PRIVACY POLICY

Trade Name: Topner (trademark in process of registration) Data Controller: William Piero Tokunaga Address: Lima, Peru Tax Regime: Natural person with RUC (Unique Taxpayer Registry), issuance of electronic professional fee receipts

Effective Date: April 26, 2026 Last Updated: April 26, 2026

Preamble

This Privacy Policy (hereinafter, the “Policy”) regulates the processing of personal data that users (hereinafter, the “User” or “Users”) provide through the website operated under the Topner trade name (hereinafter, the “Website”).

This Policy has been prepared in compliance with the Peruvian legal framework on personal data protection and in accordance with international standards of good practices in privacy matters. Its objective is to inform the User, clearly and comprehensibly, what personal data is collected, for what purpose, for how long, under what security measures, and what rights they may exercise with respect to such data.

The use of the Website and, in particular, the voluntary submission of information through the enabled forms, implies that the User has read, understood, and accepted the terms of this Policy.

1. Identification of the Data Controller

The data controller responsible for processing personal data collected through the Website is:

The controller acts as the holder of the personal data bank generated from information collected on the Website, assuming the obligations that Peruvian law imposes on this status.

2. Applicable Legal Framework

The processing of personal data carried out by the controller is subject to current Peruvian legislation regarding personal data protection, in particular:

• Law No. 29733, Personal Data Protection Law.
• Supreme Decree No. 003-2013-JUS, Regulations of the Personal Data Protection Law.
• Complementary norms, directives, and resolutions issued by the national competent authority on personal data protection that are currently in force.

Likewise, this Policy observes internationally recognized standards regarding privacy and data protection, including principles of lawfulness, purpose, proportionality, quality, security, provision of resources, and adequate level of protection.

Informational Note: The Peruvian regulatory framework on personal data protection may be subject to modifications, replacements, or updates. The controller commits to adapting this Policy to the provisions in force at the time of processing. Users are advised to verify the updated regulations with the national competent authority.

3. Personal Data Collected

3.1. Data Collected Through Forms

The Website collects personal data only when the User voluntarily provides it through the submission of forms available in its various sections. The data that may be collected includes, in an enumerative manner:

• User’s name.
• Email address.
• Project name or brand associated with the User.
• Project description.
• Type of service requested.
• Any other information that the User decides to voluntarily provide by completing the form fields or writing the body of their request.

3.2. Data Not Collected Automatically

As of the effective date of this Policy, the controller declares that the Website:

• Does not collect data automatically from the User’s device or browser.
• Does not use tracking tools or behavior monitoring systems.
• Does not employ web analytics services (analytics).
• Does not install tracking cookies or equivalent technologies for advertising or profiling purposes.

3.3. Voluntary Nature and Consequences of Not Providing Data

The supply of data required in the forms is voluntary. However, the refusal to provide the minimum necessary data could prevent the controller from adequately addressing the User’s request.

4. Purposes of Processing

Personal data collected will be processed solely and exclusively for the following purposes:

1. Request Handling: respond to queries, messages, and requirements sent by the User through the Website forms.
2. Feasibility Evaluation: analyze the information provided to determine the technical, operational, or commercial feasibility of the proposed projects.
3. Contract Management: establish, execute, and follow up on the contractual relationship derived from contracted services.
4. Issuance of Payment Receipts: issue electronic professional fee receipts and other documents required by Peruvian tax regulations.
5. Compliance with Legal Obligations: meet requirements of a legal, tax, accounting, regulatory nature or from competent authorities.

4.1. Purposes Not Contemplated

The controller expressly declares that personal data collected will not be used for:

• Personalized advertising.
• Sale, paid transfer, or commercialization of personal data to third parties.
• Elaboration of commercial or behavioral profiles of the User.
• Any purpose other than those expressly stated in this Policy.

Any processing that exceeds the purposes described here will require the prior, free, express, unequivocal, and informed consent of the User.

5. Data Retention

The controller will retain the User’s personal data only for the time strictly necessary to fulfill the purposes described in section 4 of this Policy. In particular, retention periods will be determined according to the following criteria:

• Time necessary to address the request formulated by the User.
• Duration of the contractual relationship between the User and the controller, including post-termination actions that are reasonably necessary.
• Mandatory legal periods, in particular those derived from tax, accounting, and regulatory obligations applicable to the controller’s activities.

Once the purposes are fulfilled and applicable legal periods expire, personal data will be deleted or anonymized in accordance with Peruvian personal data protection regulations.

6. Security Measures

The controller adopts reasonable technical, organizational, and legal measures proportional to the nature of the data being processed, with the objective of guaranteeing its confidentiality, integrity, and availability, as well as preventing:

• Unauthorized access.
• Accidental or unlawful loss.
• Unauthorized alteration or modification.
• Improper disclosure or transfer.
• Any other processing contrary to applicable legislation.

Notwithstanding the above, the User acknowledges that no information storage or transmission system through the Internet can guarantee absolute security. Therefore, the controller does not assume responsibility for incidents resulting from force majeure, act of God, or fraudulent or negligent conduct of third parties that violate implemented security measures, within the limits permitted by law.

7. Transfer of Personal Data

As a general rule, the User’s personal data will not be transferred, ceded, or communicated to third parties.

Exceptionally, data may be communicated when:

• It is necessary to comply with a legal obligation incumbent upon the controller.
• A competent administrative, judicial, tax, or regulatory authority requires it, through a properly founded mandate in accordance with applicable legislation.

In such cases, communication will be made respecting the principles and guarantees provided for in Law No. 29733 and its Regulations.

As of the effective date of this Policy, no international transfers of personal data are being made. Should international transfers become necessary in the future, the requirements provided by Peruvian regulations will be complied with, including, where appropriate, obtaining User consent and verifying adequate levels of protection in the destination country.

8. Personal Data of Third Parties Provided by the User

In cases where the User provides personal data referring to third parties (for example, partners, collaborators, end customers, or any other third party related to the project), it shall be understood that the User:

1. Declares having valid, sufficient, and current authorization from the data owner for its communication to the controller and for the purposes described in this Policy.
2. Commits to having previously informed such third parties about the processing that will be carried out on their personal data.
3. Assumes exclusive responsibility for the legitimacy, truthfulness, and lawful origin of the data provided.

The controller will not assume any responsibility for the unlawful origin, lack of consent, or any defect in obtaining third-party data delivered by the User, without prejudice to legal actions that may correspond against the User in case of damages or losses derived from such non-compliance.

9. Rights of the Personal Data Owner

In accordance with Law No. 29733 and its Regulations, the User, as the owner of personal data, has the right to exercise the following rights, commonly called ARCO rights:

Additionally, the User may exercise other rights recognized by Peruvian legislation on personal data protection, including the right to revocation of previously granted consent.

9.1. Procedure for Exercising Rights

The User may exercise their rights by submitting a request to the official email address indicated in section 10 of this Policy. The request must contain, at a minimum:

• Full name and surname of the applicant.
• Document proving their identity (or that of their authorized representative).
• Clear and precise indication of the right being exercised.
• Description of the request and, when applicable, the documents supporting it.
• Address or means to receive a response.

The controller will address the request within the periods provided by Law No. 29733 and its Regulations.

9.2. Complaint to the Competent Authority

If the User believes that their rights have not been adequately addressed, they may file a complaint with the Peruvian national competent authority on personal data protection, in accordance with the procedures established by such authority.

10. Contact

For any inquiries, requests, exercise of rights, or communications related to this Policy and the processing of personal data, the User may contact the following official channel:

• Official Email: [insert official contact email]
• Suggested Subject: “Personal Data Protection – [type of request]”

The controller will address communications received within reasonable periods and in accordance with applicable regulations.

11. Future Modifications

The controller reserves the right to modify, update, or supplement this Policy at any time, in order to adapt it to:

• Changes in norms or regulations.
• New processing purposes.
• Incorporation of new technologies or tools on the Website.
• Recommendations from the competent authority or applicable international standards.

11.1. Preventive Clause on Cookies, Analytics, and Digital Advertising

As of the effective date of this Policy, the Website does not use tracking cookies, web analytics tools, or digital advertising services. However, the controller warns that in the future it could incorporate such technologies, such as analytics tools, measurement cookies, or digital advertising services.

In such event, the controller will:

1. Update this Policy to reflect such additions.
2. Publish the updated version in a timely manner on the Website.
3. When applicable, request the User’s prior consent in accordance with applicable legislation.
4. Inform about the purposes, providers, and control mechanisms available to the User.

11.2. Effective Date of Modifications

Modifications will take effect from their publication on the Website. Users are advised to review this Policy periodically. Continuing to use the Website after the publication of changes will imply acceptance of the current version, without prejudice to the User’s rights regarding processing that requires specific consent.

Acceptance of the Policy

By completing and submitting any form available on the Website, the User declares having read, understood, and accepted the terms of this Privacy Policy, as well as the processing of their personal data in accordance with the purposes described here and the applicable Peruvian legal framework.

Document prepared in accordance with Law No. 29733 – Personal Data Protection Law, its Regulations, and complementary norms in force in the Republic of Peru.