DATA PROTECTION POLICY

I hereby authorize GALINDO, ARIAS Y LÓPEZ, the Data Controller, for the processing of my personal data, in compliance with Law No. 81 of March 26, 2019 “On Personal Data Protection” and other regulations in force, to collect and treat my personal data to comply with the regulations related to the prevention of (1) money-laundering, (2) financing of terrorism and (3) financing of the proliferation of weapons of mass destruction.

I also understand that the personal data collected may be transferred to competent authorities (upon formal request), partners, lawyers, and employees of GALINDO, ARIAS & LÓPEZ for the provision of the contracted services and the purposes mentioned above. GALINDO, ARIAS Y LÓPEZ may share or transfer this data with its subsidiaries for the purposes indicated in the previous paragraph.

GALINDO, ARIAS Y LÓPEZ undertakes that (1) my personal data will be treated in a secure and confidential manner and (2) I have the rights of access, rectification, cancellation, opposition, and portability; in accordance with personal data protection regulations and the policy adopted by it. Likewise, I understand that my personal data will be retained for up to five (5) years after the end of the professional or contractual relationship with the entity, according to the provisions of Law 23 of 2015 and Law 52 of 2016.

Inquiries or complaints about the treatment of my personal data, and to access, rectify or modify it, may be made through the following email address: tratamientodedatos@gala.com.pa, or through a petition which should be delivered to its offices located at PH Scotia Plaza, 11th Floor, Ave. Federico Boyd & 51st Street, Panama City, Republic of Panama. You may revoke your consent for the processing of your personal data at any time, as long as it is not prevented by a legal or contractual provision or if there is no obligation arising from the contractual or legal relationship with GALINDO, ARIAS & LÓPEZ.

Based on the foregoing, I give my consent for the treatment of my personal data in the terms described above.