Latin America Privacy Supplement

Last updated: July 9, 2026

This Latin America Privacy Supplement ("Supplement") provides additional information about how TerminalStreet LLC ("TerminalStreet," "we," "us," "our") processes personal data of individuals located in Latin American countries. This Supplement complements our general Privacy Policy and applies to our processing of personal data in accordance with the privacy laws of various Latin American jurisdictions.

1. Brazil - Lei Geral de Proteção de Dados (LGPD)

1.1 Data Controller (Controller) and Data Processor (Operator)

For the purposes of Brazil's Lei Geral de Proteção de Dados (LGPD), TerminalStreet may act as a "controller" (controlador) or an "operator" (operador) of personal data, depending on the circumstances of data processing.

1.2 Legal Bases for Processing

Under the LGPD, we process your personal data based on one or more of the following legal bases:

• Your consent
• Fulfillment of a legal or regulatory obligation
• Execution of a contract or preliminary procedures related to a contract to which you are a party
• Exercise of rights in legal, administrative, or arbitration procedures
• Protection of life or physical safety
• Protection of health, in procedures carried out by health professionals or health entities
• Legitimate interests of the controller or third parties
• Protection of credit
• Research, ensuring anonymization when possible

1.3 Processing of Sensitive Personal Data

The LGPD establishes special protections for sensitive personal data, which includes data about racial or ethnic origin, religious belief, political opinion, trade union or religious, philosophical or political organization membership, health or sex life, genetic or biometric data. We will only process sensitive personal data with your specific and highlighted consent or as otherwise permitted by the LGPD.

1.4 Your Rights Under LGPD

Under the LGPD, you have the right to:

• Confirmation of the existence of processing
• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data
• Portability of data to another service or product provider
• Deletion of personal data processed with your consent
• Information about public and private entities with which we have shared your data
• Information about the possibility of not providing consent and the consequences of denial
• Revocation of consent
• Review of decisions made solely based on automated processing of personal data

1.5 Data Protection Officer (Encarregado)

TerminalStreet LLC has not appointed a Data Protection Officer (Encarregado) under the LGPD and does not currently maintain a representative in Brazil. Questions relating to the LGPD may be directed to our privacy team at [email protected]. If and when TerminalStreet's processing requires the appointment of an Encarregado or a Brazilian representative, their name and contact details will be published here before that processing begins.

1.6 International Transfers

We may transfer your personal data to countries outside Brazil only when at least one of the following conditions is met:

• The country or international organization provides an adequate level of data protection
• We provide appropriate guarantees of data protection, such as specific contractual clauses or standard contractual clauses recognized by the Brazilian data protection authority (ANPD)
• The transfer is necessary for international legal cooperation
• The transfer is necessary to protect life or physical safety
• The Brazilian data protection authority (ANPD) authorizes the transfer
• You have provided specific and highlighted consent for the transfer
• The transfer is necessary for the execution of a contract or preliminary procedures related to a contract to which you are a party
• The transfer is necessary for the regular exercise of rights in judicial, administrative, or arbitration procedures

2. Argentina - Personal Data Protection Law No. 25,326

2.1 Data Controller (Responsible)

For the purposes of Argentina's Personal Data Protection Law No. 25,326, TerminalStreet is considered a "responsible party" (responsable) for the processing of personal data.

2.2 Consent Requirements

We process your personal data with your free, express, and informed consent, except in cases where consent is not required under Argentine law. Your consent can be revoked, but this will not have retroactive effects.

2.3 Your Rights Under Argentine Law

Under Argentine law, you have the right to:

• Access your personal data
• Request the correction, update, or suppression of your personal data
• Request that your personal data be treated confidentially
• Withdraw your consent for future processing

2.4 International Transfers

We may transfer your personal data to countries that do not provide adequate levels of protection only when:

• You have given your express consent
• The transfer is necessary for the execution of a contract to which you are a party
• Appropriate contractual safeguards are in place

3. Colombia - Law 1581 of 2012

3.1 Data Controller (Responsable) and Data Processor (Encargado)

For the purposes of Colombia's Law 1581 of 2012, TerminalStreet may act as a "data controller" (responsable) or a "data processor" (encargado) of personal data, depending on the circumstances of data processing.

3.2 Authorization Requirements

We process your personal data with your prior, express, and informed authorization (consent), except in cases where authorization is not required under Colombian law.

3.3 Your Rights Under Colombian Law

Under Colombian law, you have the right to:

• Know, update, and rectify your personal data
• Request proof of the authorization granted to us
• Be informed about how your personal data has been used
• Revoke your authorization and/or request the deletion of your data when the processing does not respect the principles, rights, and constitutional and legal guarantees
• Access your personal data free of charge
• Submit complaints to the Superintendence of Industry and Commerce for violations of data protection laws

3.4 Processing of Sensitive Data

We will not process sensitive data unless:

• You have given your explicit consent
• Processing is necessary to protect your vital interests and you are physically or legally incapable of giving consent
• Processing is carried out in the course of legitimate activities by a foundation, association, or any other non-profit body with a political, philosophical, religious, or trade union aim, and with appropriate safeguards
• Processing relates to data that you have manifestly made public
• Processing is necessary for the establishment, exercise, or defense of legal claims
• Processing is necessary for reasons of substantial public interest

4. Mexico - Federal Law on Protection of Personal Data Held by Private Parties

4.1 Data Controller (Responsable)

For the purposes of Mexico's Federal Law on Protection of Personal Data Held by Private Parties, TerminalStreet is considered a "responsible party" (responsable) for the processing of personal data.

4.2 Privacy Notice

In accordance with Mexican law, our Privacy Policy serves as a privacy notice (aviso de privacidad) informing you about the personal data we collect, the purposes of processing, and how you can exercise your rights.

4.3 Your ARCO Rights

Under Mexican law, you have the following ARCO rights:

• Access: Right to access your personal data
• Rectification: Right to rectify your personal data when it is inaccurate or incomplete
• Cancellation: Right to request the cancellation of your personal data
• Opposition: Right to oppose the processing of your personal data

4.4 Data Transfers

We may transfer your personal data to third parties without your consent only in the cases permitted by law, such as:

• When the transfer is provided for in a law or treaty to which Mexico is a party
• When the transfer is necessary for medical diagnosis or prevention, healthcare delivery, medical treatment, or health services management
• When the transfer is made to holding companies, subsidiaries, or affiliates under common control
• When the transfer is necessary by virtue of a contract executed or to be executed between you and us
• When the transfer is necessary or legally required to safeguard public interest or for the administration of justice
• When the transfer is necessary for the recognition, exercise, or defense of rights in a judicial process
• When the transfer is necessary to maintain or fulfill a legal relationship between you and us

5. Chile - Law No. 19,628 on the Protection of Private Life

5.1 Data Controller (Responsable)

For the purposes of Chile's Law No. 19,628 on the Protection of Private Life, TerminalStreet is considered a "person responsible for the data registry or database" (responsable del registro o banco de datos).

5.2 Consent Requirements

We process your personal data with your consent, which may be expressed or implied. Your consent is not required in cases established by law, such as when the personal data comes from sources accessible to the public.

5.3 Your Rights Under Chilean Law

Under Chilean law, you have the right to:

• Request information about your personal data that we hold
• Request the modification of your personal data when it is erroneous, inaccurate, misleading, or incomplete
• Request the deletion or cancellation of your personal data when it has expired, when its storage lacks legal foundation, or when it has been voluntarily provided or used for commercial communications
• Block the processing of your personal data when its accuracy cannot be established or its validity is questionable

6. Peru - Personal Data Protection Law No. 29733

6.1 Data Controller (Titular)

For the purposes of Peru's Personal Data Protection Law No. 29733, TerminalStreet is considered a "data controller" (titular del banco de datos personales).

6.2 Consent Requirements

We process your personal data with your prior, informed, express, and unequivocal consent, except in cases where consent is not required under Peruvian law.

6.3 Your Rights Under Peruvian Law (ARCO Rights)

Under Peruvian law, you have the following ARCO rights:

• Access: Right to obtain information about your personal data
• Rectification: Right to update, include, rectify, or suppress your personal data
• Cancellation: Right to request the deletion of your personal data
• Opposition: Right to oppose the processing of your personal data

7. How to Exercise Your Rights

If you wish to exercise any of your rights under applicable Latin American privacy laws, please contact us at [email protected].

When making a request, please provide us with sufficient information to identify you and describe your request in detail. We may require additional information to verify your identity before processing your request.

We will respond to your request within the timeframe required by applicable law. In some cases, we may deny your request as permitted by law, in which case we will explain the reasons for our denial.

8. Updates to this Supplement

We may update this Supplement from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes as required by applicable law. We encourage you to review this Supplement periodically.

9. Contact Information

If you have any questions about this Supplement or our privacy practices, please contact us at:

[email protected]