 COMMERCIAL MANAGEMENT (GVT) – CUSTOMER SERVICE:

Customer personal data will be processed to assess the quality of products or services through satisfaction surveys or other means. In the process of addressing customer requests, complaints, or claims, personal data processing will be carried out in accordance with the law.

4.2.7 PROCUREMENT MANAGEMENT (GCO):

The Processing of personal data will be carried out to advance the entire process of purchasing goods and services for the company.

4.2.8 MARKETING AND ADVERTISING:

The processing of personal data may be undertaken to develop all types of commercial campaigns or in the execution of the company’s corporate purpose. Similarly, personal data will be processed for sending promotional information or in the execution of loyalty and customer engagement programs. Customer Database: The Processing of personal data will be carried out to execute activities inherent to the Commercial Management and purchasing processes of MAAKAL, INC.

4.2.9 SECURITY IN MAAKAL, INC.’s FACILITIES:

Processing will be carried out for the surveillance and security of people, assets, and MAAKAL, INC.’s facilities.

4.3 Specific Purposes

For the development of procedures that deploy the above processes, MAAKAL, INC. establishes specific purposes for the Processing of personal data that are integrated into these policies. MAAKAL, INC. commits to not processing personal data for purposes other than those described in these policies without obtaining the explicit and unequivocal authorization of the Holder.

5. HOLDER

For the purposes of these policies, the Holders of personal data will be understood as all persons who are registered in the databases of MAAKAL, INC.: I) Partners, II) Employees, III) Suppliers, IV) Clients, V) Allies. In the case of minors (children and adolescents), their legal representatives will have the authority to authorize or deny the Processing of their personal data. In the Processing of these data, respect for the prevailing rights of minors, such as privacy and protection of personal information, will be ensured.

6. PROCESSING TO WHICH PERSONAL DATA IS SUBJECTED

 For the collection, storage, use, circulation, and deletion of information, MAAKAL, INC. establishes the following procedures and instruments in these policies:

6.1. Collection of Personal Data

 Notwithstanding the exceptions provided by law, MAAKAL, INC. will collect personal data only when it obtains the Holder’s authorization, limiting itself to those personal data that are relevant or adequate for the purpose for which they are collected or required according to current regulations. MAAKAL, INC. will not use deceptive or fraudulent means to collect and process personal data. The collection process will be carried out through the completion of requests to join the databases, surveys, or forms in a telephone, digital, or face-to-face manner, or any other appropriate means, without prejudice to the particular conditions that apply to each of the purposes for which personal data is collected. From the moment the Holder of the personal data authorizes MAAKAL, INC. to collect and process their personal data, such data may be used in the development of the company’s commercial and labor activities.

6.2 Authorization

 Notwithstanding the exceptions provided by law, MAAKAL, INC. will process personal data only after obtaining the Holder’s informed and express authorization, which will be drafted in clear and simple language and must be obtained by any written, physical, digital, or electronic means that can be consulted later, no later than at the time of its collection. At the time of requesting the Holder’s authorization, MAAKAL, INC. must clearly and expressly inform them of the personal data to be collected and the specific purposes for which they will be processed, as well as the rights the Holder has and the means through which they can exercise them. The Holder has the right to choose not to provide any sensitive personal data requested by MAAKAL, INC., related, among other things, to data about their racial or ethnic origin, membership in trade unions, social or human rights organizations, political, religious beliefs, sexual life, biometric, or health data. In any case, depending on the activity carried out, MAAKAL, INC. will clearly communicate to the Holder of the personal data the mechanisms available to them for knowing, updating, modifying, and deleting their data, as well as revoking the authorization granted. MAAKAL, INC. may continue with the Processing of the data contained in its databases for the purpose indicated in these policies, without prejudice to the Holder’s right to exercise at any time their right to request the deletion of the data.

6.3 Cases Where Authorization is Not Required

The Holder’s authorization will not be necessary in the following cases: (i) public data or databases, (ii) information required by mandate of public administrative authorities or by court order, (iii) cases of medical or health emergencies, (iv) Processing of information authorized by law for historical, statistical, or scientific purposes, among other public nature.

6.4 Conservation and Deletion of Personal Data

 MAAKAL, INC. will keep personal data in its manual and digital repositories, taking into account the level of risk, and will take the necessary technical, human, and administrative measures to ensure the privacy, confidentiality, and security of the data provided by the Holders, preventing alteration, loss, consultation, use, or unauthorized or fraudulent access by third parties. MAAKAL, INC., applying the principle of autonomy, reserves the right to maintain and catalog as confidential the information that rests in its databases. Furthermore, it is stated that some of its portals may contain links to third-party websites, over which it has no control or responsibility for the content, privacy policies, security, and handling of personal data established therein. It is the responsibility of the Holder of personal data to be aware of the policies related to the protection and Processing of their information on the respective portals. On MAAKAL, INC.’s website, instructions will be provided for each user or Holder of personal data to interact with them and submit requests for any type of correction, modification, and deletion in accordance with what is established in these policies.

6.5 Processing of Personal Data of Children and Adolescents

 In the Processing, the respect for the prevailing rights of children and adolescents will be ensured. The Processing of personal data of children and adolescents is prohibited, except for data of a public nature.

• Data Collected Before the Adoption of These Policies

MAAKAL, INC. will comply with the notice of authorization request required by current data protection regulations in order to continue processing databases formed before the entry into force of the Law.

7. RIGHTS OF THE HOLDER

The Holder of personal data or credit obligation acquired with MAAKAL, INC., shall have the right to:

• Know, update, and rectify their personal data with MAAKAL, INC. through the channels established in these policies. This right may be exercised, among other things, in relation to partial, inaccurate, incomplete, fragmented data that leads to errors, or those whose Processing is explicitly prohibited or has not been authorized.
• Request proof from MAAKAL, INC. of the authorization granted for the Processing of their personal data, except for the exceptions provided by law.
• Be informed by MAAKAL, INC., upon request made through the channels provided in these policies, about the use given to their personal data.
• Submit inquiries to MAAKAL, INC., and file complaints with the entity in charge of protecting personal data.
• Request the revocation and deletion of their personal data when MAAKAL, INC. engages in conduct contrary to the law and the Constitution.
• Access, free of charge and without limitation, through the channels provided in these policies, the personal data that is subject to Processing.

8. DUTIES

The Holder of personal data must keep their information updated and guarantee its accuracy at all times to MAAKAL, INC. MAAKAL, INC. will not be held liable, under any circumstances, for any liability arising from the inaccuracy of the information provided by the Holder.

9. RESPONSIBLE AND IN CHARGE OF PERSONAL DATA PROCESSING

9.1 Data Controller

MAAKAL, INC. will be the Data Controller for personal data and, in this capacity, acquires the following obligations:

1. Ensure the Holder, at all times, the full and effective exercise of the right to habeas data.
2. Request and keep, under the conditions provided in the present law, a copy of the respective authorization granted by the Holder.
3. Properly inform the Holder about the purpose of the data collection and the rights they have by virtue of the authorization granted.
4. Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
5. Ensure that the information provided to the Data Processor is truthful, complete, accurate, updated, verifiable, and understandable.
6. Update the information, promptly communicating to the Data Processor all updates regarding the data previously provided and adopting the necessary measures to keep the information provided updated.
7. Correct the information when it is incorrect and communicate the pertinent changes to the Data Processor.
8. Provide the Data Processor, as the case may be, only the data whose Processing is previously authorized in accordance with the provisions of the present law.
9. Require the Data Processor, at all times, to respect the security and privacy conditions of the Holder’s information.
10. Handle the inquiries and complaints filed within the timeframes established in the present law; Adopt a policy and procedures to ensure proper compliance with the law and especially to address inquiries and complaints.
11. Inform the Data Processor when certain information is under discussion by the Holder, once the complaint has been filed, and the respective process has not yet concluded; Inform, upon request of the Holder, about the use given to their data.
12. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
13. Inform the data protection authority when there are breaches of security codes and when there are risks in the management of the Holder’s information.

9.2 Data Processor

 The Management, through the person occupying the position of Communications and Marketing Analyst in association with the customer service areas, will be responsible for the Processing of personal data on behalf of MAAKAL, INC. The Data Processor will be provided with personal information of the Holders stored in a database. Additionally, they must monitor and update the purposes for the Processing of personal data within the company. The officer in charge of this area will maintain a report of the databases and will be responsible for the following functions:

1. Know and apply this policy as applicable to ensure the Holder’s full and effective exercise of their rights.
2. Inform the Holder about the purpose of data collection and ensure the exercise of the rights they have by virtue of the authorization granted.
3. Use only the personal data obtained with authorization, unless it is not required.
4. Keep a copy or backup of the respective authorization granted by the Holder of the personal data.
5. Ensure that the information subject to Processing is truthful, complete, accurate, updated, verifiable, and understandable.
6. Respect the security and privacy conditions of the Holder’s information to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
7. Update, correct, or delete personal data within five (5) business days from receipt of the request.
8. Timely handle inquiries and complaints filed by the Holders of personal data.
9. Apply the procedure required by law in case of complaints or administrative or judicial processes related to the Processing of personal data of the Holders, as well as when there is a violation of security codes and when there is a risk in the management of the Holders’ information.
10. Allow access to the information only to authorized persons.
11. Establish the measures to be taken within MAAKAL, INC., in each of the processes and procedures involving the Processing of the Holders’ personal data.
12. Sign confidentiality agreements with those who handle information related to the Processing of personal data.
13. Comply with the instructions and requirements issued by the competent administrative authority.
14. Other duties provided by law.

10. PROCEDURE FOR EXERCISING THE RIGHTS OF THE HOLDERS

The procedure and instruments for the Holders of information to exercise their rights to know, update, rectify, and delete information and revoke its use are as follows:

10.1 Communication Channels

The Processing of personal data by MAAKAL, INC. may be carried out through physical mail, email, landline, website, mobile phone or device, text message, fax, social networks, surveys, or any other widely known communication medium, in compliance with the provisions of current regulations.

MAAKAL, INC. establishes the following communication channels for the Holders:

• Website: www.maakal.com
• Email: legal@maakal.com
• PBX: +1 954 210 8488

10.2 Inquiries and Complaints

Inquiries and complaints made to MAAKAL, INC., must be addressed to the email legal@maakal.com. If additional information is required, the interested party may contact the phone number +1 954 210 8488. Inquiries made by the Holder of personal data or their successors will be addressed by MAAKAL, INC. within a maximum term of ten (10) business days from receipt of the respective request, which may be extended for a maximum term of five (5) business days, with MAAKAL, INC. informing the interested party in advance.

The Holder or their successors who consider that the information contained in MAAKAL, INC.’s database should be corrected, updated, or deleted, or when they notice the alleged non-compliance with any of the duties contained in the law or these policies, may file a complaint with the Communications and Marketing Analyst, which will be processed under the following rules:

• The complaint will be filed through a request addressed to the General Management, using the communication channels provided in this policy, with the Holder’s identification, a description of the facts giving rise to the complaint, the address, and the attached documents required.
• The maximum term to address the complaint will be fifteen (15) business days from the day following the date of receipt, which may be extended for a maximum term of eight (8) business days when it is not possible to address the complaint within that term, with the customer service area informing the interested party of the reasons for the delay.
• If the complaint is incomplete, the interested party will be required within five (5) business days following receipt of the complaint to correct the deficiencies. If two (2) months have passed since the date of the request without the applicant providing the required information, it will be understood that they have withdrawn the complaint.
• In case the recipient of the complaint is not competent to resolve it, they will forward it to the Communications and Marketing Analyst within a maximum term of two (2) business days and will inform the interested party of the situation.
• Before turning to the entity in charge of monitoring compliance with personal data protection regulations, the Holder must initially process their complaint with MAAKAL, INC. through the means and channels provided for that purpose.

11. SCOPE OF APPLICATION

These policies will apply to the databases managed by MAAKAL, INC. as part of the development of its corporate purpose and the commercial relationships it establishes. Depending on the obligations acquired within the framework of these relationships, MAAKAL, INC. will act as either the Data Controller or the Data Processor depending on whether the data is received from a third party or collected directly by the company.

This policy will also apply when data is processed within the territory of the United States.

12. RIGHT TO HABEAS DATA

These policies adopt the definition from U.S. law, according to which Habeas Data is the right of every person to know, update, and rectify information that has been collected about them in databases or files, whether held by public or private entities.

The scope of Habeas Data in these policies also includes what is known as “financial habeas data,” which is the right of every individual to know, update, and rectify their personal, commercial, credit, and financial information contained in public or private information centers that are responsible for collecting, processing, and circulating these data to determine the financial risk level of the Holder.

Finally, the right to Habeas Data in these policies is understood more broadly than just financial and credit aspects; it includes the Holder’s right to control the information that has been collected about them in any database or file, managed by private or public entities.

13. NATIONAL REGISTRATION OF POLICIES AND DATABASES

This is the public directory of databases subject to Processing that operate in the country, and it will be freely accessible to citizens. MAAKAL, INC. will register its policies and databases with the competent administrative authority, in the time and place established by this authority.

14. IDENTIFICATION OF DATABASES

 MAAKAL, INC. has identified the following databases:

• Public Information Database: The data contained in public records come from the fulfillment of a regulated function, whose forms and procedures serve a purpose of publicity and enforceability. These data are of a public nature by legal provision and do not require the prior authorization of the Holder for their Processing. Likewise, it is understood that subsequent records delegated to MAAKAL, INC. will have the same public nature.
• Shareholders’ Databases: These are manual or automated databases that are structured and contain public and private data about individuals who are associated with the company as shareholders. Private data in these databases require the Holder’s authorization. These databases may contain sensitive information and will only be used for the purposes for which they were entrusted.
• Employee Databases: These are manual or automated databases that are structured and contain public and private data about individuals who are employed by MAAKAL, INC. Private data in these databases require the Holder’s authorization. These databases may contain sensitive information and will only be used for the purposes for which they were entrusted.
• Supplier Databases: These are manual or automated databases containing data about natural or legal persons who have a contractual and commercial relationship, with the purpose of Processing to fulfill the contractual provisions stipulated by MAAKAL, INC., for the acquisition of services and goods required by MAAKAL, INC. in the development of its corporate purpose and economic activity. This database contains public, private, and sensitive personal data, which are intended for the development of contractual relationships. The Processing of these data for purposes other than maintaining the contractual relationship or fulfilling legal obligations requires prior authorization from the Holder or their legal representative, as the case may be, which will be contained in the clauses stipulated for this purpose in the linkage, provision, or contract documents.
• Customer Databases: These are manual or automated databases that are structured and contain public and private data about natural or legal persons as customers. In MAAKAL, INC., this status is attributed to any natural or legal person who formally links with the company in the commercial management process. Private data in these databases require the Holder’s authorization. These databases may contain sensitive information and will only be used for the purposes for which they were entrusted.

15. AUTHORIZED DATABASES

Sensitive personal data will be available for consultation and/or modifications in the following authorized databases:

• Website: www.maakal.com

The aforementioned databases have the necessary security mechanisms to protect the data, such as backups, centralized systems, contingency schemes, and access control by profiles.

16. PRIVACY NOTICES AND SECURITY MEASURES APPLIED TO THE PROCESSING

 In cases where it is not possible to make these policies available to the Holder, MAAKAL, INC. will inform the Holder of their existence and how to access them through a privacy notice. This notice will be prepared and communicated in accordance with data protection regulations, and a copy of such publication will be kept as proof in MAAKAL, INC.’s files.

MAAKAL, INC. has “Information Security Policies” to ensure compliance with the required security requirements in the Processing of personal data. These policies are understood to be incorporated into this document and establish the controls implemented by MAAKAL, INC. to guarantee the security of personal data. They involve the adoption of physical, administrative, and legal procedures and measures to ensure access control, processing, incident management, and matters related to information security audits.

17. TRANSFERS AND TRANSMISSIONS OF PERSONAL DATA

 In the development of its corporate purpose, MAAKAL, INC. establishes links and alliances with other legal entities co-responsible for the Processing of personal data. In these cases, MAAKAL, INC. will extend to these relationships the obligations established in these policies for data controllers and processors and will sign the respective contracts for the transmission of personal data to process on behalf of the controller in accordance with the principles that protect them, safeguard the security of the databases containing personal data, and maintain confidentiality regarding the Processing.

18. APPLICABLE LEGISLATION

• United States of America

19. EFFECTIVE DATE, DURATION, AND MODIFICATION

This policy will become effective on April 11, 2023, and will remain valid as long as MAAKAL, INC. exercises its corporate purpose, or until the law provides otherwise.

This policy may be modified at any time and unilaterally by MAAKAL, INC., with timely notification to the Holders of personal data of such modifications.