Appendix IV: California Consumer Privacy Rights (CCPA)

This addendum details the privacy rights applicable to Users residing in the state of California (USA), in accordance with the California Consumer Privacy Act (CCPA) and, where applicable, the California Privacy Rights Act (CPRA). To the extent that DeepThink acts as a "business" under the CCPA with respect to the personal data of California consumers, it guarantees full compliance with the regulations, offering the guarantees and rights listed below:

1.Categories of personal information collected 1.1.DeepThink may collect the following categories of personal information from California consumers: 1.1.a.Identifiers (name, email address, postal address, phone number, account ID). 1.1.b.Commercial information (history of services purchased, payments, billing). 1.1.c.Information about activity on the Internet or other electronic networks (access logs, IP addresses, cookies, browser). 1.1.dProfessional or employment information (when the User registers on behalf of a company). 1.2.This information is obtained directly from the User (for example, when registering or using the service), as well as indirectly through automatic interaction with the SWPANEL platform.

2.Purpose of the use of personal information 2.1.The personal information collected is used to: 2.1.a.Provide and maintain the contracted services (account management, payment processing, support). 2.1.b.Personalize the User's experience and improve the functionality of the service. 2.1.c.Ensure the security and integrity of SWPANEL (incident detection, debugging, fraud prevention). 2.1.d.Comply with applicable legal or regulatory obligations. 2.1.e.Send service or marketing communications (with prior consent, when required). 2.2.DeepThink will not use personal information for purposes other than those described herein, except upon prior notification and obtaining consent, when legally required.

3.Disclosure of personal information to third parties 3.1.DeepThink may disclose personal information to third parties, exclusively in the following cases: 3.1.a.To service providers contracted for specific functions (hosting, payments, analytics, technical support), who are prohibited from using the data for purposes other than those agreed upon in the contract. 3.1.b.To public or regulatory authorities, when required by law or valid court order. 3.1.c.To other companies in the Prime Quad Partners SL business group (hereinafter, "Prime Partners"), of which DeepThink is a member, only in the following legitimate cases: 3.1.1.To improve the commercial relationship with the User and optimize communication and support channels. 3.1.2.To provide additional or specialized technical support related to the use of SWPANEL. 3.1.3.To offer complementary products or services that may be integrated or useful to the User, always within the framework of legitimate interest or applicable consent. 3.2.These group companies are contractually obliged to process personal data in accordance with applicable law and may not sell, reuse or process the data for purposes other than those permitted by this Annex.

4.No sale of personal information 4.1.DeepThink declares that it does not sell personal information of California consumers, as defined by "sale" in the CCPA, nor does it receive direct or indirect financial compensation for sharing it with non-provider third parties. 4.2.Personal information is also not shared with external third parties in terms that constitute a "sale" of data under California law. 4.3.In the event that this policy changes in the future, DeepThink will: 4.3.a.Notify the User expressly. 4.3.b.Enable an opt-out mechanism, including a visible link on the website ("Do not sell my personal information"). 4.3.c.Respect global preference signals (such as Global Privacy Control) if required by applicable law.

5.Consumer rights under the CCPA California consumers have the following rights: 5.1.Right to know (access): The User has the right to request what personal data DeepThink has collected about them in the last 12 months, including the categories, sources, uses, third parties with whom it is shared, and the specific data collected. 5.2.Right to deletion: The User may request the deletion of their personal data, unless there is a legal exception to retain it (such as to fulfill a contract, legal obligation, or legitimate security interest). 5.3.Right to opt out of data sales: Not currently applicable. It will apply if any "sale" of personal data occurs under the CCPA in the future. 5.4.Right to non-discrimination: DeepThink will not discriminate against or penalize the User for exercising their rights. There will be no changes in prices, quality of service, or conditions for exercising access, deletion, or opposition, unless expressly permitted by law.

6.Exercising rights 6.1.To exercise their rights under the CCPA, the User (or their authorized representative) may contact DeepThink: 6.1.a.By sending an email to: [email protected] 6.1.b.Indicating in the subject line: "CCPA Request" 6.1.c.Clearly describing the request (access, deletion, etc.) 6.2.DeepThink may require verification of the identity of the applicant before processing the request, by means of: 6.2.a.Confirmation of existing data in your account. 6.2.b.Documentary proof, in the case of authorized representatives. 6.3.The response time will be up to 45 days, extendable once for an additional 45 days upon notification to the User.

7.Additional rules 7.1.If the User benefits from additional state privacy laws, DeepThink undertakes to comply with them to the extent that they are applicable, without contravening current federal or state regulations. 7.2.DeepThink may update this Annex to adapt to future legal reforms in California, such as the evolution of the CCPA or the entry into force of new similar laws in other states (Colorado, Virginia, etc.).