1. Introduction

SMS (*) and its employees (all of them collectively) are committed to safeguarding Personal Data (as defined in Clause 2) and ensuring its privacy, as outlined in this Privacy and Personal Data Protection Policy (hereinafter referred to as the “Privacy Policy”).

This Privacy Policy describes the practices of SMS and its service providers regarding the collection and processing of information that may be gathered from visitors, users, and/or clients (hereinafter, “You” or the “Data Subject(s)”) through any website or application operated and controlled by SMS (as defined below).

By providing your Personal Data, including data that may be considered sensitive and which SMS is legally authorized to process, you accept the terms and conditions detailed herein.

The websites and applications of SMS, including all information and materials they contain, are managed by SMS.

For the purposes of this Privacy Policy, the following terms shall be understood as:

• SMS Application(s): any software solution managed by SMS in which this Privacy Policy is stated to be applicable (hereinafter referred to as the “Application” or “Applications”).
• SMS Website(s): sms.com.ar and other sites managed by SMS that indicate the applicability of this Privacy Policy (hereinafter referred to as the “Site” or “Sites”).

In its capacity as the Data Controller, SMS ensures that its internal processes comply with the obligations established by Personal Data Protection Law No. 25.326, its regulatory decree 1558/2001 (hereinafter the “PDPL”), and the resolutions issued by the Access to Public Information Agency (hereinafter the “AAIP”). Furthermore, the exercise of the rights of access, updating, rectification, or deletion by the Data Subject is also guaranteed, in accordance with Articles 14 and 15 of the PDPL.

Simply accessing, visiting, connecting to, and/or otherwise using SMS’s Websites or Applications means that you have read and understood the entirety of this Privacy Policy and that you consent to each and every provision contained herein.

Notwithstanding the binding nature of this Privacy Policy, it does not supersede, substitute, eliminate, modify, amend, and/or alter—whether in whole or in part—any existing or future contract, record, and/or agreement that the Data Subjects may have entered into and/or may enter into with SMS.

This Privacy Policy has been drafted in accordance with other applicable internal policies and regulations of SMS and must be understood and interpreted jointly with this record. This Privacy Policy is complemented by SMS’s Information Safety Manual.

If you do not agree with this Privacy Policy, please refrain from using SMS’s Websites or Applications.

2. Definitions

The Data Subject is informed that any terms not defined in this Privacy Policy shall have the meaning assigned to them in Article 2 of the PDPL or the meaning expressly assigned to them in this Privacy Policy.  In this regard, the following definitions apply:

• Personal Data: Any information relating to identified or identifiable natural persons or legal entities.
• Sensitive Data: Data revealing racial or ethnic origin, political opinions, religious, philosophical or moral beliefs, trade-union membership, and data concerning health or sex life.
• File, record, database, or data bank: Organized sets of personal data subjected to processing, whether electronic or not.
• Data processing: Any operation or systematic procedure applied to personal data, including collection, storage, modification, transfer, or destruction.
• Data Controller: Natural or legal person who decides on the content and use of the data processing.
• Computerized data: Data subjected to automated processing.
• Data Subject: Natural or legal person whose personal data is being processed.
• Data registry for advertising purposes: Collection and processing of data for promotional, commercial, or advertising purposes, with the consent of the Data Subject or as determined by Article 27 of the PDPL and its regulation according to Decree 1558/01.
• Employees: Includes employees, administrators, shareholders, partners, legal representatives, managers, trustees, and/or directors who are part of SMS, regardless of their role, position, or hierarchical level, whether they perform their duties on-site, in a hybrid mode, or remotely.

3. Legal Basis for Data Processing

SMS will base the processing of Personal Data collected on the following grounds allowed by the PDPL:

• Having the express consent of the Data Subject.
• When the Personal Data derives from a contractual or professional relationship between SMS and the Data Subject and is necessary for its development and/or compliance.
• When the Personal Data is collected by SMS in compliance with a legal obligation.
• When the Personal Data originates from sources of unrestricted public access.

Beyond the above, use of SMS’s Websites or Applications implies acceptance of this Privacy Policy. SMS may modify its terms periodically. Continued use shall imply acceptance of the current versions.

4. Information Collected

The amount and type of information collected by SMS’s Websites or Applications depends on how they are used. Most content is accessible without providing Personal Data. However, Personal Data may only be collected when the user voluntarily provides it, for example, in the following cases:

• When signing petitions or completing forms;
• When applying for job opportunities;
• When requesting information;
• When sending messages or inquiries through our communication channels.

In this regard, SMS informs the Data Subject that, in compliance with Resolution 14/2018 issued by the AAIP, “The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is demonstrated in accordance with Article 14, subsection 3 of the PDPL. The AGENCY FOR ACCESS TO PUBLIC INFORMATION, the Supervisory Authority of the LPDP, has the authority to handle complaints and claims related to non-compliance with personal data protection regulations.” This mandatory notice will be included in all requests or forms for the collection of Personal Data that appear on SMS’s Websites or Applications.

5. Use of Collected Information. Purposes.

SMS and its service providers shall process the information solely for the purposes for which it was provided or as indicated on the Website or Application. For example, if a person expresses interest in hiring the services provided by SMS, they may receive related institutional information.

SMS shall not collect information that is incompatible with its stated purposes nor Sensitive Data, except when strictly necessary or when authorized by law (e.g., employee records, donor registries, suppliers), in accordance with Articles 2, 7, and 8 of the PDPL.

The Personal Data collected shall be stored in a database registered with the AAIP and shall be processed with the utmost confidentiality.

In this context, the Personal Data of Data Subjects may be used by SMS for the following specific purposes:

• To provide you with our services as requested.
• To respond to inquiries made by you.
• For advertising and/or direct marketing purposes by SMS (for example, but not limited to, sending newsletters, new product launches, etc.).
• To respond to requests to exercise rights of access, rectification, or deletion of the Data Subject’s Personal Data.
• To fulfill contractual obligations entered into by SMS with the Data Subject.
• To comply with legal obligations and/or requests from competent judicial and/or administrative authorities, and to exercise legal defenses.
• To monitor, review, and improve the use and performance of the Site and/or the Applications.

Data Subjects who provide Personal Data declare that the information provided is true, accurate, and complete. SMS does not verify, nor has it assumed or shall assume, in whole or in part, the obligation to verify the truthfulness, validity, sufficiency, legality, or authenticity of the Personal Data provided by the Data Subject, as this is the sole and exclusive responsibility of the Data Subject.

6. Data Security

SMS applies appropriate technical and organizational measures to protect Personal Data, in accordance with Article 9 of the PDPL and Resolution 47/2018 of the AAIP, to prevent unauthorized access, vulnerabilities, hacking, and safety incidents.

SMS declares, states, and guarantees that it makes every effort to protect the privacy of Data Subjects and their Personal Data. However, Data Subjects acknowledge that the existing technical means for providing security are not infallible and that, even when all reasonable safety precautions are taken, manipulation, destruction, and/or loss of information may still occur.

This section is aligned with the Information Safety Manual, where the specific technical and organizational security measures adopted by SMS for the compliance of the protection of Personal Data are detailed. For more information about the safety measures implemented by SMS, as well as their content, please contact us at: privacidad@sms.com.ar.

7. Third-Party Providers and Data Processing. Sharing Your Data.

In order to carry out the purposes described in this Privacy Policy, SMS may share your data with third parties, including those listed below:

• Our Sites and Applications may be hosted or processed by third-party service providers contracted by SMS, who act on its behalf and are subject to strict confidentiality and data protection obligations. In accordance with Article 25 of the PDPL, SMS shall enter into agreements with such third parties to ensure that:
  • The data will not be used for purposes other than those agreed upon;
  • Once the service has been provided, the data will be destroyed unless expressly authorized otherwise;
  • The same levels of safety required by the PDPL and/or applicable regulations are applied;
  • The data processor acts only under the instructions of SMS.
• Legal requirements. SMS may share Personal Data in its possession with judicial and/or administrative authorities when it is required to do so to comply with its legal obligations, or if SMS considers it necessary or appropriate to comply with the law or to protect or defend the rights or property of SMS. Furthermore, SMS reserves the right to retain and process Personal Data to comply with accounting and tax regulations.
• Auditors and legal consultants. SMS may share Personal Data in its possession with its auditors in order for them to carry out their functions, and with its legal advisors to obtain legal counsel. These auditors and consultants shall apply appropriate safety measures and may not use the Personal Data for their own purposes (other than those entrusted by SMS). Furthermore, SMS shall prevent them from disclosing the Personal Data to third parties, in accordance with Article 25 of the PDPL.
• Business Partners. SMS may occasionally share Personal Data in its possession with business partners associated with SMS in order to offer a particular product or service or a special condition.
• Affiliated companies. SMS may share your Personal Data with companies within the same economic group, always for the same purposes for which the Personal Data was collected and in order to provide better service. For this, SMS shall comply with all applicable regulations under the PDPL and with the intercompany policies or internal regulations of the group. If group companies are located abroad, SMS shall comply with AAIP Resolution 159/2018 or AAIP Resolution 60/16.
• International Transfer of Personal Data. If it becomes necessary to carry out international data transfers, we will take steps to ensure that there is a legal basis for such transfer and that adequate protection is provided for the Personal Data, as required by the PDPL. For example, we may use International Data Transfer Contracts when the transfer is made to countries “without adequate legislation” as prescribed by the PDPL and AAIP Disposition 60/2016, or we may request the express consent of the Data Subject, specifying the country to which the data will be transferred. Appropriate safety measures shall be maintained for the transferred information to ensure that the recipients of such data comply with the PDPL and use the data solely for the purposes for which it was transferred. By submitting their Personal Data, Data Subjects agree to the transfer and storage of such data and expressly authorize SMS, in accordance with this Privacy Policy and applicable law, to: (i) collect and process their Personal Data for the purposes detailed above, and/or (ii) assign and transfer their collected Personal Data as indicated above, solely to authorized third parties – whether in Argentina or abroad – for the indicated purposes.

If you disclose to third parties any Personal Data that you have shared with us and/or any information you have provided to us or to third parties through our services, the use of such data by those third parties is their sole responsibility, over which SMS has no control or liability.

8. Use of Cookies

SMS uses cookies and similar technologies to improve the browsing experience on its Sites and Applications. Cookies are text files sent by websites to the user’s browser, allowing the site to remember information about the visit, such as language preferences, session settings, or viewed content, with the aim of optimizing functionality and personalizing the services offered. It is possible to set restrictions from your internet browser. For more information, please visit: www.aboutcookies.org.

9. Direct Marketing Activities

In accordance with Article 27 of the PDPL, Decree 1558/01, and AAIP Disposition 10/2008, any form or record used for marketing activities must include the following clauses:

• The right of the Data Subject to access their information free of charge, at intervals of no less than six months, unless a legitimate interest is demonstrated.
• The option to request, at any time, the total or partial removal or blocking of their Personal Data from the Database.
• A prominent warning when the communication constitutes unsolicited direct advertising not previously requested or consented to by the Data Subject.

10. Database Registration

In accordance with Articles 3 and 21 of the PDPL, SMS has registered as a Data Controller with the AAIP and has duly registered its Databases, complying with the applicable regulations in this regard.

11. Rights of Data Subjects

The Data Subject may access and, where appropriate, request that SMS review, modify, delete, and/or update their Personal Data, in accordance with the procedures established in the PDPL and this Privacy Policy.

The right to access data may be exercised free of charge by the interested party, provided that the request for such information is made at intervals of no less than 6 (six) months, unless a legitimate interest is proven, as established in Article 14 subsection 3 of the PDPL.

If the data is incorrect, or needs to be updated and/or deleted, SMS shall correct, update, and/or delete such information upon request of the Data Subject, at no cost, in accordance with Article 16 of the PDPL. To do so, the Data Subject must send an email to privacidad@sms.com.ar.  Providing their full name, national Identity number, the specific request, and the reason for exercising their right. Once all the above requirements have been met, and if the request is deemed appropriate, SMS shall inform the Data Subject whether the request has been granted or rejected, within the legally established timeframes.

SMS informs the Data Subject that, in compliance with AAIP Resolution 14/2018: “the Data Subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is demonstrated, in accordance with Article 14, subsection 3 of the PDPL. The AGENCY FOR ACCESS TO PUBLIC INFORMATION, the Supervisory Authority of the LPDP, has the authority to handle complaints and claims related to non-compliance with personal data protection regulations.”

12. Training and Dissemination of the Policy.

SMS provides training to its employees and service providers regarding this Privacy Policy, maintaining records of participation in such training.

SMS shall make its best efforts to disseminate this Privacy Policy, as well as any other rules and/or procedures it may establish to protect Personal Data, among its employees.

Employees who misuse Personal Data and violate this Privacy Policy may be subject to disciplinary action by SMS, in accordance with the PDPL, labor laws, and other applicable regulations.

For more information regarding the handling of Personal Data and the Use of Systems, including their content, please contact: privacidad@sms.com.ar.

13. Validity and Review. Contact

This Privacy Policy shall take effect as of its publication and will be periodically reviewed to ensure its compliance with current regulations.

SMS reserves the right to modify this Policy at any time. Any changes shall be duly published and will be deemed accepted by users who continue to use the services after the revised Policy becomes effective.

For any additional inquiries regarding this Privacy Policy, you may contact SMS at the following email address: privacidad@sms.com.ar.

________________________________________________________________________________________________

(*) In this agreement, “SMS” refers to SMS S.A., SMS – San Martin, Suarez y Asociados Soc. Civil y SMS Sistemas S.R.L.