Privacy Policy and Personal Data Protection

1. Responsibility for the information provided

TWS2 adopts the technical, organisational and legal security measures needed to protect people's information and to prevent loss, alteration, unauthorised processing and/or access, taking into account the nature of the information and the risks it is exposed to. To protect Personal Data we strictly comply with the Organic Law on Personal Data Protection (LOPDP) and its General Regulations in the Republic of Ecuador. The data subject is responsible for the truthfulness, accuracy and currency of their information, as well as for any effects arising from the processing of their data in that capacity. TWS2 will take whatever measures are necessary to update the information when the data subject requests it.

2. Legal framework and definition of personal data

In accordance with Ecuador's LOPDP, Personal Data is defined as any data that identifies or makes a natural person identifiable, directly or indirectly. This includes, but is not limited to: numeric, alphabetic, graphic, photographic and acoustic information, location data, online identifiers, personal habits, and sensitive data, which is subject to special protection under Ecuadorian law.

3. Appointment of the Data Protection Officer

General Management has appointed a Personal Data Protection Officer (DPO), in accordance with the guidelines of the LOPDP; the formalisation of this appointment is in the process of being completed. The DPO has, as a minimum, the following duties:

• To inform and advise employees involved in the processing of personal data about the obligations incumbent on them under the LOPDP, its Regulations and other data protection provisions.
• To verify and report on compliance with the legislation and with this policy.
• To cooperate with and act as the point of contact for Ecuador's Superintendency of Personal Data Protection on matters relating to processing, including handling prior consultations.

The DPO carries out these duties paying due attention to the risks associated with processing operations, taking into account the nature, scope, context and purposes of that processing. You can contact our DPO at info@tws2.io.

4. Purposes for collecting data

We collect personal data strictly for the following specific purposes:

• Informational purpose: personal data recorded in order to obtain information that the user has voluntarily supplied on our website or through TWS2's other service channels.
• Contractual purpose: to start, maintain and continue contractual relationships; provide software development services, licensing of technology solutions, cloud platform provisioning (SaaS), deployment of artificial intelligence models, technical support, maintenance and handling of customer requests; as well as to meet legal obligations and detect any malicious or fraudulent activity or information security vulnerabilities.
• Mandatory purpose: personal data whose provision is required by law is processed here; refusing to provide it would make it impossible for TWS2 to deliver the software solutions, enable access to production/development environments or provide the technical support requested.
• Advertising purpose: to keep the data subject informed about benefits, products, new software modules or services that may be of interest, and to offer commercial advertising by e-mail, WhatsApp or other means, provided the data subject's prior, explicit and informed authorisation has been obtained.

5. Processing of personal data in software and artificial intelligence development

As a developer and provider of technology solutions with Artificial Intelligence (AI) components, TWS2 processes data under strict security and confidentiality criteria. When TWS2 acts as "Data Processor" (processing data on behalf of its corporate clients), it undertakes to use the information exclusively for the operation, technical support and execution of the functionality of the contracted software, refraining from using that information for its own purposes outside the contract. In research, technical testing, optimisation and training of Artificial Intelligence or Machine Learning models, TWS2 strictly adopts the principle of privacy by design and by default, giving priority to anonymised, pseudonymised or synthetic data and to data masking techniques, so that the identity of natural persons cannot be reversed or identified by the algorithms.

6. Consent

The processing of personal data at TWS2 will be lawful only where the data subject's free, specific, informed and unambiguous consent has been obtained, or where the processing is necessary to perform a contractual obligation (such as the provision of software services), to comply with a legal obligation, or by order of a competent authority in Ecuador. Clients and suppliers will have specific data protection clauses, service levels (SLA) and data processing agreements (DPA) built into their commercial contracts or digital forms, strictly aligned with the LOPDP.

7. Disclosure of the information received

Clients, suppliers, workers, applicants and others undertake not to disclose or share the personal data within their reach without the appropriate consent having been given, with the exception of the following cases required by law:

• Requests for information from Ecuadorian public authorities acting within their functions and remit.
• Requests for information under court orders issued by competent judges of the Republic of Ecuador.
• Requests for information under express legal provisions.

8. Storage, security and transfer of data

Personal data will be stored in our systems, databases or cloud infrastructure only for as long as is strictly necessary to fulfil the authorised purposes or the retention periods required by law or by contract. TWS2 guarantees that its databases are aligned with regulatory requirements and, where Ecuador's Superintendency of Personal Data Protection so determines, the corresponding notifications and registrations of processing activities will be carried out. The processing of your personal data will be carried out directly by TWS2 and by third-party processors (such as cloud infrastructure or hosting providers). In the event of international data transfers, TWS2 will ensure that they are carried out under secure standards (encryption in transit and at rest) and through contracts that guarantee the same level of protection required by the LOPDP.

9. Rights of data subjects

Under Ecuador's legal framework, TWS2 guarantees and facilitates the exercise of data subjects' extended rights over their personal data:

• Right of access: to obtain confirmation from the controller as to whether or not their personal data is being processed, and access to all detailed information about that processing.
• Right to rectification and updating: to obtain the rectification of inaccurate or incomplete personal data.
• Right to erasure: to have their personal data deleted when it is no longer necessary for the purposes for which it was collected, if consent is withdrawn, or if the processing is not appropriate.
• Right to object: to object to the processing of their personal data on grounds relating to their particular situation or for direct marketing purposes.
• Right to portability: to receive their personal data in a compatible, structured and machine-readable format in order to transfer it to another controller, without hindrance.
• Right to suspension of processing: to request the temporary cessation of the processing of their data under specific legal conditions (for example, while its accuracy or the lawfulness of the processing is being verified).
• Right not to be subject to a decision based solely or partly on automated assessments: the data subject has the right not to be subject to decisions taken by TWS2's Artificial Intelligence components or software that produce legal effects or significantly affect them adversely, unless the processing is based on their explicit consent or is necessary for the performance of a contract. In such cases, TWS2 guarantees the right to obtain human intervention, to express their point of view and to contest the algorithm's decision.

10. Procedure and response times

• Standing: the data subject (proving their identity with a copy of their national identity card or equivalent document) or their legal representative duly accredited by formal power of attorney have standing to exercise these rights.
• Requirements of the request: the data subject's name, a concrete and clear request, a physical or electronic address for notifications, the date, a signature and the relevant supporting documents, sent to info@tws2.io.
• Remedy: if the request is incomplete or requires clarification, the applicant will be given five (5) working days to remedy the requirements.
• Single response period: any legitimate request for access, rectification, updating, erasure, objection, portability or suspension will be handled and notified by the Data Protection Officer (DPO) within a maximum of fifteen (15) working days counted from the day after the request is received (or duly remedied).
• Form of response: the response must be reasoned, clear, legible and written in comprehensible language. In the event of a total or partial refusal to exercise the right, the DPO must technically substantiate the legal exceptions applied under the LOPDP. If the data subject considers that they were not attended to, they may lodge a complaint with Ecuador's Superintendency of Personal Data Protection.

11. Continuous improvement

This Policy will be reviewed for improvements, updated and communicated as appropriate.