CHANIS (the “Firm”, “CHANIS”, “we”, “us” or “our”)

Last updated: July 20, 2026

1. Purpose and Scope

This Personal Data Protection Policy (the “Policy”) sets forth the principles and guidelines governing the processing of personal data carried out by CHANIS, in accordance with Law 81 of March 26, 2019, Executive Decree No. 285 of May 28, 2021, and any other applicable legal provisions in the Republic of Panama.

CHANIS recognizes the importance of protecting personal data and undertakes to process such data in a lawful, transparent and secure manner, respecting the rights of data subjects and the duties of confidentiality and professional obligations applicable to the practice of law.

This Policy applies to the processing of personal data carried out by CHANIS in the course of its professional and administrative activities, with respect to clients, potential clients, client representatives, employees, candidates, interns, suppliers, visitors and any other person whose personal data is processed by the Firm.

2. Definitions

For purposes of this Policy, the following terms shall have the meanings set forth below, in accordance with Law 81 of March 26, 2019:

Personal Data: Any information concerning natural persons that identifies them or makes them identifiable.

Confidential Data: Data that, by its nature, should not be known publicly or by unauthorized third parties, including data protected by law, confidentiality agreements or non-disclosure agreements, in order to safeguard the information. Confidential data shall always be subject to restricted access.

Sensitive Data: Data relating to the intimate sphere of the data subject, or whose improper use may give rise to discrimination or entail a serious risk to the data subject. By way of example, sensitive data includes personal data that may reveal aspects such as racial or ethnic origin; religious, philosophical or moral beliefs or convictions; trade union membership; political opinions; data relating to health, life, sexual preference or orientation; genetic data or biometric data, among others, subject to regulation and intended to uniquely identify a natural person.

Data Subject: The natural person to whom the data relates.

Data Controller: Any natural or legal person, whether governed by public or private law, for profit or not, that is responsible for decisions relating to the processing of data and that determines the purposes, means and scope of such processing, as well as related matters. For purposes of this Policy, the Data Controller is CHANIS.

3. Data Controller

The data controller of the personal data processed under this Policy is CHANIS, a law firm duly established and operating in the Republic of Panama.

For any inquiry, request or exercise of the rights set forth in this Policy, the data subject may contact CHANIS through the contact channels published on its website or by email at privacy@chanis.pa, clearly indicating the reason for the request.

4. Principles

CHANIS shall process personal data in accordance with the principles set forth in Law 81 of March 26, 2019, namely:

Principle of Fairness: CHANIS collects personal data lawfully, fairly and transparently, with the express and informed consent of the data subject.

Principle of Purpose Limitation: CHANIS collects and processes personal data only for specific and legitimate purposes related to the development of its professional and administrative activities.

Principle of Proportionality: CHANIS limits the processing of personal data to data that is adequate, relevant and necessary to fulfill the purposes for which it was collected.

Principle of Truthfulness and Accuracy: CHANIS endeavors to ensure that personal data is accurate, complete and, where appropriate, kept up to date for the purposes of the processing.

Principle of Transparency: CHANIS provides data subjects with clear and simple information regarding the processing of their personal data and the exercise of their rights.

Principle of Confidentiality: CHANIS processes all personal data under strict duties of confidentiality and, where applicable, in accordance with the professional confidentiality obligations applicable to the practice of law.

Principle of Lawfulness: CHANIS collects and processes personal data with the prior, informed and unequivocal consent of the data subject.

Principle of Portability: CHANIS recognizes the data subject’s right to obtain a copy of his or her personal data in a structured, generic and commonly used format.

5. Personal Data Processed

As a law firm, CHANIS collects personal data in the course of its professional and administrative activities. The nature of the legal services provided by the Firm often requires collecting information before accepting a matter or commencing a professional relationship, in order to assess the feasibility of providing the requested legal services, verify the absence of conflicts of interest, comply with due diligence and Know Your Client (“KYC”) regulations, meet legal and regulatory obligations and, where applicable, formalize and develop the professional relationship.

Depending on the nature of your relationship with CHANIS, the Firm may collect personal data, including, among others, the following:

If you are a client or potential client:

CHANIS may collect, among other data, identification data such as full name, date of birth, nationality, personal identity card or passport number and photograph; contact details such as physical address, email address and telephone numbers; and, in the case of legal entities, information related to their domicile, taxpayer identification number, legal representatives, corporate structure, shareholders and ultimate beneficial owners, as well as any other information or documentation necessary for the provision of legal services or for compliance with applicable legal and regulatory obligations.

If you are a supplier:

CHANIS may collect the information necessary to evaluate, engage and manage its commercial relationship with suppliers, including identification and contact data, corporate information, business references and any other information necessary to conduct due diligence processes and comply with applicable legal and regulatory obligations.

If you are an employee or candidate:

CHANIS may collect personal data contained in resumes, job application forms, interviews, employment references, academic and professional information, as well as any other information necessary to evaluate your candidacy, manage the employment relationship and comply with the corresponding legal obligations.

If you visit our offices:

CHANIS may collect personal data necessary to control access to its premises and ensure the security of its employees, clients, visitors and assets, including entry records, identification information and, where applicable, images captured by video surveillance systems.

If you use our website or communicate with CHANIS through digital means:

CHANIS may collect information that the user voluntarily provides through contact forms or electronic communications, including name, contact details, company, position and the content of the inquiry. Likewise, the website may collect certain technical information, including IP address, general geographic location data derived therefrom, browser type, operating system, device characteristics, pages visited, time spent on the website, browsing patterns and identifiers from cookies and similar technologies, in accordance with CHANIS’ Website Privacy Policy.

Sensitive Data:

CHANIS does not request sensitive data as part of its ordinary activities. However, where strictly necessary for the provision of a legal service, for compliance with a legal obligation, or where the data subject voluntarily provides such data, it shall be processed in accordance with applicable law and with the corresponding enhanced protection measures.

In order to comply with the principle of truthfulness and accuracy set forth in Law 81 of March 26, 2019, data subjects who maintain an ongoing relationship with CHANIS must inform CHANIS of any changes to their personal data within thirty (30) calendar days following the date on which such changes occur, so that the information contained in the Firm’s databases may be kept up to date.

6. Purposes of Processing

CHANIS processes the personal data it collects solely for specific, explicit and legitimate purposes that are compatible with the nature of the services it provides and with the legal and regulatory obligations applicable to it.

Clients and potential clients:

Personal data may be processed for the following purposes:

• Responding to inquiries, requests for information and requests for legal services.
• Assessing the nature of the matter submitted and determining whether the Firm is in a position to provide the requested legal services, including verification of potential conflicts of interest in accordance with applicable ethical and professional rules.
• Preparing service proposals and formalizing the professional relationship.
• Providing the contracted legal services and managing the professional relationship with the client.
• Complying with identification, verification, due diligence, Know Your Client (“KYC”) procedures and other obligations related to the prevention of money laundering, terrorist financing and the financing of the proliferation of weapons of mass destruction, as well as any other applicable legal or regulatory obligation.
• Managing payments, billing and collection of obligations.
• Updating and verifying data subject information when necessary for the maintenance of the professional relationship.
• Responding to requests from competent authorities and complying with judicial or administrative orders, where applicable.
• Exercising or defending the rights and legitimate interests of CHANIS.

Suppliers:

Personal data may be processed for the following purposes:

• Evaluating and selecting suppliers.
• Formalizing and managing the commercial relationship.
• Complying with due diligence, risk assessment and other applicable legal and regulatory obligations.
• Managing payments, billing and other administrative processes related to the provision of goods or services.
• Responding to requests from competent authorities and complying with applicable legal obligations.

Employees and candidates

Personal data may be processed for the following purposes:

• Evaluating candidates during recruitment and selection processes.
• Verifying information provided by candidates, including personal and professional references, where applicable.
• Formalizing and managing the employment relationship.
• Managing payroll, employment benefits, benefits plans and other matters arising from the employment relationship.
• Complying with labor, tax, social security and other applicable legal obligations.
• Implementing internal policies and procedures related to personnel administration.

Visitors

Personal data may be processed for the following purposes:

• Controlling access to CHANIS’ premises.
• Protecting the security of the Firm’s employees, clients, visitors, assets and premises.
• Complying with internal security policies and controls.

Website users and electronic communication channels

Personal data may be processed for the following purposes:

• Responding to inquiries, requests for information and contact requests related to the Firm’s services.
• Following up on communications with the user.
• Managing contact forms and other electronic communication channels.
• Measuring and analyzing the performance of the website, including aggregate user behavior, for purposes of continuously improving its operation, content and user experience.
• Maintaining the security of CHANIS’ technology platforms.
• Sending institutional information or information related to the Firm’s services, where there is a legal basis to do so or where the data subject has given his or her consent.

In addition, CHANIS may process personal data when necessary to exercise or defend its rights and legitimate interests, address claims or judicial, administrative or arbitral proceedings, or comply with requests from competent authorities, in accordance with applicable law.

CHANIS shall not process personal data for purposes incompatible with those described in this Policy, unless there is a legal basis that permits it or the data subject has given his or her consent where such consent is required by applicable law.

7. Legal Basis for Processing and Consent

CHANIS processes personal data in accordance with Law 81 of March 26, 2019, Executive Decree No. 285 of May 28, 2021, and any other applicable legal and regulatory provisions, taking into account the nature of the legal services provided by the Firm. Such processing may be based on one or more of the following:

• The consent of the data subject is obtained, where such consent is required by applicable law.
• The processing is necessary for the performance of a contractual relationship or pre-contractual measures to which the data subject is a party.
• The processing is necessary for compliance with a legal or regulatory obligation to which CHANIS is subject.
• The processing is authorized by a special law or the regulations implementing such law.

The user may withdraw his or her consent at any time, without affecting the lawfulness of the processing carried out prior to such withdrawal. Withdrawal of consent may mean that the Firm is no longer able to continue evaluating or addressing the inquiry or request submitted.

The consent of the data subject shall not be required when the processing of personal data is authorized by applicable law, including, among others, the following cases:

• Where the processing is necessary for compliance with legal or regulatory obligations applicable to CHANIS.
• Where the personal data comes from publicly accessible sources.
• Where the information is required by a competent authority in the exercise of its legal functions or in compliance with a judicial or administrative order.

8. Transfers and Disclosures of Personal Data

CHANIS does not sell, rent or otherwise commercialize the personal data of data subjects to third parties.

In the course of its professional activities, CHANIS may share personal data with its personnel, external service providers or professionals who collaborate with the Firm, such as experts, translators, external advisors, cloud providers, compliance platforms, billing systems, technology providers, web hosting service providers and digital performance measurement tools, including Google LLC under the terms described in the Website Privacy Policy. In such cases, CHANIS shall require such third parties to maintain the confidentiality and security of personal data and to use it only for the purposes for which it was shared.

Some of these third parties may be located outside the Republic of Panama. In such cases, CHANIS shall adopt reasonable measures to seek to ensure that the transfer or disclosure of personal data is carried out in accordance with applicable regulations and under adequate conditions of confidentiality and security.

CHANIS may disclose personal data when required to do so by a competent authority in the exercise of its legal functions, or when necessary for the exercise or defense of the Firm’s rights in connection with a claim, dispute or legal proceeding.

9. Nature of Legal Services and Professional Secrecy

CHANIS is a law firm, and the information that its clients and potential clients share in the context of a legal inquiry may be protected by professional confidentiality obligations and, where applicable, by attorney-client privilege recognized under Panamanian law and the rules of professional ethics applicable to the practice of law.

This Policy governs the processing of personal data. It does not constitute or replace the confidentiality terms governing a professional relationship formally established between the Firm and a client, which are subject to an enhanced standard of protection inherent to the practice of law and shall prevail over any general provision of this Policy in the event of a conflict.

The submission of a contact form or inquiry through this website does not, by itself, create an attorney-client relationship between the user and CHANIS. Such relationship is formed only upon execution by both parties of the corresponding engagement letter or legal services agreement.

10. Data Retention Period

CHANIS shall retain the personal data collected only for the time reasonably necessary to fulfill the purposes described in this Policy, or for the period required by applicable Panamanian law, whichever is longer.

Data relating to inquiries that do not progress into a formal professional relationship shall be retained for a reasonable period for commercial follow-up purposes and subsequently deleted or securely anonymized, unless there is a legal obligation requiring retention for a different period.

Data relating to the Firm’s clients shall be retained in accordance with the periods required by applicable professional, tax and anti-money laundering regulations, including, where applicable, the periods established by Law 23 of 2015 and its implementing regulations.

11. Security Measures

CHANIS implements reasonable technical, administrative and organizational security measures, appropriate to the available technology, to protect the personal data it processes against unauthorized access, loss, alteration, destruction or improper disclosure.

Notwithstanding the foregoing, the user acknowledges and accepts that no system for transmitting, processing or storing data over the internet can be considered absolutely secure. CHANIS adopts reasonable technical, organizational and security measures to protect the personal information it processes through this website. However, CHANIS cannot guarantee the absolute security of information transmitted by digital means and shall not be liable for unauthorized access, loss, alteration or disclosure resulting from causes beyond its reasonable control, including failures in the infrastructure of third-party providers, cyberattacks, acts of God, force majeure, or misuse of the information by the user or by third parties not affiliated with the Firm.

12. Rights of Data Subjects

Pursuant to Law 81 of 2019 and its regulations, every data subject has the right to:

1. Access: Request information regarding the personal data being processed, as well as to know the origin of such data and the purposes of the processing.
2. Rectification: Request the correction of inaccurate, incomplete or outdated personal data.
3. Cancellation: Request the deletion of personal data that is incorrect, irrelevant, incomplete, outdated, inaccurate, false or impertinent.
4. Objection: Object, on grounded and legitimate grounds, to his or her personal data being subject to a specific processing activity, as well as to revoke his or her consent.
5. Portability: Obtain a copy of his or her personal data in a structured and commonly used format that allows its transmission to another data controller.

The data subject may exercise any of these rights by submitting a request to CHANIS through the contact channels published on its website or by email at privacy@chanis.pa.

CHANIS shall respond to such requests within a period not exceeding fifteen (15) business days.

13. Personal Data of Minors

CHANIS’ website is directed to a business and professional audience and is not designed to be used by minors. CHANIS does not intentionally collect personal data from minors through its website. If CHANIS becomes aware that it has inadvertently collected personal data from a minor without the corresponding consent of his or her legal representative, it shall adopt reasonable measures to delete such information.

CHANIS does not provide services directed to minors. However, in the course of providing legal services, particularly in immigration matters or other matters involving minors as dependents or beneficiaries, CHANIS may process personal data of minors where necessary for the provision of the requested legal services.

In such cases, CHANIS shall adopt reasonable measures to ensure that such processing is carried out in accordance with applicable law and, where applicable, with the authorization or involvement of the minor’s parents, guardians or legal representatives.

14. Amendments to this Policy

CHANIS may update this Policy periodically to reflect changes in its data processing practices, applicable regulations, or the services and technology tools used. The current version of this Policy shall always be the version published on CHANIS’ website, indicating its last updated date; therefore, users are encouraged to review this Policy periodically.

Last updated: June 29, 2026.

15. Contact

For inquiries related to this Policy or to exercise the rights described in Section 12, the data subject may contact CHANIS through the contact channels published on our website (www.CHANIS.pa) or by email at privacy@chanis.pa.