Privacy Policy and Personal Data Processing

GLOBAL CAR RENTAL

1. Identification of the Data Controller

This Privacy Policy and Personal Data Processing Policy governs the collection, storage, use, circulation, transmission, transfer, and deletion of personal data processed by GLOBAL CAR RENTAL, identified with NIT 1193201949-9, commercially operating under the brand Global Car Rental. Main domicile: Medellín, Antioquia, Colombia. Address: Calle 10 No. 43E-36, El Poblado, Medellín. Phone: (+57) 310 400 2360 / (604) 448 8082. Data protection email: admon@globalcarental.com Habeas data channel: admon@globalcarental.com

2. Purpose

This policy aims to inform personal data holders about how Global Car Rental collects, stores, uses, transmits, transfers, updates, rectifies, preserves, and deletes their personal data, as well as the rights they have and the procedures to exercise them.

3. Scope

This policy applies to personal data collected through: • The website globalcarental.com. • Quote, reservation, contact, and comment forms. • Customer service channels by phone, WhatsApp, email, and social media. • Pre-contractual, contractual, and post-contractual processes related to vehicle rental. • Commercial, advertising, administrative, accounting, customer service, and regulatory compliance activities.

4. Definitions

• Personal data: any information linked or associable to a specific or identifiable natural person. • Sensitive data: data affecting the holder's privacy or whose misuse may lead to discrimination, such as health or biometric data. • Holder: the natural person whose personal data is subject to processing. • Processing: any operation on personal data, such as collection, storage, use, circulation, or deletion. • Data controller: the natural or legal person who decides on the database and/or processing. • Data processor: the party that processes data on behalf of the controller. • Transmission: communication of data to a processor to handle information on behalf of the controller. • Transfer: sending data to another controller, within or outside the country.

5. Applicable Processing Principles

Global Car Rental will apply the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security, confidentiality, and demonstrated accountability, in accordance with current Colombian regulations.

6. Personal Data We May Collect

a. Identification and contact data • Full name. • Type and number of identity document. • City of residence. • Address. • Landline and/or mobile phone. • Email. b. Data associated with the request or reservation • Pickup and delivery city and date. • Type of vehicle requested. • Additional information provided by the client. • History of quotes, reservations, and services taken. c. Data required to formalize the service • Copy of ID card or passport. • Driver's license. • Information necessary for requirement validation. • Personal, family, or commercial references when applicable. • Data associated with deposits, guarantees, payments, billing, damage claims, fines, or contractual breaches. d. Legal entity data • Information of legal representatives. • Certificates of existence and representation. • Corporate or financial documentation required for service provision. e. Browsing data • IP address. • Technical cookies. • Session and browsing data. • Information derived from website use, as permitted by law and according to the portal's technical configuration.

7. Processing Purposes

Personal data may be processed for the following purposes: • Responding to information requests, quotes, reservations, and requirements from the holder. • Contacting the holder by phone, WhatsApp, email, or any other authorized channel to confirm, manage, or modify reservations. • Verifying requirements for vehicle rental and validating the applicant's identity. • Preparing, executing, and controlling vehicle rental contracts and complementary services. • Managing deliveries, returns, rental assistance, support, claims, updates, and after-sales service. • Managing collections, billing, portfolio, guarantees, deposits, claims, traffic tickets, damages, incidents, and contractual obligations. • Complying with legal, regulatory, accounting, commercial, tax, and administrative obligations. • Preventing fraud, identity theft, unauthorized vehicle use, money laundering, terrorism financing, and other illicit activities, as legally applicable. • Sharing information with insurers, payment gateways or providers, technology operators, hosting providers, messaging tools, workshops, competent authorities, and allies strictly necessary for service provision. • Sending commercial information, promotions, campaigns, news, and benefits from Global Car Rental, provided prior authorization exists when required. • Improving browsing experience, usability, security, and website operation. • Responding to inquiries, petitions, complaints, claims, and requests for updates, rectification, deletion, or revocation.

8. Sensitive Data Processing

Global Car Rental will not request sensitive data unless strictly necessary and legally permissible. If required, express authorization will be requested and the holder will be informed of the voluntary nature of its provision.

9. Data of Children and Adolescents

Global Car Rental does not direct its services to minors. In the event of processing data of children and adolescents, respect for the best interest of the minor and their fundamental rights will be guaranteed, in accordance with the law.

10. Holder Authorization

When required by law, Global Car Rental will request prior, express, and informed authorization from the holder for the processing of their personal data. Said authorization may be obtained by physical, electronic, digital, recorded verbal means, or through unequivocal conduct that allows its preservation and subsequent consultation. The holder declares that the information provided is truthful, complete, accurate, up-to-date, and verifiable.

11. Holder Rights

The personal data holder has the right to: • Know, update, and rectify their personal data. • Request proof of the authorization granted, when applicable. • Be informed about the use given to their personal data. • File complaints with the Superintendence of Industry and Commerce, once the corresponding internal process has been exhausted. • Revoke authorization and/or request data deletion when applicable. • Access their personal data subject to processing free of charge.

12. Procedure for Inquiries and Claims

Inquiries, requests, or claims related to personal data should be sent to: Email: admon@globalcarental.com Suggested subject: "Personal data protection" Physical address: Calle 10 No. 43E-36, El Poblado, Medellín. The request must contain, at minimum: • Full name of the holder. • Type and number of document. • Clear description of the inquiry or claim. • Contact information for response. • Supporting documents, when applicable. Inquiries: will be answered within ten (10) business days of receipt. If not possible within that period, the cause of delay and new date will be communicated, not exceeding five (5) additional business days. Claims: will be addressed within fifteen (15) business days of receipt. If not possible within that period, the reasons for delay and response date will be communicated, not exceeding eight (8) additional business days.

13. Data Transmission and Transfer

Global Car Rental may transmit or transfer personal data to third parties located in Colombia or abroad when: • Necessary for proper service provision. • There is a contractual relationship with data processors. • Necessary to operate technological tools, storage, messaging, hosting, analytics, payments, or support. • Required by a competent authority. • The holder has authorized it or the law permits it. In all cases, Global Car Rental will ensure that third-party recipients adopt adequate security, confidentiality, and regulatory compliance measures.

14. Information Security

Global Car Rental will adopt reasonable technical, human, administrative, and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, disclosure, or destruction. However, the holder acknowledges that no internet transmission or storage system is completely infallible.

15. Cookies and Similar Technologies

The website may use cookies and similar technologies for technical, functional, statistical, security, and experience improvement purposes. If non-essential cookies are used, users will be informed through visible mechanisms on the site and preference management will be allowed when applicable.

16. Information Retention and Preservation

Personal data will be retained for the time necessary to fulfill the purposes described herein, for the execution of the contractual relationship, to meet legal or regulatory obligations, and for the time required for judicial or administrative defense of Global Car Rental's interests. Once the purpose has been fulfilled and provided there is no legal or contractual duty of retention, data will be deleted or anonymized, as appropriate.

17. Policy Modifications

Global Car Rental may modify this policy at any time. Any substantial change will be communicated through the website or available contact channels, before its implementation when applicable.

18. Effective Date

This Privacy Policy and Personal Data Processing Policy is effective as of March 26, 2026.

Authorization for Commercial, Advertising, and Promotional Purposes

Global Car Rental may process the holder's personal data to send commercial information, promotions, discounts, news, advertising campaigns, benefits, reservation reminders, loyalty programs, and offers related to its products and services, only when it has the prior, express, and informed authorization of the holder, or when another applicable legal basis exists. The holder may authorize the sending of such communications by physical or electronic means, including email, calls, SMS, WhatsApp, or other digital channels. Authorization for promotional purposes is optional and does not constitute a requirement to request information, obtain quotes, or contract vehicle rental services, except to the extent strictly necessary for the execution of the commercial or contractual relationship. The holder may revoke this authorization at any time or request the deletion of their data for such purposes, through the service channels provided by Global Car Rental. Revocation will not affect processing that must be maintained due to legal or contractual obligations.