Terms and conditions of service

Contents

• 1 Clauses to 13: Recruitment, Responsibilities, Payments and Departure of Service.

• 14 clauses to 18: SLA and credits.

• 19 clauses to 23: responsibility, confidentiality, evidence and applicable law.

• 24 Clause: Unique acceptance. References: normative, technical and corporate sources.

1 Identification and scope of application

1.1. ENGITECH SOLUCIONES INFORMATICAS S A S, NIT 900.611.904-1, henceforth ENGITECH, is a company domiciled in Bogotá D. C., with commercial registration 02315759. Its legal representative, according to the certificate of existence and legal representation issued by the 17 of September of 2026, is IVÁN CAMILO TORRES LEÓN. Commercial and judicial notifications: Carrera 96G Bis # 22-19, Bogotá D. C., Colombia. Phone: +57 601 432 2144. Judicial notifications mail: ivan.torres@engitech.com.co. Commercial and service contact: info@engitech.com.co. Website: https://engitech.com.co. eCloud, Engitech Cloud, TrustNet Security and IT Solutions are designations of their service lines, not different legal entities.

1.2. These conditions regulate access to the website and, when incorporated by verifiable acceptance, contracting infrastructure, collaboration, communications, information protection, cybersecurity, IT administration, software, equipment and projects. The visit to the site is not tantamount to contracting payment services or accepting economic obligations.

1.3. Only the benefits described in the commercial offer, electronic order or contract accepted are included. Optional functions, licenses, migrations, integrations and services of third parties require express inclusion. The catalogue does not mean that every customer acquires all the services.

1.4. The rules apply to business customers and, where appropriate, to consumers. The consumer status is determined according to the law and the actual purpose of the acquisition, not only because it is a natural or legal person. The imperative rights of consumers, data holders and other third parties prevail over any incompatible stipulation.

2 Contract and Acceptance Documents

2.1. The contract is integrated by the commercial offer identified with number or consecutive, or by the electronic order that individualizes the service; by this agreement and its version; and by the expressly incorporated annexes. The confidentiality agreement of the 20 clause is accepted with the same contracting act, without an independent signature. The Comprehensive Policy on the Treatment and Protection of Personal Data remains separate and is reported before contracting. The particular stipulations identified and accepted prevail only in respect of the matter that changes and within the law.

2.2. Before accepting, the customer must be able to consult, download and retain the documents, know the full price, applicable taxes, the resources included, the minimum time and the relevant limitations. Third-party conditions will only be incorporated if your provider, product and version or date is identified, and your consultation is facilitated before you hire. Binding advertising and legal reporting obligations are not known by the documentary hierarchy.

2.3. In electronic contracting, the client will voluntarily mark an unmarked box and execute the action to hire or accept, after having access to this agreement, its version, the independent policy and the summary of the service. Acceptance will be linked to your identity, account and order and will be recorded in the recruitment database with the evidence of the 21 clause. In physical procurement, the signature of the numbered offer or the contract that incorporates it will credit acceptance of this agreement when it identifies it by name and version and has been delivered or made available previously. It is not required to sign all technical fields or an additional tab.

2.4. The client shall designate authorized contacts and their powers: recruitment, technical changes, incidents, billing and processing of data. Deletion instructions, overwriting restoration, data delivery, administrator change or contractual modification require enhanced verification. An authorized technician to open tickets is therefore not entitled to acquire unlimited economic obligations.

3 Operating Definitions

Managed service: the one in which ENGITECH executes the technical tasks listed in the offer or order. Self-administered service: the one in which the client manages the operating system, applications and configuration within the supplied resources. The technical administration does not transfer to ENGITECH the management of the business or the determination of the purposes of the data.

Customer data: information that this or its users load, generate or transmit in the service. The expression does not alter the rights of its owners or attributes absolute ownership of personal data. Operating data: technical, security, support and billing records necessary to provide and credit the service.

SLA: Measurable service level commitment. First attention: initial human intervention that confirms scope, priority and next performance; an automatic acuse does not satisfy it. Restoration: Recovery of the affected function, including through a valid temporary solution. Final solution: correction of the case, where technically possible.

RPO: maximum admissible antiquity of the recovery point against the incident, when contracted. RTO: time committed to recover the defined scope, originating from computing and express dependencies. A backup frequency does not automatically credit a RPO, nor does the availability of a repository credit a RTO.

Service unit: instance, tenant, mailbox, component or identifiable resource to which a charge is assigned and a SLA. Demarcation point: interface where the provision of ENGITECH is verified and separated from the networks or systems of the client and third parties other than the contracted scope.

4 Activation and Scope of Administration

4.1. The proposal shall establish the requirements and date or time of activation. ENGITECH will notify the delivery with resource identification, secure access, scope and tests performed. The recurring position begins with the provision in accordance with scope, except for a different date expressly agreed upon. The implementation advances are governed by the agreed milestones.

4.2. In self-administered infrastructure, ENGITECH operates the physical, virtualization and network elements included; the client installs and maintains its systems, applications, databases, users, licenses and backups. In managed services, ENGITECH responds for the tasks actually undertaken. An explicitly sold task cannot be excluded invoking the generic nature of the cloud.

4.3. Changes of capacity, version, architecture or scope require change order with impact on price, continuity, dependencies and tests. Expansions are not presumed for demand growth. At immediate risk, the measures provided in the 8 clause may be applied and then documented.

4.4. Migrations require inventory, cutting, validation and return procedure. The client checks the functional integrity of the migrated information; ENGITECH verifies contracted technical operations. The approval of a delivery does not release from hidden defects or legal guarantees. Comments, corrections and acceptance shall be recorded.

5 Data Management and Responsibility

5.1. THE ADMINISTRATIVE CLIENT YOUR DATA AND ITS OPERATION. It is up to the customer to determine which information it stores, who can access, for what it is used, how long it should be preserved and what validations it requires. You must verify accuracy, legality, authorizations, rights of third parties and consistency of your records. ENGITECH does not assume functions of accountant, content auditor, legal archivist, regulatory custodian or administrator of the customer's processes by the only information accommodation.

5.2. The client manages high and low users, permissions, shared links and information classification, except for technical tasks delegated in writing. You must withdraw access at the end of work or business relationships, protect devices and notify compromised credentials. If ENGITECH executes an authorized change, it retains responsibility for its proper execution; the client retains responsibility for the business decision and the authorization given.

5.3. The client defines its continuity strategy and communicates the special conservation, audit, residence and recovery requirements before contracting. You must keep the independent copies that your risk analysis requires. Your absence does not exonerate ENGITECH from failing a contracted backup or proof alone that all damage is attributable to the customer.

5.4. Accommodation, storage, synchronization, snapshots, RAID and high availability do not amount to an independent backup on their own. A deletion, malicious encryption or modification can be propagated to synchronized replicas and devices. Trash and versions are subject to capacity and retention; they are not permanent archive.

5.5. The technical access of ENGITECH will be limited to the necessary to provide the service, to carry out verified instructions, to protect the infrastructure or to meet a legal obligation. It does not authorize the sale of data, its commercial exploitation or its use to train IA models. Any additional purpose requires a specific legal basis and authorization where appropriate.

5.6. ENGITECH does not guarantee access to information already deleted in accordance with the accepted or inaccessible policy for loss of keys exclusively guarded by the customer. It will inform the consequences before carrying out destructive instructions and keep record of the authorization.

6 Independent personal data policy

The processing of personal data is regulated in the Comprehensive Policy on the Treatment and Protection of Personal Data ENG DAT 01, an independent and common document for all services and third parties. The aims, rights, channels, responsible and responsible functions and rules for the circulation of information are developed. This agreement retains only the operational responsibilities for information, security and confidentiality required to provide the service. The policy is reported before contracting; its knowledge does not amount to indiscriminate authorization for any treatment.

7 Backup and Recovery

7.1. Each backup service will identify sources, accounts included, frequency, windows, retention, exclusions, repository, encryption, key custodian, checks, restorations included and responsible. The immutability, isolation, second location and disaster recovery are only considered to be included if they are expressly described and tested.

7.2. The customer will provide agents, permits and connectivity when they are under your control, inform new sources and validate the usefulness of the restorations. ENGITECH, when you manage the backup, will configure the contracted policy, review executions in the agreed coverage, investigate bugs and notify the absence of valid points. The lack of customer information excludes only the causal impact attributable to that omission.

7.3. A successful copy state credits the reported technical execution, but does not replace a restorative test or check all the rules of an application. Open databases and files require compatible consistency methods. The offer or order will establish recovery tests, including at least an initial validation before declaring the contracted protection operative.

7.4. Restoration requires authorisation of enabled contact, selection of point and destination, evaluation of overwriting and subsequent verification. When ransomware exists, the clean point and the isolated environment will be evaluated. Without a contracted and technically validated RPO or RTO will not promise recovery without loss or a maximum recovery time; the diligence and execution obligations of the acquired backup tasks remain.

7.5. Retention is counted by defined points and periods, not as perpetual conservation. Once a copy expires, it can be automatically deleted. In case of insufficient capacity, ENGITECH will notify and propose measures; it will not silently alter the sold retention. Mail and public cloud backup services only cover users, loads and objects that are expressly supported inventoried.

8 Security and acceptable use

8.1. It is prohibited to use services for fraud, unauthorized access, distribution of malware, sexual exploitation of minors, violation of rights, spam or attacks on third parties. Security tests require written authorization from the owner of the assets and rules of enforcement. Resale, intensive loads, mining and mass traffic require compatibility with the plan and authorization when they affect shared resources.

8.2. The customer will protect credentials, enable multi-factor authentication when available, apply updates to the components in his/her position and respect the quotas. ENGITECH will apply proportional controls to the risks in its scope. No promise of invulnerability, detection of any threat or undocumented encryption or certification. DDoS mitigation is limited to the contracted capacity and modality.

8.3. In the face of a substantiated threat, competent order or unlawful use, ENGITECH may block the strictly necessary resource or traffic, preserve evidence and request corrections. It will inform reasons, scope and conditions of reactivation, previously where feasible and in a timely manner, in urgent cases, except for legal prohibition. It will avoid affecting resources other than the incident and will review the measure when the cause ceases.

8.4. ENGITECH will notify the security contact, without unreasonable delay and up to twenty-four hours after confirming an incident that commits customer data under your treatment. The initial notice may be partial and include available information, measures and coordination channel, with subsequent updates. This contractual obligation does not replace or extend the appropriate legal terms to report to authorities or holders.

8.5. Technical records and antimalware or anti-spam analysis may involve limited treatment of metadata and content where necessary and within the service. It will not be declared that no technician can access data if the architecture allows that access. Privileged access must be authorized, restricted and traced.

9 Intellectual Property and Use of the Website

9.1. The contents, signs, designs and components of ENGITECH or its licensors retain their rights. Access does not transfer your property. Authorized uses and legal exceptions are permitted; the reproduction or presentation of the site or its marks is prohibited so that it leads to confusion about its ownership or endorsement.

9.2. The data and materials provided by the client retain the rights of their respective owners. The client grants only the necessary powers to accommodate, transmit, support or process these materials according to the service. Third-party licenses follow your regime; a hosting or RDP service does not automatically include all Windows, Office, SQL, Odoo Enterprise or other products.

9.3. Custom-developed components, open source, new deliverables and exploitation rights will be identified separately. The assignment or license, access to repositories and conditions of delivery of the code must be in writing and respect the applicable legal regime. The absence of a particular clause does not constitute a universal cession or permits the disregard of rights resulting from the law.

9.4. External links do not imply general editorial control over your destination. ENGITECH will provide reasonable notices of illicit content or links and act in accordance with the law. This rule does not exclude liability for its own content, decisions or actions.

10 Price billing and validity

10.1. The order will indicate currency, value, taxes, periodicity, expiration date, consumption and additional charges. Unless otherwise agreed, recurring services are paid in advance. Excesses are only charged according to previously informed units and fees; if they are not agreed, they require acceptance before widening the scope.

10.2. Recurring business services will have an initial period of twelve months only when reported and accepted in order. If the deadline is omitted, the recruitment will be monthly. Automatic renewal only operates when expressly agreed upon; it is not presumed. Non-renewal may be requested on a monthly basis prior to the next period. In annual deadlines, a thirty-day notice is set, without restricting legal termination rights.

10.3. Prices are maintained during the committed period, with the exception of expressly agreed objective adjustments or legal changes in taxes. The rates for a renewal will be communicated at least thirty calendar days before and will allow to decide the continuity. Conditions or prices are not retroactively modified by a web publication.

10.4. Interests in respect of the legally agreed rate or the supplementary trade regime shall apply to expired dinerary obligations without exceeding the legal maximum applicable to the period and modality. ENGITECH will discriminate capital, period and liquidation. A permanent fee is not set here and undetermined collections are not permitted.

10.5. An objection to invoice shall be submitted with sustenance and shall be resolved through the contractual channels. The customer will pay the undiscussed amounts required. SLA claim periods do not extinguish legal actions or alter the requirements applicable to invoices.

11 Mora Suspension and Revitalization

11.1. The payment expires on the date indicated in the invoice or offer. ENGITECH will send default notice upon completion of ten calendar days of arrears counted from the expiration, identifying obligation, balance, way of correcting and scheduled date of suspension. If there is no payment or written agreement in force, the service will be suspended upon the end of thirty calendar days of arrears. You can send previous reminders; these do not advance the court by default. Evidence of the notice will be preserved and the alternate channel will be managed when the message is returned. A notification failure attributable to ENGITECH must be corrected with a real opportunity to regularize before the court.

11.2. The suspension of the day thirty does not constitute definitive cancellation or authorize the immediate deletion. ENGITECH will report what resources are reserved and what charges are still being held as accepted. The subsequent termination requires cause and communication under the 12 clause; from its effective date the withdrawal window begins twenty-four hours. These delays are not a liability limit: economic limits continue to be regulated in the 19 clause. The payment or agreement that subsane the cause will result in reactivation within a working day from its verification, except for informed technical impediment. There will be no new revival charges without previously accepted rate.

11.3. A failure of the charging system or an improper suspension attributable to ENGITECH will not be treated as a breach of the client. Urgent security embargoes are governed by the 8 clause, without the need to wait for the delay.

12 Self-retirement Termination and Removal

12.1. The contract ends without renewal, mutual agreement, valid exercise of a right of termination or non-compliance material not corrected within ten working days from a reasoned requirement. It may be terminated immediately when the offence is unreasonable, there is a legal prohibition or it is necessary to prevent serious harm, with documented justification. The effects of insolvency processes are subject to special regulations.

12.2. The advance termination due to the convenience of a fixed-term business client only generates exit charges that are defined and accepted in the order. The entire future balance is not budgeted as a penalty. Services already provided, unrecovered investments expressly agreed upon and cancelable resources are distinguished. The imperative rights of consumers prevail.

12.3. When the termination is due to material non-compliance of ENGITECH not corrected, there will be no penalty for future periods and the advances for unpaid services will be returned, without prejudice to the other applicable rights. ENGITECH will be able to withdraw a service line with a minimum of sixty calendar days, offering transition and proportional return of unexecuted advances; fixed-term obligations must be resolved through agreement or legal cause.

12.4. From the effective date and time of service termination, the customer has TWENTY-FOUR (24) CONTINUOUS HOURS to retrieve, on their own, any information they wish to retain, using the functions and access available on their platform. This includes nights, weekends and public holidays. A request to cancel on a future date does not start this period early: it begins on the effective date specified and communicated. The cancellation notice or confirmation will state the date, time and time zone of termination and the retrieval deadline, and will warn of subsequent deletion. The customer should plan and make their backups preferably before cancelling, particularly when the volume of data or connection requires more than twenty-four hours.

12.5. During that window, only the functional access required for the self-retirement of existing data, with security controls, will be retained without free continuity of the ordinary operation. ENGITECH will not carry out or hand over exports, conversions, migrations, information packages, system images or copies in external media. The customer manages their information and systems and must execute and validate their extraction. The assistance of ENGITECH, performance in third-party services, temporary storage, additional transfer and migration will cost when requested and quoted; they require acceptance of the scope and price. A request for assistance does not extend the deadline, except for written agreement prior to its expiry.

12.6. Over twenty-four hours, withdrawal access will be revoked and the logical deletion of the data and resources of the completed service will be executed. The customer will not have a contractual right to recovery or additional maintenance from that time. The support of the cancelled service will be incorporated into the deletion procedure; it does not constitute an extension of the withdrawal. Physical sanitation of media and disposal of residual fragments in shared supports or third-party systems will be executed according to their previously informed technical mechanisms, without regular use or restoration for production. ENGITECH will not present as instant physical destruction of all supports what is technically logical elimination. A different retention will require legal basis or competent order, or prior and specific written agreement.

12.7. ENGITECH is not required by the single contract or termination to deliver own or third-party software, licenses, source code, installers, images, virtual machines or operating tools. The client ' s rights and expressly contracted deliveries, applicable licenses and non-derogable legal obligations shall be respected. The withdrawal of data through the available functions does not imply the transfer of software. The lack of payment does not authorize the appropriation of data or prevents the legal rights of its holders. If an imputable failure to ENGITECH materially prevents withdrawal during the window, it must enable an equivalent functional environment or replenish the time actually lost before the deletion, at no cost to correct its non-compliance. No information subject to legal preservation or compulsory evidentiary preservation shall be deleted.

13 Consumer Rights and Claims Care

13.1. Where there is a relation of consumption, guarantees, information, favourable interpretation, protection against abusive clauses and claim mechanisms of the 1480 Law of 2011 and its amendments, including the 2439 Law of 2024. Incompetent business restrictions do not apply to such cases.

13.2. Retracting and reversing payments will proceed in the assumptions, terms and legal conditions. There is no general waiver. The application or consent required by law will be obtained in order to initiate the benefit during a retracting period; the exception of services initiated with a consumer agreement will be evaluated in the specific case. Legally enforceable returns will not be replaced by service credits.

13.3. The PQR can be presented in info@engitech.com.co and in the electronic channel enabled for recruitment. ENGITECH will issue based, date and time, allow follow-up and respond within the applicable legal term; direct consumer claims will be dealt with within fifteen working days. It is not a requirement to exhaust private arbitration to apply to the competent authority.

14 General Rules of the SLA

14.1. The availability commitment is uniform: 99,7 % per month per unit of operating production service paid and activated under this version, at the demarcation point defined in the 17 clause and the offer or order. It also applies to third-party operating components that ENGITECH has included as an integral benefit. The technical and physical conditions are valued by the verifiable exclusions of the 15 clause and do not reduce the percentage alone. A different level will only be applicable if it is specifically identified and accepted as a particular exception. Free riders don't generate credit except pact. Audits, consultancy, construction works and development are measured by care and deliverables, not by a percentage of non-existent uptime. The backup execution rate is a different indicator of availability.

14.2. Availability is calculated per calendar month, time of Colombia. M is the minutes when the unit was hired and activated during the month; E are the minutes excluded, identified and justified; T is M minus E; U are the minutes of computable unavailability within T. Monthly availability is 100 × (T − U) ÷ T. If T is zero, it is reported “not applicable”, never 100 %. It is not rounded up to avoid non-compliance.

14.3. One minute is indisposable when the essential operation defined for the service fails for an attributable cause within the scope of ENGITECH. Regular verification is performed with synthetic tests every sixty seconds. Two consecutive bugs confirm the event, counted from the first; recovery requires two satisfactory results and counts to the first one. Reliable records of shorter incidents are also recorded. Monitors and records will be contrasted; the failure of a single probe does not automatically credit a fall.

14.4. Monitors should check the defined function, not only ping or opening of the initial page. When a probe cannot verify the service, the state will be “unchecked.” This status does not prove availability or indisposability and will be resolved with additional evidence. The UPTIME page is informative: it does not replace customer measurement, does not limit the test and does not make available a service without valid monitoring.

14.5. The measurement begins in the operational delivery and ends in the effective termination. Events that cross the month are divided; the simultaneous ones on the same unit are not duplicated. A partial affectation is assigned to the units or components affected according to their position, without automatically converting the entire contract into indisposable.

14.6. In a month of thirty days without exclusions, the 99,7 % is equivalent to 129,6 minutes of unavailability, i.e. two hours, nine minutes and thirty-six seconds. The calculation is adapted to the actual minutes of each month according to 14.2. The threshold does not permit deliberate interruptions or eliminate other contractual breaches.

15 Verifiable maintenance and exclusions

15.1. An excluding maintenance window is set up for up to four hours per unit, informed at least seventy-two hours in advance, indicating date, scope and impact. Only the actual interruption within that window and the limit is excluded; the excess counts as unavailability. An impact-free maintenance does not consume excluded time. The actual capacity and schedule will be specified in the offer or order.

15.2. Urgent security changes will be reported as soon as practicable. They are not automatically excluded by urgent calls: ENGITECH must demonstrate a specific case. The failures of its regular maintenance and of the components that it assumed are accounted for.

15.3. It excludes only the period and scope causally linked to: actions or configurations of the client outside of the control assumed by ENGITECH; connectivity, energy or client equipment; suspension or properly applied termination; expressly requested intervention by the client and with accepted impact; or force majeure or legally accreditable fortuitous case. The lack of contracted capacity excludes only the effect of the excess shown, not an independent fault of the supplier.

15.4. Attacks, cuts of an operator, failures of a manufacturer or breaches of a subcontractor are neither force nor exclusions by its sole denomination. If ENGITECH sold the full benefit, it cannot be excluded entirely because it has been subcontracted. The third-party component contracted directly by the client and the clearly identified resale of the service administered integrally by ENGITECH will be distinguished.

15.5. ENGITECH will document all exclusion with beginning, end, causal, scope and evidence. No periods are excluded due to lack of logs that ENGITECH should retain or condition the computation of an already demonstrated fall to the client's opening ticket. The customer will cooperate in the diagnosis without taking the test of inaccessible facts under exclusive control of ENGITECH.

16 Incidents and Scaling

16.1. Base coverage: Monday to Friday, from 8:00 a. m. to 5:00 p. m., Colombia time, excluding national holidays. The availability of a platform is measured permanently; this does not mean 24/7 human support. The automatic receipt of out-of-hour tickets also does not amount to continuous attention. The 24/7 support requires confirmed recruitment and capacity.

16.2. Critical P1: total interruption of an essential function without alternative or active incident compromising data. First base care within two hours of coverage. High P2: serious degradation or affectation of several users with limited alternative; first attention within four hours of coverage. Normal P3: Fixed failure without general interruption; first attention within eight hours of coverage. P4 request: consultation, change or improvement; first attention within sixteen hours of coverage.

16.3. For an explicitly contracted 24/7 plan, P1 is established in a continuous hour and P2 in two continuous hours; P3 and P4 retain the base schedule except for expansion. The reception through the agreed channel starts the computation, although the final classification is then adjusted with justification. An incomplete request will receive first attention within the time frame; this commitment is not postponed until the client completes the diagnosis.

16.4. The previous times are of first attention, not of solution. ENGITECH will report preliminary diagnosis, actions, dependencies and re-establishment estimation when you have elements. Update P1 every two hours of coverage and P2 every four, or as agreed; P3 and P4 in the hits reported. The expectation of an indispensable performance of the client can suspend a resolution task, laying on record, but does not erase the time of imputable unavailability to ENGITECH.

16.5. Scaling: service table, technical and management officer or security officer, according to the incident. It will be notified internally before a foreseeable commitment is breached. For a P1 attributable to ENGITECH, a case report and actions will be issued within five working days from the re-establishment; if the investigation requires more time, a preliminary report and a new motivated date will be issued.

16.6. The primary and alternate channels will be included in the offer or order and will have to allow residency when the portal fails. A personal WhatsApp or informal conversation does not replace the agreed channel, but ENGITECH will not be aware of an effective notification received by an enabled contact. The legal PQR maintain their own channels.

17 Conditions and SLA by Service

17 1 AppCloud VPS Linux VPS Windows and dedicated servers

Commitment: 99,7 % monthly per instance or individual server. The covered function is to have computing and storage assigned and connectivity in the virtual or physical interface delivered. The resource is verified from the ENGITECH infrastructure and network; ping is not enough to a system that the client can block. A breakdown of hardware, hypervisor or storage by ENGITECH that prevents the use of the computer resource as a fall.

The client manages operating system, applications, bases and accesses in self-administered plans. The accommodation of an IA application or project does not guarantee results of the model, GPU capacity or availability of external APIs. A managed AppCloud service must add to the offer or order the functional operation covered and the tasks assumed. A high-availability modality requires architecture, switching tests and specific SLA; it is not deducted from the word cloud.

For VPS Windows, remote desktops and RDS will specify licenses and number of competing users. The client responds by its processes and data, while ENGITECH responds by the environment it manages. An application hanging within a self-administered MV is not itself infrastructure indisposability.

17 2 Site Hosting and Panels Commitment: 99,7 % monthly for the managed hosting platform, including an agreed test or functional route application. A web server failure, runtime, managed database or storage included that prevents the essential computer operation. Hosting with cPanel or other panels retains this regime; a management panel failure will be measured separately if it does not affect the application.

The content, code, plugins and customer queries remain under your administration except for express engagement. The contributions of CPU, RAM, disc, processes, mail and transfer will be objective; “reasonable use” does not authorize arbitrary restrictions. The client maintains dominion and DNS if he does not delegate them. If ENGITECH manages them and their mistake causes the fall, that effect is computable.

17 3 Professional Mail and Business Mail Commitment: 99,7 % per month per tenant or set of mailboxes identified. Authentication and access to the mailbox is covered through the protocols included, as well as internal acceptance and delivery of messages by the managed platform. Synthetic access transactions will be used and sent to a test mailbox. The webmail will be identified as a component when your charge and coverage can be separated.

Delivery in the inbox of external recipients, their anti-spam policies, sender limits and domain reputation are not a guarantee of result. ENGITECH retains its obligations on the reputation and configuration of infrastructure that it manages. The client manages high, low, content, authorized lists, devices and message conservation. The backup, legal file, retention of retired mailboxes and granular recovery must be contracted with express parameters.

17 4 Nextcloud Workspace Files Talk and Office Online Nextcloud Files or Drive managed: 99,7 commitment % monthly, verified by authentication and reading and writing of a test file within the quota. The client manages users, permissions and content; ENGITECH operates the platform and updates included. Local synchronization and the status of client devices are distinguished from central service.

Talk and Office Online: commitment of 99,7 % per month per contracted plugin. For Talk you check signaling and setting a test session; for Office, opening, editing and saving a compatible document. Audiovisual quality also depends on connectivity, devices and concurrence. Macros, complex formats and integrations are previously validated; no total equivalence is promised with Microsoft 365.

The light or shared modality will have declared capacity; no unlimited concurrence is presumed. AD/LDAP/SSO integrations, IA attendees and mail are included only according to plan. The failure of a plugin does not convert Files alone into indisposable. The offer or order will separate your charges to apply credits without duplicity.

17 5 Virtual Machine Safety Copies

Access to platform and repository: 99,7 % monthly, checked with authenticated catalog operation and reading a test object. This SLA does not measure recovery on its own. For execution it is stated that at least 98 % of the scheduled eligible works are completed correctly within your agreed window; the restatements within it count as a single execution.

Eligible work is programmed with agreed scope and window. It can only be excluded due to a demonstrated lack of a pre-requisite by the client or by another reason of the 15 clause; no errors of the repository, ENGITECH saturation or errors of its configuration are excluded. The rate is successful eligible jobs divided by programmed eligible jobs, multiplied by one hundred. If there are no eligible jobs it is reported “non-applicable” and its motive.

The compatibility of hypervisor, application consistency, excluded disks, encryption, secondary destination and restorative tests will be included in the offer or order. Disaster recovery, cloud startup and contingency capacity require separate recruitment. RPO and RTO will be specific by load.

17 6 Computer Copies Mail and Public Cloud Servers

The same 99,7 % access commitments and eligible execution 98 % described in 17.5 applied to the contracted unit are applied. For computers and servers, the scope of files and folders does not include full image, system status or open base consistency if not agreed. For Microsoft 365, Google Workspace and other clouds will invent compatible mailboxes, files, sites and objects; new users are not automatically protected unless their dynamic inclusion has been contracted.

The customer retains permissions and licenses of origin. The limits or changes of external APIs will be documented with their real effect; ENGITECH will adjust the components under your administration and warn of unprotected loads. The “Backups Mail” or “Backups Nube Pública” panel shows access to a platform, does not prove that all copies of each customer have been successful. The restoration retains the conditions of the 7 clause.

17 7 Cloud IP telephony

Commitment: 99,7 % monthly for registration of extensions and establishment of internal calls in the managed central, measured with a SIP transaction or test equivalent. Extensions, concurrence, recordings and retention will be defined. The logs and calls to public networks will be identified as separate components with your provider and responsibilities.

The client protects credentials and terminals, authorizes destinations and defines consumption limits. ENGITECH applies the contracted antifraud controls. All fraudulent calls are not presumed to be the responsibility of the client if there is a non-compliance attributable to ENGITECH. Audio quality and end-to-end continuity require agreed network conditions. Emergency calls, numbering and telecommunications obligations will be verified according to the modality; no replacement of an emergency line without accredited capacity and compliance will be offered.

17 8 Odoo ERP SaaS and business applications

Commitment: 99,7 % monthly on access and an agreed essential transaction of the managed production application. It also applies to business applications or SAP hosted when they are part of the order; it does not grant licenses on its own. The offer or order identifies modules, version, base, integrations and environments included. Implementation, functional support and development have separate scopes.

The customer responds by teachers, inventory, prices, taxes, licensed business parameterizations and document validation. ENGITECH responds by its contracted configuration and code. The accommodation or installation of a module does not guarantee tax compliance or automatic acceptance of each document by the DIAN. Policy and third-party changes will be evaluated within the agreed maintenance or by additional order.

A failure of an out-of-range module does not amount to total downfall. If a modification made by ENGITECH prevents the essential operation compromised, it counts in the SLA. Functional errors are classified according to the 16 clause; final correction depends on the scope and is not confused with the first attention.

17 9 VPN firewall WAF and remote access

Commitment: 99,7 % monthly for gateway or managed platform. The establishment of a tunnel or permitted transaction of evidence between agreed points is measured. End-to-end access also depends on customer links, energy and equipment. If both ends or links are fully contracted with ENGITECH, the offer or order may not generically exclude them as aliens.

Firewall, WAF and remote access administered include only defined policies, assets, agents and changes. A legitimate blockade policy is not a fall, but an erroneous configuration attributable to ENGITECH can be. Rules, approvals, expiration of licenses and privileged accesses will be recorded. No blockade of any threat or absolute anonymity is guaranteed; continuity does not amount to the absence of intrusions.

17 10 NOC SOC and infrastructure management

The contracted monitoring platform will have availability of 99,7 % monthly, measure with reception and consultation of a test event. Human supervision is provided in the expressly contracted coverage. The SLA monitored infrastructure does not arise from the single monitoring contract, especially when it belongs to the customer or to another provider.

For actionable alerts within the inventory and agreed rules, the P1 to P4 times of the 16 clause are applied, counted from the reception of the event by the ENGITECH platform or from the valid notice, what happens first. The SOC will analyze and scale the events included; active containment requires pre-authorised powers. The NOC will execute the contracted operating changes. It is not promised to detect any attack, monitor disconnected sources or remediate equipment out of reach.

The offer or order identifies assets, sources of logs, volume, retention, rules, coverage, permitted actions and exclusions. In infrastructure management, remote or presenceal maintenance, milestones, visits and displacement times are agreed upon; they do not automatically become a guarantee of repair of any component.

17 11 Audits Pentest Awareness & SGSI

Audits, vulnerability analysis and pentest are governed by scope, methodology, dates and reports, not by a percentage of uptime. They require written authorization of assets, timetables, test intensity and emergency contact. ENGITECH will verify that authorization and execute the tests with diligence. A confirmed critical finding will be reported within a working day; an active risk of compromise will follow the urgent mechanism of the 8 clause.

Sensitization and phishing simulations require population, content and treatment of authorized results. Reports and sessions will be delivered according to schedule, protecting employee data. In SGSI, ISO 27001 and consultancy are bookable, revisions and customer obligations. ENGITECH is not by this contract a certification body nor does it guarantee the certification, absence of sanctions or thorough identification of vulnerabilities.

Delays will be analysed for their cause and the timetable will be adjusted documented when they depend on customer information. Defects of deliverables will be corrected within the agreed time frame according to their scope. The first attention follows the contracted coverage and non-compliance remedies are those of the bill and the law, without automatically transferring the availability credits.

17 12 Response to incidents of forensic analysis and consultancy

Planning, simulations and response preparation are governed by project milestones. The operational response to incidents requires a team availability and activation agreement; in a contracted 24/7 retention, first P1 attention is set in a continuous time. Without such retention, an urgent request requires express confirmation of availability and scope; no permanent guard is presumed for having acquired a consultancy.

Forensic analysis will document authorization, origin, integrity, copies, custodians and deliveries of evidence under ENGITECH control. It is not guaranteed to recover non-existent information, attribute authorship or obtain a judicial result. Proceedings on third-party systems require authorization or legal basis. Reports will express method, findings, limitations and technical conclusion. The decision to denounce or communicate to third parties corresponds to the client, except for the legal duty of ENGITECH.

17 13 Software Development API Automation and Artificial Intelligence

Development, modernization and integration are governed by requirements, acceptance criteria, milestones, evidence and change control. They do not have SLA availability during construction; when the product enters production and ENGITECH contracts its operation, 17.2 or 17.8 is applied according to supply or order. The period of correction, maintenance and supported versions shall be expressly defined; legal guarantees remain.

The APIs of accounting, logistics, suppliers, GPS or other systems are custom integrations when quoted. The client provides rights, documentation, credentials and authorized environments. Changes in APIs or third-party rates do not automatically expand the contracted development. Adjustments will be budgeted without excluding correction of defects from the originally delivered work.

IA functions require supplier or model, data destination, limits, human supervision and documented authorizations. Your answers may be wrong; the customer validates business decisions. ENGITECH responds for the contracted implementation and will not use customer information for different training or purposes without corresponding instruction and legal basis. Universal accuracy, savings or economic performance are not guaranteed.

17 14 Renting for maintenance and IT projects

The rental of servers, networks and other equipment is defined by inventory, serials, delivery status, authorized site, maintenance, insurance if agreed and returned. The property retains the holder indicated in the contract; the periodic payment does not generate purchase or automatic transfer. A purchase option requires particular price and acceptance. Ordinary wear is distinguished from damage attributable to the customer.

First care of P1 failures is set in two hours of base coverage; diagnosis, visitation and replacement depend on location, parts and expressly agreed replacement plan. If the rented equipment is part of a hosted infrastructure sold as a service, your availability SLA is also applied without duplicating credits. Legal guarantee and maintenance diligence are not conditioned on a general exemption.

The sale of equipment, installation of networks, wiring, CCTV, access control, energy, UPS and other technical projects that ENGITECH hires are governed by design, timetable, records, tests, intervention security and applicable guarantees. Licences, permits, works of third parties and subsequent maintenance are defined. There is no promise of continuous availability of a work delivered without a contracted operation service.

17 15 Colocation energy connectivity and remote hands

Base Commitment: 99,7 % per month for electrical supply at the delivery point to the equipment. If two independent power feeds are contracted, the unavailability is determined by the simultaneous loss of both, provided that the accepted equipment and architecture admits that redundancy. A higher level requires specific headquarters and design confirmation; it is not presumed by commercial references to data centers.

The connectivity contracted with ENGITECH has a commitment of 99,7 % monthly at its delivery point, with agreed proof towards independent destinations. The network port of 1 Gbps does not mean Internet included or guaranteed bandwidth of that value. The offer or order indicates channel, operators, flow, direction and switching. Energy, connectivity and accommodation will have identifiable economic basis for credits; simultaneous events on the same charge are not added.

Offer or order will establish verifiable power limits and environmental conditions; deviations will be recorded and corrected even if they do not cause a computable fall. ENGITECH responds by the contracted environment and its custody proceedings. The client manages its equipment, systems and data, except express delegation. Remote hand interventions require instruction, identification of equipment and evidence of execution.

There is no free physical access to the data centre or the right to photograph infrastructure of others. Visits, delivery, withdrawal and audits are coordinated in accordance with the headquarters security regime, with accompanying or alternative evidence. This restriction does not preclude the requirement of contractual information, the return of client equipment or the enforcement of an order of authority.

18 Non-Compliance and Procedure Credits

18.1. If the monthly D availability is lower than the S target of the service, but equal to or greater than 99,0 %, the credit will be 10 % of the eligible monthly fee. If D is less than 99,0 % and equal to or greater than 95,0 %, it will be 30 %. If D is less than 95,0 %, it will be 100 %. If D reaches S, there is no availability credit. The intervals are exclusive and one applies only per unit and month.

18.2. For backup managed with the implementation commitment 17.5 or 17.6if the eligible rate is lower than 98 % and equal or higher than 95 %, credit will be 10 %; if it is less than 95 % and equal or higher than 90 %, 20 %; if it is less than 90 %, 30 % of the affected backup charge. Where the provision of availability and execution is made on the same charge, the largest is applied, without adding them. This does not replace the data loss liability analysis.

18.3. For non-compliance with the first care of P1 or P2 in a separate support plan, a credit of 5 % of that monthly charge is set for different incident, with maximum monthly 20 %. Fragmentation of tickets does not create new incidents. In support included without separate charge, ENGITECH will present explanation and corrective plan, without specific attention credit; availability credit remains applicable. Projects are governed by their particular remedies.

18.4. The eligible base is the net recurring charge of the resource affected by the month, after discounts and without single charges, non-consumption or separate third-party licenses. An annual prepaid is distributed between the covered months. If there is no prior breakdown of a package and the affected component cannot be individualized, the affected package charge will be used, without setting retroactive distribution percentages. Fiscal adjustments will be documented as appropriate.

18.5. The customer will request the credit within thirty calendar days after the end of the month, indicating service, intervals, impact and reasonably available evidence. You must not deliver secrets or records from other users. ENGITECH will incorporate your own records and will not refuse a proven fall just because you lack the customer access to them. This period regulates the commercial benefit of SLA, not the prescription or legal rights.

18.6. ENGITECH will respond reasonably within fifteen working days and will apply the approved credit to the next invoice. If future invoices no longer exist, you will liquidate the balance in favour by refoulement, legal compensation or agreement. Credits are not transferred to other customers. The maximum aggregate per unit and month is 100 % of your eligible charge, without double recovery for the same concept.

18.7. In business relations in which it is valid to agree, credit is the conventional economic remedy for the mere deviation of the SLA, without further proven damage. It does not limit legal guarantees, restitution of unexecuted advances, consumer rights or claims for dolo, grave guilt, breach of confidentiality, loss of data or non-compliance with legal data protection obligations. These events are analyzed in accordance with the 19 clause.

18.8. If the service fails to meet the availability of three consecutive months or four months within six, the client may terminate the affected component without penalty for future periods, by notice within thirty calendar days from the last report, with proportional return of unused advances and application of the data output.

19 Risk responsibility and distribution

19.1. Each party responds for non-compliance that is legally attributable to it, with damage assessment, causality, mitigation measures and contribution of each intervening party. Customer data management does not eliminate ENGITECH's responsibility for an improperly executed instruction, a contracted backup failure or a breach attributable to non-compliance with its duties.

19.2. For business contracts in which it is legally admissible, it is agreed to limit the accumulated contractual liability of ENGITECH by ordinary fault to the value of the charges paid or demanded by the service directly affected during the twelve months prior to the fact; if the contract is less old, the charges caused since its inception are taken. In single payment projects, the limit will be the price of the affected project. The limit shall not be multiplied by number of claimants derived from the same client or by fractionation of the incident.

19.3. In the same area of business and within the legally permitted, indirect losses, business opportunities and loss of profits are excluded. The classification depends on the actual nature of the damage, not its label. The reasonable costs of restoring information are not automatically converted into indirect damage. The obligation to pay services effectively provided and returns of unused advances are liquidated separately.

19.4. The above limits and exclusions do not apply to dolo, grave guilt, death or personal injury, breach of confidentiality, breach of legal data protection obligations, irrenunciable rights of consumers or responsibilities that the law prohibits limiting. There is no early cancellation of the dolo or general exoneration in front of authorities or headlines. The validity of the limit should be revised for the specific type of contract.

19.5. The customer will respond to claims from third parties arising from illicit content, lack of licenses or illegal instructions that are attributable to him, for damages and reasonable costs credited. ENGITECH will notify, allow for participation in the defense and will not hold agreements that impose obligations on the client without their consent. The obligation does not cover the ratio caused by ENGITECH nor prevents discussion of responsibility.

19.6. No party guarantees economic results, absolute absence of incidents or suitability for unreported and accepted critical use. Services for processes that may affect life, health or safety require specific evaluation and design. The obligations expressly assumed and the legal guarantees remain in force.

20 Bilateral Confidentiality Agreement

20 1 Parties and purposes

ENGITECH and the customer are mutually obligated as a divulner or receiver, depending on the case. The reserve includes information known during the evaluation, recruitment, delivery and termination of the service identified in the offer or order. Its exclusive purpose is to evaluate or execute that relationship, provide support, verify obligations and carry out an authorized transition. It does not impose exclusivity or obligation to make a different purchase, investment or business.

20 2 Protected Information

It protects all non-public information whose reserved character is identified or reasonably recognizable: files, databases, credentials, keys, configurations, architecture, vulnerabilities, code, methodologies, proposals, non-public prices and financial or strategic data, including copies and analysis that reveal their content. Each file is not required to be marked. The oral reservation information may not be confirmed in writing within ten working days; this formality does not condition the protection of secrets or recognizable credentials.

20 3 Receiver Duties

The receiver shall limit the use to the authorized purpose and apply reasonable care, access controls, safe channels and custody proportionate to sensitivity. It will only give access to employees, advisers, contractors and suppliers who need to know the information and are subject to sufficient reserve; it will verify the revocation of accesses when the need ceases. You will not use it to appropriate secrets, benefit foreign businesses or disclose it without foundation.

20 4 Credentials code and artificial intelligence

Access for other purposes will not be reused, nor will secrets be charged in public repositories or AI platforms that use them for their own purposes, without specific authorization and applicable basis. Temporary credentials must be revoked or broken. Reverse engineering and reproduction for unauthorized purposes are prohibited without restricting legal exceptions or expressly contracted activities.

20 5 Ownership

The divulner and the legitimized third parties retain their rights. The communication does not grant cession or general license of software, brands or bases. The customer retains the functional management of their information and business; ENGITECH retains responsibility for the technical and security operations assumed. Support access does not transfer the direction of the customer processes.

20 6 Exceptions

The receiver may certify that he already knew the unreserved information, which was made public without non-compliance, that he received it from an authorized third party or that he developed it independently. The advertising of isolated elements does not make public its combination. These exceptions do not remove legal reservations.

20 7 Authorities

Mandatory disclosure shall be limited to what is required by competent authority or legal duty, verifying scope and channel and keeping record. The divulner will be notified when legally permitted. A valid order is not required to disobey and unnecessary additional information is not allowed.

20 8 Incidents

The receiver will notify without unreasonable delay and, at most, within twenty-four hours of confirming unauthorized loss, access or disclosure. The notice may be preliminary and will indicate known facts, affected information, measures and contact. Containment, revocation, preservation of evidence and updates will be coordinated. Special duties on personal data are developed in independent policy. Cooperation is not an admission of guilt.

20 9 Termination and Deletion

When the purpose ceases, the receiver will stop the use. The client's hosted data and resources follow only the twenty-four-hour withdrawal window and the deletion of the 12 clause, without creating an obligation for the export or delivery of software by this agreement. For reserved negotiation documentation that is not hosted content, it will be returned or deleted according to lawful instruction within thirty calendar days of the application. Only what is required by law or necessary and justified for a dispute, with restricted access, shall be retained. Deletion without the physical presence of the client may be credited to shared facilities.

20 10 Duration

The contractual reservation is maintained during the relationship and for five years since its termination or the latest disclosure, which happens later. Business secrets and information subject to legal reservation are protected during the relevant period by law. Over the course of five years, it does not authorize the disclosure of active credentials or information that is still legally protected.

20 11 Non-compliance

The non-compliant party responds to legally attributable and accredited damages. The affected person may apply for a cessation and judicial or administrative measures. No amount is presumed or an undetermined penalty is established. The availability credits do not replace this regime and the exceptions of the 19 clause on confidentiality, dolo, serious fault and inderogable responsibilities are respected.

20 12 Advertising and verification

Logos, commercial references or cases of identifiable success shall not be used without written authorization, except legal duty. Verifications will be carried out with relevant evidence and agreed scope, protecting third-party systems and secrets. Unrestricted access to facilities, topologies or credentials is not granted.

20 13 Acceptance and coordination

This clause is fully accepted with the same click or signature that incorporates the general agreement; it does not require a second document or form. Its adoption as a replacement of a prior agreement must be identified and does not extinguish claims already caused or legal reservations. Information and purpose are individualized by supply or order; treatment functions are regulated in independent policy. Modifications and disputes are subject to 22 and 23 clauses.

21 Registrations acceptance and electronic evidence

21.1. The electronic contracting shall keep on database an acceptance record associated with the client's and the acceptant's identifier, authenticated account or mechanism used, order or transaction, service and plan, consecutive supply when available, exact version of this agreement and the informed policy, affirmative action executed and date and time with area. A full copy of accepted documents and business summary will be retained, either directly or through a stable reference to a protected file against changes. The IP address and technical session data will be able to complement the evidence in a proportionate manner; they do not prove on their own identity or representation. The customer will receive confirmation and persistent copy or link to the accepted content.

21.2. Tickets, original mails, records, logs and change records may provide evidence; no incontrovertible value is attributed to single-party systems. Each party may dispute them and provide other elements. Impressions or captures complement, but do not necessarily replace the original electronic file and its metadata.

21.3. Acceptance records should be protected with access control, backup, traceability of changes and a verifiable mechanism of integrity. They will be conserved in a consultative manner during applicable legal periods and as long as necessary to establish the relationship or deal with a dispute, in accordance with independent policy. SLA technical metrics will be retained for 12 months, expanding the preservation of evidence linked to a dispute when necessary and lawful. In physical contracts will be archived numbered offer, version of the agreement delivered, signed document, identity and faculty of the signer and evidence of delivery.

21.4. The customer will receive a copy of the accepted documents and will be able to request their historical version. A hash of integrity complements traceability, but does not demonstrate by itself who accepted or substitutes a reliable identification mechanism. This contract does not automatically become an executive title: any collection must comply with the legal requirements of clear, express and enforceable obligation and the other applicable.

22 Modifications communications and assignments

22.1. Substantial modifications shall be communicated at least thirty calendar days before and shall be applied in accordance with valid acceptance, renewal or previously agreed mechanism which is legally admissible. No benefits already paid will be unilaterally reduced or SLA retroactively changed or limits for an incident. The adjustments imposed by law will be applied in the required scope and opportunity, with customer information.

22.2. Contractual communications will be sent to registered contacts and evidence of delivery or availability will be retained. Each party will keep your data up-to-date; returned messages will require managing the available alternate channel. Judicial notifications are subject to their own rules.

22.3. Subcontracting does not amount to integral assignment or eliminates ENGITECH obligations. An assignment shall be subject to the contract and the law and shall not reduce guarantees or unduly alter the processing of data. The nullity or ineffectiveness of a clause does not preclude the application of others that may subsist lawfully.

23 Applicable Law and Dispute Settlement

23.1. The contract is governed by Colombian law, without prejudice to mandatory rules that are applicable by the operation and location of data. The parties shall seek a direct solution and may seek conciliation. Such management does not preclude urgent action or the timely exercise of action.

23.2. Disputes shall be submitted to the competent judges or authorities in accordance with the legal rules, preserving the competences of the Superintendency of Industry and Commerce as appropriate. There is no general waiver of legal jurisdiction or binding arbitration under these conditions.

24 Single Acceptance and Support of Contracted Service

24 1 Electronic recruitment

The contracting screen will display the service or plan, its features, price, taxes, periodicity and deadline, along with links accessible to this agreement and to the independent policy. Acceptance text: “I declare that I have the power to hire. I have read and accept the General Agreement on Services and Confidentiality of ENGITECH, version 2.0, applicable to the order identified in this contract, including the SLA, the conditions of payment and the autonomous withdrawal of information within the 24 continuous hours following the effective termination. I have been informed of the Comprehensive Policy on the Treatment and Protection of Personal Data.”

The box will be voluntary and will not be pre-marked. The evidence provided in the 21 clause will be stored in the recruitment database. A single acceptance covers the services of order and confidentiality. Data authorizations that legally require particular demonstration will be collected in accordance with the policy, without turning them into multiple contractual chips or confusing them with acceptance of terms.

24 2 Numbered offer and physical contract

The offer or contract will contain a brief reference: “The service is contracted according to the commercial offer number [consequential], dated [date], which defines its scope and particular conditions. The General Agreement on Services and Confidentiality of ENGITECH, version 2.0, delivered or made available prior to signature, and the specific conditions expressly incorporated, are part of the contract. The signatory declares to know the independent data processing policy.” The data in square brackets are completed in the offer or contract itself; they are not an additional tab of this agreement.

24 3 Technical scope documented without repeated signatures

ENGITECH will document in the offer, the summary of the order and the activation logs resources, managed functions, licenses, quotas, location, dependencies, support coverage and backup policy when you apply. The client should not sign a form for each field. Essential economic or technical elements and relevant limitations must be made available before accepting; subsequent internal records cannot impose new burdens or reduce the contract. Changes of scope or price require verifiable acceptance of the modification.

Technical and corporate policy references

Consultation and update: 19 of September of 2026. The references base drafting criteria and do not incorporate other contracts into the block. The AWS SLA are methodological references; ENGITECH's own commitment in this version is 99,7 %. The above documents retain their scope until a validly accepted replacement or modification.

Corporate identification: Certificate of Existence and Legal Representation of the Bogotá Chamber of Commerce, issued 17 September 2026 to the 11:08:25, plate 02315759, verification code B26632832DEB78, SB file26632832DEB78.pdf provided by ENGITECH. Address and mail are transcribed from the certificate; the phone was informed directly by the management. The reading of the file does not imply independent validation of its authenticity in the portal of the Chamber.

Law 527 of 1999, articles 6 and 8 to 13. Accessibility, integrity, conservation and valuation of data messages. Consult source

1581 Law of 2012, 4, 8, 9, 17, 18 and 26. Roles, rights and data protection obligations. Consult source

1074 Decree of 2015, chapter 25, especially article 2.2.2.25.5.2. Transmission contract and obligations of the person responsible. Consult source

External Circular SIC 003 from 2025. Model clauses for international transfer and transmission. Copy of the act consulted in an external repository. Consult source

1480 Law of 2011, 37 Articles to 43, 47, 50, 51 and 58. General conditions, abusive clauses and consumption. Consult source

Law 2439 of 2024. Update on consumer protection of electronic commerce, information, channels and returns. Consult source

Civil Code, articles 1522, 1602, 1603, 1604 and 1616. Limits and revision of liability pacts Consult source

Code of Commerce, article 884. Interests in commercial obligations; the rate is verified for each period. Consult source

General Code of Process, articles 244, 247 and 422. Documents, data messages and requirements of the executive title. Consult source

AWS Shared Responsibility Model. Conceptual reference for separating infrastructure and customer operation. Consult source

Amazon Compute SLA. Distinguished individual deployment instance in several areas and uses monthly measurement and phased credits. The ENGITECH architecture with AWS is not equated. Consult source

AWS Backup SLA. Its availability measurement of API does not amount to the success of each backup; therefore a separate performance indicator is proposed. Consult source

AWS Customer Agreement. Contractual organization and resource delimitation; no foreign law or incompatible exonerations are imported. Consult source

Portfolio Engitech and TrustNet Security. Base for coverage of services and brands. Consult source

Nextcloud Workspace. Scope of Files, Talk, Office and Add-ons per plan. Consult source

Advanced Security Copies. Distinction of VMs, files and collaboration data. Consult source

Colocation. Internet separated from the network port and conditions subject to headquarters and proposal. Consult source