Habitus Español

Privacy Policy

Draft under legal review. It may change before launch.

Habitus – Global Privacy Policy

Version: 2.0 – Global Application · Draft for legal review

Issue Date: __________

Owner: Habitus Finance S.A.C. · Tax ID (RUC) 20615971074 · Av. Ricardo Palma 982, Dpto. 702, Miraflores, Lima, Peru

1. Who We Are

1.1. This Privacy Policy explains how Habitus Finance S.A.C., with tax ID (RUC) 20615971074 and registered address at Av. Ricardo Palma 982, Dpto. 702, Miraflores, Lima, Peru ("Habitus", "we", "us"), collects, uses, shares and protects personal data when you use the Habitus app, the website habitus.finance and related services (together, "the Platform").

1.2. Habitus is the data controller for the personal data described in this Policy.

1.3. Privacy contact: Joel.hernandez@habitus.finance. You can write to us in English or Spanish about any question or request related to your personal data.

1.4. This Policy applies to all Users of the Platform, wherever they live. Where the law of your country gives you additional rights, section 11 explains them. Module-specific annexes (for example, the Habitus Finance Privacy Annex) add detail for each module and prevail over this Policy for that module.

1.5. This Policy forms part of the Habitus Terms and Conditions.

2. Our Commitments

2.1. We do not sell your personal data.

2.2. We do not share your personal data for cross-context behavioral advertising, and we do not show third-party advertising.

2.3. We do not connect to your bank accounts.

2.4. We collect only what the Platform needs to work, and you decide what you record.

2.5. Your emotional data is treated as sensitive data and is processed only with your explicit consent.

3. Personal Data We Collect

3.1. Account data: email address (or the identifier provided by Apple or Google if you sign in with them), name, date of birth (to confirm you are 18 or older), country, time zone and language.

3.2. Consent records: which consents you gave, the version of the text you accepted, and when you gave or withdrew them.

3.3. Content you record: income and expenses (category, amount, currency, date, optional description), goals and preferences, and the settings you choose in each module.

3.4. Emotional data: the emotions, sub-emotions and short narratives you associate with your records. This information can reveal aspects of your emotional life and mental well-being, so we treat it as sensitive data (a special category of data under the GDPR, sensitive personal information under the CPRA and sensitive personal data under the LGPD and Peruvian Law 29733).

3.5. Approximate location (optional): only if you give location consent and only for the records where you turn it on. It is stored rounded to about 110 meters and is never used to track you.

3.6. Technical data: device type, operating system, app version, error logs and security logs needed to keep the Platform working and secure.

3.7. Website data: if you join the waiting list on habitus.finance, we store your email, language and where you signed up from. The website stores your language preference on your device. It does not use advertising cookies, analytics cookies or third-party trackers.

3.8. Data from third parties: only what Apple or Google share when you sign in with them, and only with your authorization.

3.9. We do not collect government identification numbers, bank credentials or card details. Payments for subscriptions, when enabled, are processed by the App Store or Google Play.

4. Why We Use Your Data and Our Legal Bases

For each purpose, the legal basis we rely on:

4.1. Where we rely on consent, you can withdraw it at any time from the app or by writing to us. Withdrawal does not affect processing carried out before it.

4.2. Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (section 11).

5. Automated Processing

5.1. Habitus does not make decisions based solely on automated processing that produce legal effects or similarly significant effects on you.

5.2. Messages such as reflections, questions and pattern notices are descriptive. They do not score you, decide for you or limit your access to any service.

5.3. Habitus does not use your personal data to train third-party artificial intelligence models.

6. Anonymized and Aggregated Data

6.1. We may create anonymized and aggregated data from personal data, so that it can no longer identify you or be linked back to you by reasonable means ("Structural Data").

6.2. We use Structural Data for statistics, research, product development and service improvement.

6.3. Structural Data is not personal data. We apply recognized anonymization standards and contractually prohibit any recipient from attempting to re-identify individuals.

6.4. We do not sell or license data that identifies you or could reasonably be linked to you.

6.5. The Structural Data Use Clause develops this section.

7. Who We Share Data With

7.1. Service providers (processors) that help us operate the Platform, under contracts that require them to protect your data and use it only on our instructions:

7.2. Other Habitus modules: only with your cross-module consent.

7.3. Authorities: only when required by law, a court order or to protect the vital interests of a person.

7.4. Corporate transactions: if Habitus is involved in a merger, acquisition or sale of assets, personal data may be transferred subject to this Policy, and we will notify you before it becomes subject to a different policy.

7.5. We do not share personal data with data brokers or advertisers.

7.6. Protection of rights: we may use or disclose personal data as necessary to establish, exercise or defend legal claims; enforce the Terms and Conditions; investigate fraud, abuse or security incidents; and protect the rights, property and safety of Habitus, its Users or others.

8. International Data Transfers

8.1. Habitus is based in Peru and our main database is in Brazil. Some providers may process data in other countries.

8.2. When we transfer personal data outside your country, we use appropriate safeguards required by applicable law, such as adequacy decisions, the European Commission's Standard Contractual Clauses, the transfer mechanisms of the LGPD and Law 29733, and equivalent contractual and technical measures.

8.3. You can ask us for information about the safeguards used for a specific transfer.

9. Security

9.1. We protect personal data with technical and organizational measures, including encryption in transit and at rest, row-level access controls (each person can only access their own data), access restricted to authorized personnel, audit logs and regular review of our providers.

9.2. No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the competent authorities and you within the time limits required by applicable law.

10. How Long We Keep Data

10.1. We keep your account data and content while your account exists.

10.2. If you withdraw location consent, we delete your stored locations.

10.3. When you delete your account, we permanently delete your profile and content. We keep only a record of your deletion request and security logs that no longer identify you, for up to five years, and data we must keep by law, for the period the law requires.

10.4. Waiting list data is kept until you unsubscribe or until we notify you that the app is available.

10.5. Structural Data may be kept as long as needed for the purposes in section 6, because it does not identify you.

10.6. We may keep strictly necessary data, with restricted access, for as long as required to establish, exercise or defend legal claims, comply with legal obligations or resolve disputes, until the applicable limitation periods expire.

11. Your Rights

11.1. Depending on where you live, you have the right to:

11.2. Peru (Law 29733): rights of access, rectification, cancellation and objection (ARCO). You can complain to the National Authority for Personal Data Protection (Autoridad Nacional de Protección de Datos Personales).

11.3. European Union, EEA and United Kingdom (GDPR and UK GDPR): all rights in section 11.1. You can complain to the supervisory authority of your country of residence or work.

11.4. California (CCPA/CPRA): the right to know, delete and correct; the right to opt out of the sale or sharing of personal information (we do neither); the right to limit the use of sensitive personal information (we use it only to provide the services you request); and the right not to be discriminated against for exercising your rights. You may use an authorized agent.

11.5. Brazil (LGPD): the rights in Article 18 of the LGPD, including confirmation of processing, anonymization, information about sharing and review of consent. You can complain to the National Data Protection Authority (ANPD).

11.6. United Arab Emirates (PDPL, DIFC and ADGM): the rights granted by the applicable law, under the UAE User Clause.

11.7. How to exercise your rights: use the options in the app (export, settings and account deletion) or write to Joel.hernandez@habitus.finance. We may ask you to confirm your identity. We respond within the time limits set by applicable law and do not charge for reasonable requests.

11.8. We may refuse or limit a request when we cannot verify your identity, when it is manifestly unfounded, excessive or repetitive, when it would affect the rights of others, or when we must keep the data by law or to defend legal claims. Where the law allows, we may charge a reasonable fee for excessive requests. We will always explain why.

12. Children

12.1. The Platform is only for people aged 18 or older. We do not knowingly collect data from minors. If we learn that a minor has created an account, we will delete it.

13. Changes to This Policy

13.1. We will notify you in the app before material changes take effect and, where the law requires it, we will ask for your consent again.

13.2. The current version, with its date, is always available in the app and at habitus.finance.

14. Legal Framework and Country-Specific Provisions

14.1. Habitus applies this Policy in accordance with the data protection laws that apply to each User based on where they live, including:

14.2. If an applicable law gives you more protection than this Policy, that law prevails.

14.3. European Union, EEA, United Kingdom and Switzerland. If Habitus actively offers the Platform in these territories, it will appoint a representative under Article 27 of the GDPR (and its UK and Swiss equivalents) and publish their details here. The website only uses strictly necessary storage (your language), so it does not require cookie consent; if we use non-essential cookies in the future, we will ask for your consent first.

14.4. United States. We treat emotional information as sensitive personal information and as consumer health data under the Washington My Health My Data Act: we collect it only with your consent, use it only to provide the service you request, do not sell it and do not share it without additional, separate consent. We honor browser opt-out signals such as Global Privacy Control. Residents of states with privacy laws can exercise rights of access, correction, deletion, portability and opt-out, and appeal our response, by writing to the email in section 1.3.

14.5. Canada and Quebec. The person in charge of the protection of personal information is Joel Hernandez Fernandez (Joel.hernandez@habitus.finance).

14.6. Latin America. In Mexico, Colombia, Chile, Argentina and Ecuador you can exercise the rights of access, rectification, cancellation or objection (ARCO) and any others granted by your law, and complain to your country's data protection authority.

14.7. Asia-Pacific and Middle East. In India, Japan, South Korea, Singapore, Australia, the United Arab Emirates and Saudi Arabia you can exercise the rights granted by local law, including appointing a person to exercise them on your behalf where the law allows, and complain to the competent authority.

15. Responsibilities and Limitations

15.1. Accuracy of information. You decide what you record and are responsible for ensuring that the information you enter is truthful and that you have the right to share it. If your narratives mention other people, please do so respectfully and only as necessary. Habitus does not verify the content you record.

15.2. Security of your account. You are responsible for protecting your device, your credentials and the sign-in methods you use (including Apple and Google), and for notifying us immediately if you suspect unauthorized access. Habitus is not liable for access resulting from the loss, lending or careless handling of your device or credentials.

15.3. No professional advice. The readings, reports, the Body Report and the messages on the Platform are self-knowledge tools. They are not financial, legal, tax, medical, psychological or therapeutic advice, nor a diagnosis of any kind. The decisions you make are your own.

15.4. Not an emergency service. Crisis mode shows help resources, but Habitus is not an emergency or mental health care service. If you are in danger, immediately call the emergency services in your country.

15.5. Third-party services. Apple, Google, map providers, app stores and other services you use together with the Platform are governed by their own policies. Habitus is not responsible for the practices of those third parties beyond what it entrusts to them.

15.6. Misuse. We may suspend or close accounts used for fraud, abuse, attacks on the Platform or in breach of the Terms and Conditions, keeping the data needed under section 10.6.

15.7. Limitation of liability. To the maximum extent permitted by applicable law, Habitus's liability in connection with the processing of personal data is limited to direct damages caused by a breach of this Policy attributable to Habitus. Nothing in this Policy excludes or limits liability that cannot be excluded or limited by law, or rights that the law grants you and that cannot be waived.

16. Governing Law, Language and Validity

16.1. This Policy is governed by the laws of the Republic of Peru. Disputes are submitted to the judges and courts of Lima, Peru, without prejudice to the mandatory rights granted to you by the law of your country of residence, including the right to complain to your data protection authority.

16.2. This Policy is published in Spanish and English. In case of discrepancy, the Spanish version prevails, unless applicable law requires otherwise.

16.3. If any provision of this Policy is held invalid or unenforceable, the remaining provisions will remain in effect, and that provision will be interpreted as closely to its purpose as the law allows.

16.4. Habitus's failure to exercise a right under this Policy does not mean it waives that right.

17. Contact

17.1. Habitus Finance S.A.C., Av. Ricardo Palma 982, Dpto. 702, Miraflores, Lima, Peru. Email: Joel.hernandez@habitus.finance.

Privacy Annex – Habitus Finance

Draft for legal review · October 23, 2026 · Supplements the Habitus Global Privacy Policy and prevails over it as regards Habitus Finance. In case of discrepancy, the Spanish version prevails.

1. Who processes your data

1.1. The data controller is Habitus Finance S.A.C., tax ID (RUC) 20615971074, with registered address at Av. Ricardo Palma 982, Dpto. 702, Miraflores, Lima, Peru.

1.2. For any question, or to exercise your rights, write to [privacy email; today Joel.hernandez@habitus.finance].

1.3. This annex describes what Habitus Finance does in its first version: conscious recording of income and expenses, the Emotions Matrix, the Crocodile, readings and reports (including the Body Report), rituals and export.

2. What data we process

2.1. Account. Email address (or the identifier provided by Google or Apple if you sign in with them), name, date of birth, country, time zone and language. Your date of birth is used to confirm that you are 18 or older.

2.2. Consents. What you authorized, with which version of the text and when; and, if you withdraw it, when.

2.3. Finance settings. Main currency, income frequency, categories you turn on or off, how you prefer to see your readings (essential or detailed) and the silhouette you choose for the Body Report (female, male or neutral). The silhouette is only a visual preference: Habitus does not ask for or store your sex.

2.4. Records. For each income or expense: type, category, amount, currency, date, an optional description and how you recorded it (manually, by photo or by voice). Also your fixed income and expenses.

2.5. Emotional layer. For each expense, the emotion and sub-emotion you choose and a short narrative you write. For income they are optional. These data reveal aspects of your emotional life and we treat them as sensitive data: only with your express consent and with the security measures in section 6.

2.6. Approximate location (optional). Only if you give the location consent and only on the records where you turn it on. It is stored rounded (about 110 meters), never your precise location, and it is not used to track you.

2.7. Crocodile messages. The reflections, questions and notices the app shows you after each record.

2.8. Crisis mode. If what you write suggests you are at risk, the app shows you immediate help (for example, Line 113, option 5, of Peru's Ministry of Health) and, for a few days, responds only with support. We store when it was activated and when it was closed; what you wrote stays only in your record.

2.9. Website waiting list. If you sign up on the Habitus website: your email, language and where you signed up from.

3. Photo and voice

3.1. Photo or scan of a receipt. The text in the image is read on your phone. The image is not sent to Habitus or stored: you only get a draft with amount, date and description, which you review.

3.2. Voice. Dictation uses your phone's speech recognition (Apple or Google), which may process the audio under their own policies. Habitus does not receive or store the audio: only the text of the draft you confirm.

3.3. In both cases, you choose and write the emotion, sub-emotion and narrative. None of that is automated.

4. What we use your data for

4.1. To provide the service: keep your records and show you who you are when you spend, your readings by period, the Body Report, rituals and export.

4.2. The Crocodile: to choose a reflection and a question for each record, and to let you know when a pattern repeats (for example, several days in a row from the same emotion, or several expenses in the same place). The Crocodile describes and asks; it does not judge or decide for you.

4.3. The Body Report groups your expenses into seven zones (Mind, Sustenance, Health, Relationships, Experiences, Growth and Well-being) according to their category. It is a descriptive reading of your money: it is not a health diagnosis and it does not assess your body.

4.4. Safety and care: to protect your account, prevent misuse and activate crisis mode when appropriate.

4.5. To comply with legal obligations and handle your requests.

4.6. We do not sell your personal data, we do not use it for third-party advertising and we do not connect to your bank accounts.

5. With whom and where

5.1. Supabase (database and sign-in). Your data is hosted in its São Paulo, Brazil region. This is an international data transfer, carried out with the safeguards required by Law 29733.

5.2. Google and Apple, if you sign in with them, and for voice dictation (section 3.2).

5.3. Maps: to show the map of your places, map images are requested from an external provider (today OpenStreetMap; before launch, [map provider]). The provider receives the map area being shown, not your records.

5.4. Payments: when subscriptions are enabled, payment is processed by the App Store or Google Play [and RevenueCat]. Habitus does not see or store your card details.

5.5. Between Habitus modules: what you record in Finance may feed other modules of the ecosystem (for example, Nexus or Decision) only if you give the cross-module consent. You can withdraw it at any time.

5.6. Authorities, only when required by law.

6. How we protect your data

6.1. Each person can only see and write their own data (row-level security in the database).

6.2. The connection between the app and the servers is encrypted, and the provider encrypts stored data.

6.3. We keep an audit log of who did what and when, without the content of your data.

7. How long we keep it

7.1. While your account exists, your records, their emotional layer and your Crocodile messages are not edited or deleted one by one: they are the memory of your story and what makes it possible to see your patterns honestly.

7.2. Location: if you withdraw the location consent, all your stored locations are deleted; your records remain.

7.3. When you delete your account, your profile and all your Finance data are permanently deleted. We keep only the record of your deletion request and the audit log, which no longer identifies you and is deleted after five years.

7.4. Waiting list: until you unsubscribe or we launch the app and let you know.

8. Your rights

8.1. Under Law 29733 and its regulations, you can request access, rectification, cancellation and objection (ARCO rights), and withdraw your consents at any time from the app.

8.2. You can download your data from the app (PDF, text and CSV, which includes each record with its emotion and narrative).

8.3. You can delete your account from Settings.

8.4. If you believe we did not handle your request, you can contact Peru's National Authority for the Protection of Personal Data.

9. Minors

9.1. Habitus Finance is only for people aged 18 or older.

10. Changes

10.1. If we change this annex we will let you know in the app before the change takes effect and, where the law requires it, we will ask for your consent again.

User Informed Consent

Version: 1.0 – Global Application

Issue Date: __________

Owner: Habitus Finance S.A.C. · Tax ID (RUC) 20615971074 · Av. Ricardo Palma 982, Dpto. 702, Miraflores, Lima, Peru

1. Purpose of Consent

1.1. This document ensures that the User provides free, express, informed and unequivocal consent for the use of the Habitus Platform and for the processing of their Personal Data and Structural Data.

1.2. Consent is a mandatory requirement for accessing and using the Platform.

1.3. By accepting this document, the User acknowledges that they understand the scope, limitations and implications of the Service.

2. Nature of the Service

2.1. The User understands that Habitus is a Financial Emotional Clarity (EFC) platform.

2.2. The User acknowledges that Habitus does not provide financial, legal, tax, psychological, medical, therapeutic, estate or investment advice.

2.3. The User acknowledges that Habitus does not make decisions on their behalf nor recommend mandatory actions.

2.4. The User understands that all results, models, projections and simulations are estimates based on the information they provide.

2.5. The Platform is not intended for emergency situations of any kind.

3. User Autonomy

3.1. All financial, emotional, behavioral or personal decisions derived from the Platform are the User's sole responsibility.

3.2. The Platform is a support tool and does not replace professional advice of any nature.

3.3. The User acknowledges that they remain fully responsible for evaluating the accuracy, relevance and implications of the information generated.

4. Consent for Personal Data Processing

4.1. The User authorizes Habitus to process their Personal Data in accordance with the Global Privacy Policy.

4.2. Processing activities include, without limitation:

a) collection,

b) storage,

c) organization,

d) analysis,

e) security and fraud prevention,

f) international transfer,

g) deletion in accordance with applicable law.

4.3. The User acknowledges that Personal Data is processed under international standards, including GDPR, CCPA/CPRA, PDPL, DIFC, ADGM, LGPD and LATAM privacy regulations.

4.4. The User understands that failure to provide Personal Data may limit or prevent the use of the Platform.

5. Consent for Structural Data Use

5.1. The User authorizes Habitus to transform, anonymize and structure their Personal Data to generate Structural Data.

5.2. Structural Data does not identify the User and is the exclusive property of Habitus.

5.3. The User authorizes the use of Structural Data for:

a) model training and optimization,

b) internal research,

c) innovation,

d) statistical analysis,

e) product development,

f) algorithmic improvement,

g) aggregated behavioral studies.

5.4. The User acknowledges that Structural Data may be retained indefinitely, as it does not constitute Personal Data.

6. International Data Transfers

6.1. The User authorizes the international transfer of Personal Data and Structural Data to any country where Habitus or its technological providers operate.

6.2. Habitus guarantees equivalent levels of protection through contractual, technical and organizational safeguards aligned with GDPR, PDPL, DIFC, ADGM and CCPA/CPRA.

7. User Rights

The User may exercise the following rights, subject to applicable law:

Requests must be submitted to: Joel.hernandez@habitus.finance

8. Declaration of Consent

The User declares that:

a) They have read and understood this document.

b) They understand the nature, scope and limitations of the Service.

c) They authorize the processing of their Personal Data. d) They authorize the generation and use of Structural Data.

e) They authorize international data transfers.

f) They acknowledge that all decisions are their sole responsibility.

g) They provide free, express, informed and unequivocal consent.

9. Signature

User Name: __________________________

Signature: __________________________

Date: __________________________

Structural Data Use Clause

Version: 2.0 – Global Application · Draft for legal review

Issue Date: __________

Owner: Habitus Finance S.A.C. · Tax ID (RUC) 20615971074 · Av. Ricardo Palma 982, Dpto. 702, Miraflores, Lima, Peru

1. Purpose and Relationship with the Privacy Policy

1.1. This Clause develops section 6 of the Habitus Global Privacy Policy (version 2.0) and forms part of it. In case of doubt, it is interpreted in accordance with the Policy.

2. What Structural Data Is

2.1. Structural Data is aggregated, statistical or anonymized information that Habitus obtains from Users' data and that can no longer identify any person or be linked to them by reasonable means.

2.2. It may include, for example: aggregated statistics on income, expenses, goals and emotions; relationships between variables observed across groups of people; collective trends and behavioral patterns; and the models, metrics and indicators built from that information.

2.3. Data linked to your account is not Structural Data and remains personal data protected by the Policy, even when it is derived or calculated, such as your readings, your individual patterns or your Body Report.

3. Legal Basis

3.1. Properly anonymized information is not personal data under Peruvian Law 29733, the GDPR (Recital 26), the UK GDPR, the LGPD, the CCPA/CPRA (deidentified information), the UAE PDPL, the DIFC Data Protection Law, the ADGM Data Protection Regulations and the other laws listed in section 14 of the Policy.

3.2. The anonymization process itself is processing of personal data. Habitus carries it out on the basis of its legitimate interest in improving and developing the Platform and, for emotional data, within the explicit consent you gave for its processing.

4. How We Protect Anonymity

4.1. Before treating a dataset as Structural Data, Habitus:

4.2. Habitus will not attempt to re-identify any person from Structural Data and contractually prohibits any recipient from doing so.

4.3. If a dataset stops meeting these conditions, Habitus will treat it as personal data under the Policy.

5. Permitted Uses

5.1. Habitus may use Structural Data for:

5.2. Habitus does not sell, rent or license data that identifies or could reasonably be linked to a person.

5.3. Only aggregated and anonymized results may be shared with third parties, under contracts that prohibit re-identification and combination with other data that could identify someone.

6. Intellectual Property

6.1. The aggregated databases, models, algorithms, methodologies, indicators and other results that Habitus creates from Structural Data are Habitus's intellectual property, under the Intellectual Property Document.

6.2. Your personal data remains yours. This Clause does not take away any of your rights over it.

7. International Transfers

7.1. Because it does not identify anyone, Structural Data may be stored and processed in the countries where Habitus or its providers operate, always with the measures in sections 4 and 5.

7.2. Personal data used to create Structural Data is transferred only with the safeguards in section 8 of the Policy.

8. Retention

8.1. Structural Data may be kept for as long as it is useful for the purposes in section 5, including after you delete your account, because it can no longer be linked to you.

8.2. When you delete your account, your personal data is deleted under section 10 of the Policy.

9. Your Rights

9.1. You have all the rights in the Policy over your personal data, including the data used before it is anonymized.

9.2. You can object to your personal data being used in the future to create Structural Data by writing to Joel.hernandez@habitus.finance. We will honor your objection unless the law allows us to continue.

9.3. Once data is anonymized, Habitus cannot know which part of the Structural Data comes from you. For that reason, and in accordance with applicable law, the rights of access, rectification, deletion and portability cannot be exercised over it.

International User Clause

Version: 1.0 – Global Application

Issue Date: __________

Owner: Habitus Finance S.A.C. · Tax ID (RUC) 20615971074 · Av. Ricardo Palma 982, Dpto. 702, Miraflores, Lima, Peru

1. Global Scope

1.1. This clause applies to all Users worldwide, regardless of their country of residence, nationality or location at the time of accessing the Platform.

1.2. The Platform may be accessed from any jurisdiction, and this clause governs the international legal relationship between the User and Habitus.

2. Governing Law

2.1. This Agreement is governed exclusively by the laws of the Republic of Peru.

2.2. The choice of Peruvian law is made under internationally recognized principles of contractual autonomy.

2.3. Peruvian law governs all contractual, commercial, consumer, data protection and liability matters related to the Platform, unless otherwise required by non waivable local rights.

3. Jurisdiction

3.1. Any dispute, claim or legal action arising from or related to the use of the Platform shall be resolved before the competent courts of Lima, Peru.

3.2. This jurisdiction applies even if the User resides or accesses the Platform from outside Peru.

3.3. The User expressly waives any other jurisdiction that may correspond by domicile or nationality.

4. Compatibility with Foreign Laws

Habitus complies with the international data protection, privacy, consumer protection and digital platform standards applicable to its global operation, including:

European Union

United Kingdom

United States

Latin America

Middle East

International Standards

Digital Platforms Requirements

4.2. In case of conflict between the User's local legislation and this Agreement, Peruvian law prevails, without prejudice to non waivable minimum rights granted to the User under their local laws.

5. International Transfers

5.1. The User authorizes the international transfer of Personal Data and Structural Data to any country where Habitus or its technological providers operate.

5.2. Habitus ensures equivalent levels of protection through contractual, technical and organizational safeguards aligned with GDPR, PDPL, CCPA/CPRA, DIFC and ADGM.

5.3. Structural Data, being non identifiable, is not subject to personal data transfer restrictions.

United Arab Emirates User Clause

Version: 1.0 – Global Application

Issue Date: __________

Owner: Habitus Finance S.A.C. · Tax ID (RUC) 20615971074 · Av. Ricardo Palma 982, Dpto. 702, Miraflores, Lima, Peru

1. Territorial Scope

This clause applies to Users located in:

a) The United Arab Emirates (Federal jurisdiction under PDPL).

b) Dubai International Financial Centre (DIFC).

c) Abu Dhabi Global Market (ADGM).

2. Applicable Legal Frameworks

Habitus aligns its processing activities with the following UAE data protection frameworks:

2.1. Federal UAE (PDPL)

2.2. DIFC

2.3. ADGM

3. Legal Basis for Processing

For Users located in UAE, DIFC or ADGM, Habitus processes data under the following legal bases:

a) User consent (explicit acceptance of the Privacy Policy and Informed Consent).

b) Performance of a contract (operation of the Habitus Platform).

c) Legitimate interests (security, fraud prevention, service improvement).

d) Compliance with legal obligations (when applicable).

e) Processing of anonymized Structural Data, which is outside the scope of PDPL, DIFC and ADGM.

4. User Rights Under UAE Law

Users located in UAE jurisdictions have the following rights:

a) Right of access.

b) Right to rectification.

c) Right to erasure.

d) Right to restriction of processing.

e) Right to object.

f) Right to data portability.

g) Right not to be subject to automated decision making without human review (PDPL Art. 10). h) Right to withdraw consent.

Requests must be submitted to: Joel.hernandez@habitus.finance

5. Obligations of Habitus Under UAE Law

Habitus undertakes to:

a) Implement appropriate technical and organizational security measures.

b) Maintain records of processing activities (when applicable).

c) Ensure confidentiality and integrity of data.

d) Notify Users of material changes in processing practices.

e) Ensure that processors and sub processors meet PDPL/DIFC/ADGM standards.

f) Apply valid anonymization techniques for Structural Data.

6. International Data Transfers

The User authorizes Habitus to transfer Personal Data and Structural Data outside the UAE, DIFC or ADGM.

Habitus ensures:

a) Adequate safeguards consistent with PDPL Art. 22.

b) Contractual protections equivalent to DIFC and ADGM requirements.

c) That Structural Data, being anonymized, is not subject to transfer restrictions.

7. Data Retention

Habitus retains data only for:

a) the duration of the User's account,

b) compliance with legal obligations,

c) legitimate business purposes,

d) anonymized Structural Data indefinitely (as it is non personal).

8. Automated Processing and Profiling

Habitus does not make decisions that produce legal or significant effects solely through automated processing without human involvement, in compliance with PDPL, DIFC and ADGM requirements.

9. Governing Law and Jurisdiction

Notwithstanding the above compliance obligations, the User agrees that:

a) Peruvian law exclusively governs this Agreement.

b) Any dispute shall be resolved before the courts of Lima, Peru.

c) This clause does not constitute submission to UAE jurisdiction.

10. Prevalence and Interpretation

In case of conflict between:

Habitus will: a) Apply Peruvian law for contractual matters, and b) Apply UAE/DIFC/ADGM rules only to the extent required for data protection compliance.

← Back to Habitus