Personal data processing policy.

We receive only the data that you provide to us and the data that regulations require us to collect. We do not buy databases or build profiles with third-party information.

• Contact data. Name, email, telephone, company and position, when you write to us, subscribe or request a prequalification.
• Identification and transaction data. When a transaction moves forward, the information required by due diligence: identity, corporate documentation, source of funds and structure of the counterparty.
• Browsing data. The data described in our cookie policy.

We process your data in accordance with the principles of Article 5 of the law. We do not request sensitive data in order to provide our services. If the nature of a transaction makes it necessary to process such data, you will be informed and asked for your express consent before we do so.

• To respond to your inquiry and maintain the professional relationship.
• To assess the viability of a transaction and provide the contracted structuring services.
• To comply with the legal obligations that apply to us as an obligated entity, in particular those on anti-money laundering and counter-terrorist financing, and those arising from our status as a supervised entity.
• To send you communications about the firm when you have requested them. You may unsubscribe at any time.

We do not use your data for automated decisions that produce legal effects on you. The prequalification of a transaction uses analysis tools, but the decision is always made by a person.

We keep each piece of data for the time necessary for the purpose that justifies it and, from then on, for the period that the law requires us to keep it.

• Due diligence files. Five years from the end of the relationship, in accordance with the legal retention period.
• Commercial contact data. For as long as there is a relationship or interest, and until you request its erasure.
• Accounting and tax records. The periods set by the applicable Salvadoran legislation.

Once the period has elapsed, the data is erased or irreversibly anonymized.

We do not sell personal data. We share it only in these cases:

• Providers that work on our behalf. Technology infrastructure, email, analytics and professional advisors, subject to contract and bound by the same confidentiality.
• Counterparties to a transaction. When you authorize it and to the extent that the transaction requires it: structurers, legal advisors, auditors and distributors.
• Competent authorities. When there is a legal requirement, in particular from the National Commission of Digital Assets and from the anti-money laundering authorities.
• Embedded third-party content. Team profiles show videos hosted on YouTube. When the player loads, Google receives your IP address and technical data from your browser and processes them on its own account. Details are in our cookie policy.

Part of our infrastructure is hosted outside El Salvador. When an international transfer of your data is necessary, you will be informed and your prior consent will be obtained, unless the law itself permits the transfer without it.

As the data subject, you may exercise, at any time and at no cost, the rights that Articles 6 to 14 of the Personal Data Protection Law of El Salvador (Ley de Protección de Datos Personales) recognize:

• Access. To know which of your data we process and for what purpose.
• Rectification. To correct data that is inaccurate or incomplete.
• Erasure. To request that data be deleted when it is no longer necessary or when you withdraw your consent, unless we must keep it by legal mandate.
• Objection. To object to a specific processing activity on grounds relating to your situation.
• Restriction. To request that processing be restricted while a request of yours is being resolved.
• Portability. To receive your data in a commonly used format.

The request is sent to privacy@satscapital.io. Pursuant to Article 20 of the law, we respond within twenty business days. That period may be extended by a further twenty business days when the request justifies it, and we will inform you of the extension before the first period expires.

If you consider that we did not honor your right, you may turn to the competent authority for personal data protection in El Salvador.

We apply technical and organizational measures proportionate to the risk: encryption in transit and at rest, role-based access control, two-factor authentication, access logging and periodic backup of information.

Our infrastructure relies on cloud providers that maintain their own international security certifications. Those certifications belong to the providers, not to SATS Capital, and operate under a shared responsibility model.

If a security breach affecting your personal data occurs, we will notify the competent authority and, where applicable, you, within seventy-two hours of becoming aware of it.

We may update this policy when the applicable regulations or the way we provide our services change. The date of the last update appears at the top. If the change substantially affects the processing of your data, we will communicate it to you through the contact details we have on record.