Terms and Conditions

Coloca is a technology platform that allows Users to receive, send, exchange, hold and process payments without borders, as well as to access corporate cards. It is a solution that facilitates global financial operations, allowing transactions between different markets, currencies, payment methods and system participants to flow swiftly, efficiently and without friction.

Coloca has its own infrastructure and a network of strategic allies that allows it to make its services available to Users in an accessible way. The Platform is designed under a modular system that allows the Services to be configured to fit each User's operating needs, avoiding unnecessary costs and simplifying processes. In this way, Users can focus on their core activity, relying on Coloca as their technology ally.

To provide the Services, Coloca operates through local operating structures in the countries where it has a presence, or through allies, Enabled Providers and other authorized third parties, subject to the regulations applicable in each jurisdiction. The regime governing these providers and payment infrastructures is set out in Section 11.

These terms and conditions (the "T&C") govern access to, registration with, onboarding to and use of the applications, platforms, websites, APIs, products, technology tools and other services offered or made available by Coloca Group S.A.S., a company incorporated under the laws of the Republic of Colombia, with its principal domicile in Envigado, Antioquia, commercial registration No. 271906 of the Cámara de Comercio Aburrá Sur and identified with NIT (tax ID) 901.820.031-5 ("Coloca").

The involvement of an Enabled Provider in the provision of a Service does not mean that it is a branch, affiliate, subsidiary or representative of Coloca, unless expressly stated otherwise. The regime applicable to these third parties and to payment infrastructures is set out in Section 11.

The scope of the Services applicable to each User will depend, among other factors, on their model, location, risk profile, onboarding process, enabled products, Commercial Proposal, technical availability, Enabled Provider coverage and applicable regulation.

Some Services may be subject to Particular Terms, policies, fees, contracts or third-party rules. Where applicable, those documents will be disclosed to the User before activating or using the relevant Service, must be accepted where so required, and will form part of the legal relationship with respect to that Service. The order of precedence among these documents is set out in Section 29.

Nothing in these T&C limits the non-waivable rights that the law grants to Users who qualify as consumers, nor does it prevent them from turning to the competent administrative or judicial authorities. This reservation is deemed incorporated into every section of this document.

For the purposes of these T&C, the following expressions have the meaning set out below, without prejudice to other definitions incorporated in specific sections:

• Administrator · Person authorized by a Company to manage its User Account, add or remove Authorized Users, assign permissions, set limits and carry out the other actions enabled on the Platform.
• B2B · Onboarding model in which a Company uses the Services for its own operations, without offering, integrating or reselling them to its own clients or end users.
• B2B2C · Onboarding model in which a Company or Platform Client integrates, embeds or resells the Services in order to offer them to its own clients or End Users. It comprises two sub-models whose regime is set out in Section 5.1.
• Direct B2B2C · Sub-model in which each End User onboards directly with Coloca, accepts these T&C, is subject to compliance verifications, has their own User Account and acquires the status of User.
• Indirect B2B2C · Sub-model in which the Platform Client is Coloca's sole contractual User. End Users do not accept these T&C, do not have a User Account, and their legal relationship remains exclusively with the Platform Client.
• B2C · Onboarding model in which an adult natural person uses the Services for personal, family or non-business purposes.
• Authorized Channels · Means made available or recognized by Coloca to issue instructions, receive communications or manage requests, including the Platform, the Dashboard, email, support forms, APIs and other channels disclosed to the User.
• Platform Client · Company that integrates, embeds or uses the Services to support products or features offered to its own clients or End Users.
• Chargeback · Procedure by which a transaction is disputed, debited, disowned or reversed by decision of an issuer, acquirer, network, financial institution, Enabled Provider or competent authority, in accordance with their rules or applicable regulation.
• User Account · Technology profile created on the Platform to access the enabled Services. It does not in itself constitute a bank account, deposit, savings product or deposit-taking instrument.
• Dashboard · Module of the Platform through which the User consults their transactions, Operating Balances, pockets, Fees, statuses, receipts and reports online, and downloads the available operating information.
• Dispute · Claim relating to an Order, transaction, Refund, Reversal, Chargeback, balance, Fee or any other aspect of the Services.
• Issuer · Authorized Enabled Provider that issues and manages the Cards in accordance with the rules of its program and of the corresponding franchise or payment network.
• Company · Legal entity, autonomous estate, establishment, organization or natural person acting for business or professional purposes that onboards to the Services.
• Funds · Monetary resources in respect of which the User issues an Order or which are the subject of a Service. The term does not imply that Coloca owns them, holds financial custody of them, or may freely dispose of them.
• Mandate · Engagement conferred on Coloca to carry out the acts described in these T&C, in the Commercial Proposal or in the instructions issued through the Authorized Channels. The identification of the principal is set out in Section 9.
• Order · Instruction issued by the User, their Administrator or an Authorized User to execute a transaction or use a Service. In B2B2C models, the attribution rule set out in Section 10 applies.
• Cross-Border Payment · Transaction in which the origin, destination, provider, currency, beneficiary or payment infrastructure is in a different jurisdiction or requires the involvement of Enabled Providers in more than one country.
• Platform · Coloca's technology infrastructure, including applications, websites, the Dashboard, APIs, interfaces and other channels enabled to access the Services.
• Data Policy · Coloca's Personal Data Processing Policy, in force and available on its website and through the Authorized Channels.
• Commercial Proposal · Document, offer, service order, quote, plan, activation form or agreement accepted by a Company setting out particular, economic or operating conditions.
• Enabled Provider · Third party involved in the provision, processing, settlement, support or availability of one or more Services, including financial institutions, Issuers, acquirers, processors, payment networks, correspondents and technology or currency-conversion providers.
• Refund · Total or partial return of an amount associated with a transaction, initiated by the User, a merchant, a beneficiary, Coloca or an Enabled Provider, as applicable.
• Reserve · Amount temporarily withheld or set aside to cover risks, obligations, Chargebacks, Refunds, Disputes, negative balances, costs or contingencies associated with the Services, in accordance with Section 19.2.
• Reversal · Return or cancellation of a transaction where permitted by law, by the processing status, by the Enabled Provider or by the applicable rules.
• Operating Balance · Informational or accounting record shown on the Dashboard in respect of available, in-transit, withheld or pending-settlement resources.
• Services · Features offered or enabled by Coloca, directly or with the support of Enabled Providers, in accordance with these T&C.
• Fee · Price, commission, cost, margin, spread, expense or charge applicable to a Service.
• Card · Physical, virtual or tokenized payment instrument issued and managed by an Issuer, which the User may access through the Platform when the product is enabled.
• Cardholder · Natural person authorized by the Issuer to use a Card, in accordance with the rules of the corresponding program.
• Particular Terms · Specific conditions of a Service, program, campaign or product that Coloca discloses to the User before activation and that supplement these T&C with respect to that Service.
• User · Natural person or Company that completes the onboarding process defined by Coloca, accepts these T&C and accesses the Services enabled in their User Account. Actual use of a Coloca feature through a Platform Client does not by itself confer User status, except under the Direct B2B2C sub-model.
• Authorized User · Natural person empowered by a Company or Administrator to access the User Account and carry out the actions permitted by their assigned role.
• End User · Client, user or final recipient of a Platform Client who accesses products or features supported by the Services. They acquire User status only where the Direct B2B2C sub-model applies.

4.1. Stages of the relationship

Reading, understanding and accepting these T&C are indispensable requirements to begin registration on the Platform. The relationship is structured in four successive stages:

1. 01Registration. From the moment the interested party begins the process, the onboarding conditions apply to them and they grant the data processing authorizations necessary to carry it out. Registration does not create any obligation for Coloca.
2. 02Acceptance. These T&C will be binding from the moment the User completes their acceptance through a reliable mechanism in accordance with Section 4.2. Once accepted, Coloca will enable the User Account and access to the Platform, without this implying the activation of any Service.
3. 03Approval. The actual provision of the Services is subject to Coloca satisfactorily approving the applicable compliance, risk and know-your-customer verifications. Coloca reserves the right to accept or reject any onboarding request; rejection will constitute grounds for immediate termination under Section 24.1, without generating any liability for Coloca.
4. 04Activation. Once the User is approved, Coloca will activate only the Services actually requested, accepted and contracted.

The User declares that, before accepting, they had the opportunity to read, consult, download and retain these T&C and the documents incorporated by reference. Where acting on behalf of a Company, they declare that they have sufficient authority to bind it.

4.2. Acceptance mechanism and evidence

Acceptance may be perfected by means of an acceptance checkbox, OTP code, biometric validation, electronic signature, corporate authentication, acceptance via API or another mechanism that is reliable and appropriate for the operation, in accordance with Law 527 of 1999 and other applicable rules on data messages and electronic signatures.

Coloca will retain evidence of acceptance, including the identity of the accepting party, the date and time, the version accepted, the IP address, the device used and the outcome of the authentication mechanism employed. These records may be used to evidence the existence, content and scope of the legal relationship.

4.3. Onboarding, eligibility and right of admission

To use the Services, the User must complete the onboarding process defined by Coloca and provide complete, accurate, verifiable and up-to-date information, which may include identification and contact details, economic activity, representation, shareholding structure, ultimate beneficial owners, tax status, financial information, source and destination of funds, and supporting documentation for transactions.

B2C Users must be natural persons over eighteen (18) years of age with full legal capacity. Coloca may verify age and capacity at any time.

Coloca may verify information directly or through third parties, consult public or private sources, request additional documents, perform biometric or technological validations and apply know-your-customer, know-your-business, fraud prevention and risk management procedures, including after activation.

Where the User acts on behalf of a Company, verification may extend to its existence and representation, directors, shareholders, ultimate beneficial owners, controlling parties and Authorized Users.

Coloca may approve, condition, defer or reject an onboarding or the activation of a Service based on legal, regulatory, contractual, technical, operational, commercial or risk criteria; definitive rejection of onboarding is subject to Section 24.1. Unless the law provides otherwise, Coloca is not obliged to disclose internal methodologies, monitoring results, reports subject to confidentiality, or reasons whose disclosure could affect compliance or security controls.

The User must update their information when it changes or when Coloca so requests. Failure to update, the impossibility of verifying it, or the existence of inconsistencies may result in limits, rejection of transactions, suspension or termination.

4.4. Amendments

Coloca may amend these T&C. Any amendment will be published on the official website and on the Platform, and material changes will be communicated through the Authorized Channels with reasonable advance notice, unless they must be applied immediately by legal mandate, requirement of an authority, security, fraud prevention or decision of an Enabled Provider. The applicable conditions will always be those of the latest version in force, and use of the Services after it takes effect will constitute acceptance.

A B2C User who does not accept an amendment may close their User Account at any time, freely, immediately and without penalty. For B2B and B2B2C Users, disagreement does not enable immediate termination: the User must communicate it to legal@colocapayments.com and the parties will have thirty (30) calendar days to review alternatives; failing agreement, termination will require sixty (60) calendar days' prior notice, during which the conditions in force before the rejected amendment will be maintained.

The general provisions apply to all Users. The rules on APIs, Commercial Proposal, Authorized Users, Reserves, corporate reconciliation, commercial confidentiality and guarantees apply exclusively to Companies or to those using the corresponding Service.

The powers of whoever onboards a Company are declared in accordance with Section 6.2, and the designation, permissions and revocation of Administrators and Authorized Users are governed by Section 16.

5.1. Sub-models of the B2B2C model

The B2B2C model admits two sub-models with different legal consequences. The Commercial Proposal will expressly indicate which one applies to each integration. In the absence of an express indication, the Indirect B2B2C model will be deemed applicable.

Under both sub-models, the Platform Client must inform its End Users about the involvement of Coloca and of the Enabled Providers, in accordance with the declarations in Section 6.2. The relationship between the Platform Client and its End Users will not make Coloca a party to their contracts, except under the Direct B2B2C model or by express stipulation.

6.1. Natural person Users (B2C)

When requesting or using the Services, the natural person User represents and warrants that:

1. 01They are of legal age, have full legal capacity to contract, and are aware that the version of these T&C in force is published on Coloca’s website.
2. 02They have read, understood and accepted how the business model works, the Platform tools and the Data Policy.
3. 03The Funds and transactions have a lawful origin, destination and purpose, and they will not use the Platform for illegal activities or for those expressly prohibited in Section 13.
4. 04The information provided is true, complete and verifiable, and will be kept up to date.
5. 05They are not subject to sanctions or restrictions that legally prevent their onboarding.
6. 06The authorizations, mandates and consents granted will remain in force for as long as the relationship subsists.

6.2. Company Users (B2B and B2B2C)

In addition to the above where applicable, the Company represents and warrants that:

1. 01It has the legal capacity and the necessary authorizations or powers of representation to onboard, and that acceptance of these T&C constitutes a valid, binding and enforceable obligation on it.
2. 02It carries out lawful commercial activities that are not restricted by Coloca, and that the resources channelled come from legitimate sources.
3. 03Acceptance of and compliance with these T&C do not conflict with its bylaws, internal authorizations or other contracts or obligations to which it is subject.
4. 04It will identify its ultimate beneficial owners and will be responsible for the Administrators and Authorized Users it designates.
5. 05In B2B2C or resale schemes, it performs the mandatory know-your-customer and know-your-business (KYC/KYB) procedures and identification of ultimate beneficial owners in respect of its End Users.
6. 06In B2B2C or resale schemes, it informs its End Users about Coloca’s involvement, includes or makes available in its own contracts and platforms Coloca’s rules and conditions —including the use restrictions in Section 13— and ensures that its End Users know and comply with them.
7. 07In B2B2C or resale schemes, its data processing policies expressly authorize the transmission, transfer and disclosure of data to allied third parties, processors or controllers such as Coloca, and it has the necessary powers or legal bases to provide Coloca with third-party personal data, in accordance with Section 25.
8. 08Under the Indirect B2B2C model, it is answerable to Coloca for its End Users, including the validity and traceability of the instructions they originate and the handling of their claims.

The above representations are deemed repeated throughout the relationship. The User must immediately report if any of them ceases to be true.

Coloca provides technology infrastructure to facilitate the management and execution of payment transactions and related services. Depending on the Service, it may act as the User's agent under mandate, technology integrator, access channel, operations coordinator or technical intermediary between the User and one or more Enabled Providers.

Coloca is not a banking institution merely by offering the Platform, nor does the User Account constitute a bank account, deposit or savings product. Coloca may not use the Funds for purposes other than executing authorized instructions, meeting obligations associated with the Services or complying with the law.

The Dashboard may display Operating Balances, movements and transaction statuses, but these records do not alter the legal ownership of the Funds or the role of the provider involved in the transaction. Operating Balances do not accrue interest, yield or any remuneration in favour of the User, unless expressly agreed in the Commercial Proposal.

Coloca does not provide financial, foreign-exchange, tax, legal, accounting or investment advice. The information on the Platform is for operational purposes and does not constitute a recommendation to carry out a transaction.

7.1. Coloca's obligations

In providing the Services, Coloca undertakes to:

1. 01Deploy its best technical and commercial efforts to keep the Platform available and functional, giving reasonable advance notice of scheduled maintenance or technical interruptions.
2. 02Execute Orders in accordance with the information provided and with the standards described in these T&C and other applicable documents.
3. 03Process or coordinate, according to the applicable route, the crediting or transfer of Funds arising from authorized and validated transactions, within the agreed times and conditions.
4. 04Provide clear information on the transactions processed and keep a transaction history available through the Dashboard.
5. 05Implement reasonable information security measures and process personal data in accordance with applicable law and the Data Policy.
6. 06Maintain visibility of the Fees, exchange rates or margins applicable to transactions.
7. 07Make Authorized Channels available to handle enquiries, requests, complaints and technical incidents.

7.2. User obligations

By accessing, registering with or using the Services, the User undertakes to:

1. 01Provide real, accurate, complete and verifiable information during onboarding, and update it upon any relevant, structural, legal or corporate change.
2. 02Safeguard their credentials and authentication factors in accordance with Section 15, assuming responsibility for the transactions carried out from their User Account.
3. 03Use the Platform only for lawful purposes, respecting activity and jurisdiction restrictions and anti-money laundering and counter-terrorist financing rules.
4. 04Pay applicable Fees and taxes on time, and bear the amounts arising from Chargebacks, Reversals, Disputes or negative balances.
5. 05Grant, increase or replace the guarantees required under Section 19, where applicable.
6. 06Inform Coloca immediately of unauthorized access, security failures, identity theft or suspicious transactions.
7. 07Assume their tax, foreign-exchange and customs obligations exclusively.
8. 08Comply with the other obligations described in these T&C.

The Services described in this Section adapt and vary in scope according to the User's onboarding model, their profile on the Platform and the architecture of the contracted business model (B2C, B2B or B2B2C). They may be provided individually or in combination and be available via API, web, mobile application and other Authorized Channels.

8.1. Collection and disbursement

Coloca makes available to the User funds collection and payment disbursement services through the local or cross-border payment networks, rails and infrastructures described in Section 11, and through the other payment methods disclosed and updated through the Platform.

Coloca's operating model and its regulatory classification depend on the jurisdiction: in Colombia, Coloca operates as a Low-Value Payment Services Provider where this corresponds to its operating model and to the applicable regulatory framework. In other jurisdictions it will provide the Services as permitted by each country's regulation, in accordance with Section 2.

Nothing in these T&C may be interpreted as a statement that Coloca holds licences, authorizations or financial permissions other than those it actually holds in each jurisdiction, nor as an offer of services reserved to supervised entities.

By accepting these T&C, the principal identified in accordance with Section 9 confers on Coloca the mandate described therein to receive the funds arising from transactions processed through the authorized payment methods and to execute their disbursement to the indicated recipients.

Coloca will only execute disbursement orders to bank accounts, electronic deposits or payment products that the User has previously registered, validated and designated on the Platform. Collection and disbursement may be carried out in the agreed currencies or through any other enabled payment method.

This Service may be enabled for the B2C, B2B and B2B2C models. Ownership of the Funds, the person empowered to issue Orders, the scope of the mandate and liability towards End Users will be determined according to the applicable model and the Commercial Proposal.

8.2. Cross-Border Payments

Where the Service is enabled, Coloca may coordinate the execution of Cross-Border Payments with the involvement of the Enabled Providers described in Section 11. The specific route will be determined by Coloca based on availability, cost, timing and regulatory conditions, and may vary without materially altering the User's rights.

Cross-Border Payments may be subject to additional information requirements regarding the originator and beneficiary, foreign-exchange controls, per-jurisdiction limits, withholdings, enhanced compliance verifications and longer processing times than a domestic transaction. The User must supply the information and supporting documents required by each jurisdiction involved. Where the transaction involves currency conversion, Section 8.3 will additionally apply.

8.3. Exchange (currency conversion)

Coloca facilitates currency conversion through the Platform. This Service is executed by Enabled Providers that hold the licences, registrations and authorizations required in their jurisdiction.

For B2C Users, the economic conditions, Fees and exchange rate will be disclosed on the Platform before confirming each transaction. For B2B and B2B2C Users, the fee scheme and conditions will be governed by the accepted Commercial Proposal.

Exchange rates fluctuate with the market. Once a conversion order is confirmed, the transaction will be final, firm and irreversible, applying the rate quoted and accepted at the exact moment of confirmation.

Exchange transactions are subject to the limits defined on the Platform and in Coloca's compliance policies. Coloca and the Enabled Providers may deny, restrict, suspend or condition a transaction where the amount, frequency or nature is not consistent with the User's transactional or risk profile, or where it does not pass compliance validations. For B2B and B2B2C models, provision may be conditioned on the constitution of the guarantees described in Section 19.

8.4. Pockets

The User may create and segment virtual pockets within the Platform to organize and allocate their Funds according to their operating needs. Pockets correspond exclusively to a virtual accounting and administrative record reflected on the Dashboard, with the nature described in Section 7. The consultation and reconciliation of balances, movements and reports is governed by Section 17.

8.5. Bulk disbursements

Where the Service is enabled, the User may upload and execute disbursement batches grouping multiple Orders in a single submission, through the files, formats or API calls that Coloca defines.

The User is responsible for the integrity, accuracy and completeness of each record included in the batch. Technical validation of the file by the Platform does not imply validation of the business information or of the identity of the beneficiaries.

Each record constitutes an independent Order and may be accepted, rejected, held or reversed individually; the rejection of one or several does not affect the validity of the others. The individual outcome will be available on the Dashboard. Coloca may set limits per batch, record, time window or risk profile, and require prior provision of Funds or guarantees in accordance with Section 19.

8.6. Integration and services via API

Where the Service is enabled, Coloca will make available to the User programming interfaces (APIs), access keys, test environments, webhooks and technical documentation that allow Orders to be originated, statuses queried, transactions reconciled and products managed in an automated way.

Use of the APIs constitutes a Service and not merely a technical means of access; the rules on Orders, Fees, security, compliance, availability and liability in these T&C apply to it. Keys, tokens and credentials are personal, non-transferable and under the User's exclusive custody.

The User must follow the technical documentation and manuals provided by Coloca and keep their systems and integrations adapted to the updates or new API versions that Coloca notifies. The developments, adaptations and technical configurations required in their own systems are their exclusive responsibility. Coloca may version, update, limit or discontinue features by giving reasonable advance notice, unless an immediate measure is warranted on the grounds set out in Section 4.4.

8.7. Coloca Rewards

Where this Service is enabled, Coloca may offer incentive, reward or benefit programs associated with the use of certain Services, in accordance with Section 21.

8.8. Access to Cards

Where this Service is enabled, Coloca provides Users onboarded under any of the models with access to Cards denominated in the currency of the corresponding issuing program and structured in accordance with that program's funding scheme, as a payment tool for their operational and financial administration.

The Cards are issued and managed by an Issuer. Coloca acts as a technology channel, integrator, distributor or commercialization channel, and not as issuer. The applicable regime is set out in Section 20.

8.9. Modular activation

Only the sections corresponding to the Services that the User has requested, accepted and actually enabled on the Platform will apply to them.

For Services that require the execution of instructions, the principal confers on Coloca a specific mandate, remunerated where a Fee exists, to act on the principal's account within the limits of each Order. The mandate is deemed conferred without representation, unless the Commercial Proposal expressly states otherwise; accordingly, Coloca acts in its own name and on the principal's account vis-à-vis the Enabled Providers, without this altering the legal ownership of the Funds.

9.1. Identification of the principal

The person conferring the mandate is determined according to the onboarding model:

1. 01Under B2C, the principal is the natural person holding the User Account.
2. 02Under B2B, the principal is the Company, acting through its Administrators and Authorized Users.
3. 03Under Indirect B2B2C, the principal is exclusively the Platform Client. In issuing Orders it represents and warrants that it has sufficient authorization, powers or legal basis from its End Users to order the transactions, and is answerable to Coloca for that representation. The End User confers no mandate on Coloca.
4. 04Under Direct B2B2C, the principal is the End User onboarded directly with Coloca, in respect of the transactions they themselves order.

9.2. Scope of the mandate

The mandate may comprise, according to the enabled Service: receiving, validating and transmitting Orders; coordinating the collection, receipt, conversion, clearing, settlement or disbursement of Funds through Enabled Providers; supplying those providers with the information necessary to execute the Order and comply with legal obligations; making authorized deductions for Fees, taxes, Refunds, Chargebacks, Reserves, negative balances or other enforceable obligations; and carrying out the ancillary acts reasonably necessary to fulfil the instruction.

Coloca may not allocate the Funds to purposes other than those authorized, nor materially depart from the Order, unless necessary to comply with the law, protect the principal, prevent fraud, respond to an authority or apply mandatory rules of an Enabled Provider. Execution of the mandate through Enabled Providers does not release Coloca from liability for its own acts or omissions or for duties it may not legally delegate.

Each Order will constitute a specific instruction. The mandate will remain in force for as long as there is an active User Account, a pending transaction or an obligation requiring its execution. Its termination will not affect acts already carried out, firm Orders, Reserves, Disputes or pending obligations.

Orders must be issued through the Authorized Channels and meet the applicable technical, documentary, authentication and availability requirements.

Under the Indirect B2B2C model, instructions generated by an End User through the Platform Client's channels will be considered Orders of the Platform Client only where the latter has implemented the authentication, authorization and traceability mechanisms approved by Coloca. Under the Direct B2B2C model, authenticated instructions attributable to the End User will constitute Orders of that End User, regardless of whether they are issued through their User Account or through a Platform Client interface authorized by Coloca.

Whoever issues the Order must carefully review the data before confirming, including amount, currency, beneficiary, destination, concept, rate and Fee. Coloca will not be liable for errors attributable exclusively to the User where the Order was executed in accordance with the information provided; nevertheless, it will provide reasonable cooperation to attempt recovery where possible, with the applicable costs.

An Order may pass through statuses such as received, pending, under validation, processed, sent, settled, rejected, cancelled, reversed or held; the names visible on the Dashboard may vary without altering their legal nature. Receipt of an Order does not guarantee its execution: Coloca or an Enabled Provider may reject or hold it due to incomplete information, lack of Funds, limits, unavailability, error, risk, fraud, compliance, requirement of an authority or technical impossibility.

An Order will be firm once it has been processed or transmitted to an Enabled Provider in such a way that its cancellation is no longer possible; before that moment Coloca may attempt to cancel it, without guaranteeing the outcome. The times disclosed are estimates, unless expressly committed otherwise, and may vary due to schedules, non-business days, controls, intermediaries, jurisdictions, networks or events beyond Coloca's reasonable control.

This Section consolidates the regime applicable to the third parties and infrastructures involved in providing the Services, and is deemed applicable to all other sections of these T&C.

To provide the Services, Coloca may integrate with Enabled Providers and with local or international payment systems, networks or rails, including, by way of example and without limitation, instant payment systems, electronic payment mechanisms, bank transfers and card networks. These references are illustrative and do not imply that an infrastructure is enabled for all Users, products or countries.

Local instant and immediate payment rails are administered and operated exclusively by the monetary authorities or central banks of each country. This condition applies equally to any other service, network or infrastructure that depends on third parties outside Coloca.

Coloca may change, add or withdraw providers, methods or routes where this does not materially alter the User's rights or where necessary for technical, commercial, legal, regulatory, security or continuity reasons. Enabled Providers may require verifications, limits, documents, schedules, usage rules, particular terms and fraud prevention measures, which will be disclosed to the User before using the corresponding Service and which the User undertakes to comply with.

Coloca's liability for delays, intermittency, failures or operating decisions attributable exclusively to an Enabled Provider, rail, network or infrastructure is governed by Section 27.

For B2C Users, the Fees, commissions and processing costs will be those published and clearly displayed on the Platform before confirming each transaction. Coloca does not charge hidden commissions, costs or fees. For B2B and B2B2C Users, the financial conditions and charging schemes will be governed by the accepted Commercial Proposal, and will be settled at the time, in the manner and with the frequency described therein.

Fees may vary according to Service, amount, currency, method, jurisdiction, profile, provider and market conditions. Where there is currency conversion, the price may include a base rate and a margin or spread. Costs of networks, financial institutions, intermediaries, taxes or other third parties may be charged additionally where they have been disclosed or cannot be determined in advance because they depend on a third party.

The User authorizes Coloca to deduct or set off against the Funds or balances in their favour the due and payable obligations associated with the Services —Fees, taxes, Refunds, Chargebacks, Reserves, network fines, recovery costs and negative balances—, settling the resulting net amount, provided there is a contractual or legal basis and reasonable information is provided about the item.

Each party will be responsible for its own tax obligations. Coloca may apply the withholdings legally incumbent on it in its capacity as withholding agent and will issue the corresponding certificates in accordance with the rules in force. The User will provide their tax details and electronic invoicing status in a timely manner.

Coloca may update its fee schemes. For B2C Users, changes will be reflected on the Platform and will apply to future transactions; for B2B and B2B2C Users, they will be notified with the advance notice agreed in the Commercial Proposal, in accordance with Section 4.4.

13.1. Restricted activities

The User will use the Services only for lawful, legitimate purposes compatible with their onboarding. It is prohibited to use, attempt to use or allow the use of the Services for:

1. 01Money laundering, terrorist financing, weapons proliferation, corruption, bribery, fraud, human trafficking or other unlawful activities, as well as transactions intended to conceal the true originator, beneficiary, holder, source or destination of the Funds.
2. 02Mass and habitual deposit-taking of resources, bank deposits or public funds without the corresponding financial licences, nor intermediation, money transmission, financial services or regulated activities without the required authorizations.
3. 03Marketing, distribution or trafficking of illegal drugs, narcotics, psychotropic substances, "miracle" products or restricted-use medicines not authorized by the competent health authority.
4. 04Operation of betting, casinos, lotteries, online gambling or sports pools without local regulatory licences and authorizations.
5. 05Marketing of pornographic material or adult-content entertainment services.
6. 06Any activity linked to the commercial sexual exploitation of children and adolescents, child pornography, human trafficking or sex tourism.
7. 07Manufacture, marketing, brokerage, import or export of firearms, ammunition or explosives, except by legally empowered State entities.
8. 08Unregulated extraction, marketing or processing of precious metals, precious or semi-precious stones and metallic minerals without the legal and environmental titles and permits required; illegal mining; and trafficking of wild flora and fauna.
9. 09Pyramid schemes, Ponzi schemes, investment fraud, impersonation, phishing, ransomware, cyberattacks or system abuse.
10. 10Unauthorized debt collection services, collection agencies or credit repair services.
11. 11Donations or crowdfunding campaigns by persons or entities that do not demonstrate their proper incorporation and registration.
12. 12Marketing of counterfeit goods, protected species or other illegal goods or services, and infringement of intellectual property, privacy, data protection or third-party rights.
13. 13Structuring, triangulation, simulation or any practice intended to circumvent limits, controls, Fees or reviews.
14. 14Automated access, scraping, reverse engineering, vulnerability testing or interference with the Platform without authorization; and the sale, assignment, rental or making available of the User Account, credentials or API to unauthorized third parties.
15. 15Any other activity prohibited or classified as a criminal offence in the regulatory frameworks of the countries where Coloca operates, or determined to be of unacceptable risk by Coloca’s compliance team, the payment networks or the partner banks, which will be communicated to Users as appropriate.

13.2. Restricted countries and territories

Coloca will not provide Services, process transactions or permit the onboarding of persons or entities associated with the jurisdictions included in its Restricted Jurisdictions Policy.

The inclusion of a jurisdiction may be due, among other factors, to sanctions, risk classifications, regulatory requirements, Enabled Provider conditions or decisions arising from Coloca's risk appetite. These categories are not equivalent to one another: they comprise jurisdictions subject to an FATF call for action or increased monitoring, jurisdictions subject to comprehensive or targeted sanctions programs of OFAC, the United Nations or other competent bodies, territories under international embargo, and jurisdictions restricted by Coloca's own commercial decision.

By way of indication and without being exhaustive, as at the date of these T&C the list comprises: North Korea, Iran, Syria, Cuba, Burma (Myanmar), Russia, Belarus, Sudan, Somalia, Yemen and Afghanistan. The policy will also include territories flagged through fraud alerts or communications from competent authorities, even where the list has not been formally updated. The list in force will be kept available through the Platform and the Authorized Channels.

Coloca may monitor the use of the Services and request information or documents before, during or after a transaction in order to comply with legal obligations, manage risk, prevent fraud, respond to Enabled Provider requirements or verify consistency with the User's profile.

The User must respond fully and promptly within the reasonable deadlines that Coloca sets according to the urgency and nature of the request. Failure to respond, or an insufficient or inconsistent response, may result in rejection, holding, limitation, suspension or termination.

Coloca may apply enhanced due diligence to higher-risk transactions, sectors, jurisdictions or persons, as well as differentiated limits according to the level of verification. Where the law permits or requires it, Coloca may share information with authorities, Enabled Providers, auditors, advisers and third parties responsible for compliance or security, without being obliged to disclose reports, alerts, investigations or communications subject to confidentiality.

The User must safeguard their credentials, passwords, codes, API keys, devices, tokens and authentication factors. They must not share them, reuse them insecurely or allow access by unauthorized persons.

Actions carried out using valid credentials and authentication controls will be presumed authorized and binding. This presumption admits evidence to the contrary and does not exclude Coloca's liability for its own failures, fraud or events not attributable to the User.

The User must immediately report the loss, exposure or misuse of credentials, devices or keys, an unrecognized transaction or any incident affecting the User Account. Coloca may block access, rotate credentials, suspend Orders or require additional verifications, and will adopt the reasonable measures within its reach to attempt to stop, recover or reverse a reported transaction.

Companies must implement adequate controls for their integrations, including secrets management, environment segregation, least-privilege permissions, logging, monitoring, system updates and incident response plans. Coloca will apply reasonable security measures appropriate to the nature of the Services, without guaranteeing that the Platform is immune to every threat.

A Company may designate one or more Administrators and Authorized Users, assigning them roles, permissions, amounts, products and restrictions. Coloca may establish predefined profiles or approval tools subject to availability.

The Company will be responsible for verifying the identity, employment relationship and powers of each designated person; keeping permissions up to date and revoking them when they are no longer necessary; periodically reviewing access, limits and transactions; immediately reporting departures, role changes, conflicts or incidents; and ensuring that its users know and comply with these T&C.

Instructions issued within current permissions will bind the Company, unless they result from a failure attributable to Coloca. Revocation will take effect once Coloca receives and processes it; transactions initiated beforehand may continue if they are already firm or cannot be cancelled. Coloca may preventively block an Authorized User without suspending the entire User Account where this is a sufficient and proportionate measure.

The Platform includes a Dashboard through which the User can consult their transactions, Operating Balances, Fees, statuses, receipts and reports online. The User must review and reconcile them on an ongoing basis against their own records. Coloca may additionally send confirmations of each transaction and periodic reports to the registered contact channel, without this replacing the User's duty to reconcile.

The User will report any inconsistency through the Authorized Channels within a reasonable period from when they know or ought to know of it, without prejudice to the particular period provided for Cards in Section 20.7. Failure to give notice will not extinguish non-derogable rights, but may affect the possibility of investigating or recovering a transaction once third-party deadlines have expired.

Coloca's technological and accounting records constitute evidence of transactions and admit evidence to the contrary. In the event of a discrepancy, Coloca will review the available information, including Enabled Provider records, authentication traces and User supporting documents. Coloca may correct manifest errors, duplicates or records that do not correspond to Funds actually received, reporting the adjustment.

Coloca may communicate through the Authorized Channels, including notifications on the Platform, email, messages to the registered number, support forms or notices on its website. The User must keep their contact details up to date and periodically review communications. A communication will be deemed received when sent to the registered channel or made available on the Platform, unless there is evidence of error or a different legal rule.

Data messages, electronic records, logs, authentications, receipts and digital documents will be admissible as evidence under the law. The User may request a copy of the version accepted and of the available supporting records of their transactions.

Refunds, Reversals, Chargebacks and Disputes will be handled in accordance with the law, the type of transaction, its status, the rules of the Enabled Providers and this Section.

18.1. Request

The User must submit their request through the Authorized Channels as soon as they become aware of the event and within the applicable deadlines, identifying the transaction, setting out the grounds and providing the information or documents reasonably required. Coloca may request additional supporting documents and share them with the provider in charge. Receipt of a request does not guarantee a favourable outcome.

18.2. Refunds and Reversals

A Refund will be subject to the availability of Funds, the status of the transaction, the authorization of the competent party, the rules of the payment method and the applicable costs. Coloca may deduct its amount from resources pending settlement or require it to be provisioned in advance.

A transaction may be reversed where required by law, where it has not been definitively executed, where there is proven error, where the Enabled Provider permits it or where another applicable ground applies. Firm transactions may not be cancelled at the User's sole discretion.

18.3. Chargebacks

The User acknowledges that certain payments may be subject to a Chargeback for fraud, unauthorized transaction, breach, duplication, error or other grounds established by law or by the networks. Coloca may debit or set off a Chargeback, together with the associated costs, where it is attributable to the User or their activity; before or after the debit, according to the urgency and the provider's rules, it will supply reasonable information about the case and allow evidence to be provided within the available period.

If the Funds are insufficient, an enforceable negative balance will arise. Coloca may apply Reserves, suspend settlements or request payment, without prejudice to the User's right to contest the Chargeback.

18.4. Decision and cooperation

Coloca will report the status or outcome where it is available and the law permits. The User will cooperate in good faith, retain supporting documents and not submit duplicate or fraudulent claims. Disputes associated with Card transactions will be handled in accordance with Section 20.7, in addition to the program's Particular Terms, the Issuer's terms and the network rules.

Given the nature, transaction volume, foreign-exchange volatility, international disbursement or settlement risks inherent to B2B or B2B2C operations, the provisions of this Section apply exclusively to Companies onboarded under the B2B or B2B2C models, or to operating models classified as higher risk by Coloca, and in no case to Users who qualify as consumers.

19.1. Guarantees

Only where Coloca's risk team requires it based on ongoing exposure and solvency assessments, the Company must constitute, grant and maintain in Coloca's favour the backing mechanisms required to guarantee the fulfilment of its financial, operational and contractual obligations. Such mechanisms will be documented in the Commercial Proposal or in an annex accepted by the Company, and may consist of retention rights over Funds or transaction flows, collateral and liquidity reserves, financial hedges, in-rem or movable guarantees, pledges of shares, assets or credit rights, or any other agreed backing instrument.

If Coloca determines, based on periodic risk reviews, increased exposure or exchange-rate fluctuations, that the coverage is insufficient or has deteriorated, it may require additional guarantees within the period granted. Failure to constitute them, insufficiency of assets or unremedied deterioration will entitle Coloca to suspend the enabled transactions, quotas or lines, terminate the Services early and declare the enforceable obligations due and payable.

19.2. Reserves and withholdings

Where there is a reasonable risk of Chargebacks, Refunds, fraud, breach, operational volatility, settlement or exposure to third parties, Coloca may establish a Reserve where the Service or the Company's risk profile justifies it.

The Reserve may consist of a fixed amount, a percentage, a temporary withholding, a minimum balance or a scheme agreed in the Commercial Proposal. Its amount and duration must bear a relationship to the estimated risk and may be reviewed periodically. Coloca will inform the Company of its existence and, where possible, of its general criteria, amount or method and release conditions, and may use it exclusively for obligations associated with the Services.

If the risk decreases and there are no pending obligations, Coloca will release the Reserve within a reasonable period, subject to settlement cycles, Disputes and provider rules.

19.3. Negative balances

A negative balance must be covered by the User within the period disclosed. Coloca may set it off against present or future Funds, suspend Services, disable the associated transaction codes and exercise reasonable collection mechanisms, including charging default interest at the maximum rate permitted by law and passing on to the User the reasonable costs, expenses and fees of pre-judicial or judicial collection.

This Section contains the general regime applicable to the Cards that the User accesses through the Platform. The functional scope of the Service is described in Section 8.8.

20.1. Particular Terms of the program

The conditions of each Card program —Issuer, country, currency, franchise or network, funding scheme, limits, available features, dispute deadlines, commissions, blocking grounds and liabilities— may differ between programs and will be established in Particular Terms, which will be disclosed to the User and the Cardholder at the time of activating the Service in accordance with Section 2.

20.2. Issuer and scope of Coloca's involvement

Where the Service is available, Coloca may facilitate the request, configuration, display and initial support of Cards issued by an authorized Issuer. The identity of the Issuer may vary by program, country, network or availability, and will be disclosed in the Particular Terms.

Coloca acts as a technology channel, integrator, distributor or commercialization channel, and not as issuer, unless expressly stated and where it holds the corresponding authorization. The Issuer will determine eligibility, issuance, ownership, activation, authorization, settlement, blocking, replacement, cancellation and Dispute resolution.

Before issuance or activation, the applicant and the Cardholder must accept the Issuer's terms, policies and authorizations, in accordance with Section 28. The issuance, operation and use of the Cards are subject to the policies, regulations and operating rules of the corresponding franchise or payment network, which the User and the Cardholders must observe.

20.3. Assignment, Cardholders and powers

Card assignment depends on the onboarding model:

1. 01Under B2C and Direct B2B2C, the Card may be assigned directly to the natural person User onboarded with Coloca, who will hold the status of Cardholder.
2. 02Under B2B and Indirect B2B2C, the Card must be assigned and linked nominatively and individually to a natural person authorized by the Company or by the Platform Client (staff member, director, employee or designated representative), subject to the program rules.

The User will be responsible for verifying the identity of the Cardholders, determining their powers or usage limits and promptly requesting the corresponding blocks. Legal ownership and liabilities will be determined in accordance with the Particular Terms and the Issuer's rules. The Cardholder must safeguard the Card, credentials, PIN, devices and tokens, immediately report loss, theft, cloning or unauthorized use, and use it only for permitted purposes.

20.4. Limits, controls and tokenization

Where the program permits, the User may configure or request spending limits, transactional parameters and merchant-type restrictions through the Platform. Coloca or the Issuer may deny transactions that exceed those limits or that are attempted at restricted merchants.

Where the issuing program and the wallet provider permit, the Cards may include tokenization features for integration into third-party digital wallets, subject to the terms and policies of those external providers. The availability of this feature is not guaranteed, will be disclosed in the Particular Terms, and Coloca does not control its continuity.

20.5. Ownership of the Funds

Coloca is not, and will not be considered, the owner or depositary of the Funds managed or transacted through the Cards. Ownership, provisioning and custody of the resources correspond to the User or the Issuer, according to the program's operating architecture.

20.6. Loss, theft, fraud and blocking

In the event of loss, theft or misplacement of the Card or of the device on which it is tokenized, or upon suspicion that tokens or access data have been compromised, the User or the Cardholder must immediately proceed to block or unlink it through the Platform or the means disclosed by Coloca.

Coloca may receive reports and transmit them to the Issuer. The block will take effect once processed by the corresponding infrastructure. The User will assume responsibility for transactions executed before formal notification or reporting; however, prior transactions may be the subject of a Dispute in accordance with the law, the Particular Terms and the Issuer's terms, and will not be automatically assigned to the User where there is fraud not attributable to them.

Coloca and the Issuer retain the power to suspend, deactivate or preventively cancel any Card where they detect atypical transaction patterns, indications of fraud, regulatory breaches or an express requirement from the payment networks.

20.7. Reconciliation, Disputes and support

The User is advised to report any inconsistency within ten (10) business days following the operating record, in order to facilitate its investigation and recovery. This period is operational in nature and does not limit the User's legal rights or the dispute deadlines established by the Issuer, by the Particular Terms or by the network rules, which will prevail.

Coloca may act as the initial channel for receiving a Dispute and forward the request to the Issuer, but the decision will rest with the competent entity in accordance with the network rules and applicable regulation.

Coloca will provide first-level support for the request, configuration, display and reporting of Card issues through the Authorized Channels, within the scope of its role as a technology channel. Support corresponding to the Issuer, the franchise or the network will be handled in accordance with their own procedures, without the involvement of a third party serving to exclude Coloca's own responsibilities set out in Section 27 and Section 28.

Where the Service is actually active, Coloca may offer rewards, incentives, discounts or benefits associated with the use of certain Services, obtainable by completing challenges, goals or objectives defined by the Platform.

The conditions, mechanics, rules, eligibility criteria, validity, calculation method, limits and amounts of each program or campaign will constitute Particular Terms and will be published or disclosed to the User when the program is actually active. Until then, no provision of this Section creates enforceable rights.

A reward will be deemed earned only when the published conditions are met and Coloca confirms it; the benefit will be credited to the Operating Balance of the User Account, unless the Particular Terms provide another mechanism. Rewards are personal, non-transferable and not redeemable for cash, unless expressly provided otherwise. Each party will bear the tax consequences legally incumbent on it. Coloca may correct credits that are erroneous, duplicated or obtained through fraud or abuse, as well as those affected by the cancellation or Reversal of the transaction that gave rise to them, and may modify or terminate a program while respecting benefits already earned.

22.1. Availability and continuity

Coloca will endeavour to keep the Platform available and to operate with reasonable levels of continuity, security and support. It does not guarantee uninterrupted availability or the complete absence of errors. Maintenance, updates, telecommunications failures, provider interruptions, security events, force majeure or technical circumstances may occur.

Coloca reserves the right to carry out scheduled or emergency maintenance to ensure system stability, endeavouring to give the advance notice indicated below, and will adopt reasonable continuity, communication and provider management measures. The technical conditions of API integration are set out in Section 8.6.

22.2. Support and service levels

The schedules, channels, target times, service levels and escalation mechanisms will be those published on the Platform, disclosed to the User or agreed in the Commercial Proposal. By way of indication, Coloca endeavours to operate under the following parameters:

Response times represent operational service targets and do not constitute a guarantee of immediate resolution, which will depend on technical complexity or on the involvement of Enabled Providers. A Commercial Proposal may agree different or binding service levels for a particular Company.

Coloca may limit or suspend, wholly or partially, a User Account, Authorized User, Order or Service where there is legitimate cause, including:

1. 01Breach of these T&C or of applicable documents, or false, incomplete, outdated or unverifiable information.
2. 02High levels of fraud or atypical rates of disputes, reversals or chargebacks exceeding Coloca’s internal risk policies or the thresholds of its financial partners.
3. 03Failure or delay in providing information or documents required for periodic know-your-customer updates.
4. 04Failure to constitute, increase or maintain the guarantees, Reserves or coverage required.
5. 05Alerts or indications of fraud, security, money laundering, sanctions, transactions with restricted jurisdictions or prohibited use.
6. 06Improper or abusive use of Coloca’s technical infrastructure, or a determination by an authority or payment network that the User’s operations put the stability of the system at risk.
7. 07Requirement of a competent authority, regulator or Enabled Provider.
8. 08Risk of loss, Chargebacks, negative balance or harm to third parties.
9. 09Compromise of credentials, API, device or User Account.
10. 10Technical, regulatory or operational unavailability.
11. 11Failure to pay Fees or to constitute an agreed Reserve.

The measure will be reasonably limited to the risk identified. Coloca will inform the User where legally possible and may request explanations or supporting documents.

Where the suspension leads to an internal investigation, it will have a maximum term of thirty (30) calendar days from its start. That term will be suspended while the investigation depends on information, responses or actions from third parties, Enabled Providers, Issuers, payment networks or competent authorities, and will resume once these are received.

While the term is suspended, Coloca will inform the User of the status of the investigation with reasonable frequency and, in any case, at least every thirty (30) calendar days, stating the cause and an estimate of the remaining time where possible, unless legally prohibited or required otherwise by an authority. No User Account will remain under review indefinitely without communication.

If the cause disappears, Coloca will lift or adjust the measure. If it persists, it may terminate the relationship or maintain the restrictions permitted by law. Suspension does not extinguish pending obligations or prevent the application of Reserves, the handling of Disputes or compliance with orders from an authority.

24.1. Grounds for termination

Termination by the User. May be requested at any time through the Authorized Channels and will be processed once the absence of ongoing transactions, Disputes, Chargebacks in progress, Reserves, negative balances, Fees or pending obligations has been verified. Coloca may require identity verification.

Termination by Coloca. May apply for breach of these T&C, prohibited use, impossibility of verifying information, unsatisfactory outcome of an internal investigation, unacceptable risk, regulatory decision, permanent unavailability of a Service, termination of relationships with providers or any other legitimate cause. Rejection or non-approval of the onboarding verifications provided for in Section 4.1 will also constitute grounds for immediate termination, in which case the reasonable notice indicated below will not be necessary, since the User Account never had active Services. In the remaining cases, where there is no urgency, risk, legal prohibition or material breach, Coloca will endeavour to give reasonable notice and to allow the withdrawal or transfer of available resources.

24.2. Settlement and exit of Funds

Following termination, Coloca will coordinate the transfer or settlement of the available Funds to the destination validated by the User, after deducting Chargebacks, Disputes, Fees, fines and other enforceable obligations, and maintaining reasonable Reserves for pending Disputes. The actual transfer will be executed by the Enabled Provider corresponding to the applicable operating route.

Where there are ongoing investigations, requirements from competent authorities or risk of Chargebacks or future claims, Coloca may preventively withhold the Funds for the maximum term required by the payment networks, the regulation applicable in each jurisdiction or its risk policies.

If a transfer is not possible due to lack of information, restrictions, absence of a destination account or legal impediment, Coloca will retain the record and request instructions. Unclaimed Funds will be treated in accordance with applicable law.

24.3. Inactivity and survival

Coloca may consider inactive a User Account that records no access or transactions for a period equal to or greater than twelve (12) continuous months, or another period disclosed on the Platform or in the Commercial Proposal. To reactivate the Service, the User must again complete the required verification processes. Coloca may require re-verification, limit features or initiate closure before that period where there is legitimate cause. Any inactivity charge must have been disclosed in advance, and inactivity does not authorize Coloca to appropriate the Funds.

Termination will not affect rights and obligations that by their nature must survive, including payments, Disputes, Reserves, confidentiality, intellectual property, liability and information processing.

The processing of the User's personal data is governed by Coloca's Personal Data Processing Policy, permanently available for consultation on the official website and through the Authorized Channels. By accepting these T&C, the User declares that they know, understand and accept that policy, and acknowledges that it details the purposes, the controllers and processors, the retention periods, the procedures for exercising their habeas data rights and the channels for filing petitions, complaints, claims and suggestions.

The User grants their express, prior, informed and unequivocal authorization for Coloca to collect, store, use, process, circulate, transmit or transfer their personal data for the purpose of carrying out due diligence validations, risk analysis, anti-money laundering and counter-terrorist financing prevention, restrictive list screening and other compliance actions necessary to assess, approve and maintain their onboarding.

The Data Policy likewise governs the processing of third-party personal data supplied by the User in connection with an Order, the processing of sensitive and biometric data, international transmissions and transfers, and the determination of controller and processor roles in B2B2C models. The User declares that they have the necessary powers, authorizations or legal bases to supply such data and to permit its processing by Coloca and by the Enabled Providers involved in the transaction.

26.1. Intellectual property

Coloca and its licensors retain all rights over the Platform, the software, the APIs, the documentation, the designs, the trademarks, the databases, the content and other protected elements. Coloca grants the User a limited, revocable, non-exclusive, non-transferable licence, conditional on compliance with these T&C, to use the Platform during the relationship, without this implying any transfer or assignment of any right over its technology.

The User may not resell, copy, modify, distribute, sublicense, decompile, reverse engineer, extract data through scraping or bots, circumvent controls or create derivative works, except with express authorization or legal permission. Nor may they use Coloca's name, trademark or advertising elements without prior written authorization; the distinctive signs of the payment networks or franchises belong exclusively to their owners.

Upon termination of the relationship, the User undertakes to permanently return or delete any information, documentation, credentials or tangible fixations of Coloca's technology under their control, confirming this in writing if Coloca so requires. Comments or suggestions provided by the User may be used by Coloca to improve the Services.

26.2. Confidentiality

All technical, commercial, financial, operational and security information, API documentation, integration manuals, transaction data and negotiated Fees shared between Coloca and the User under the B2B and B2B2C models will be treated as confidential information and may only be used to perform the relationship.

The parties will limit access to those who need to know it in order to perform the Service and will impose equivalent obligations on them. Information will not be confidential where it is public without breach, where it was legitimately in the receiving party's prior possession, where it was independently developed, or where it must be disclosed by legal mandate or requirement of an authority; in the latter case, the required party will endeavour to give prior notice where permitted.

Confidentiality obligations will remain in force during the relationship and for an additional period of three (3) years from its termination, except for trade secrets, industrial secrets or data protected by special laws, whose confidentiality will subsist indefinitely.

Each party will be liable for the direct damages it causes through proven breach of its obligations, within the limits permitted by law. Coloca will not be liable for losses arising exclusively from:

1. 01Earthquakes, power outages, failures in data transmission lines, terrorist acts, strikes, interruptions of third-party networks, internet failures or any force majeure or fortuitous event beyond its control.
2. 02Interception, access, modification or misuse of data by unauthorized third parties through unlawful cyber manoeuvres, provided Coloca has complied with the applicable security standards.
3. 03Problems with equipment, communication systems, malicious software or failures in the User’s internet providers and networks.
4. 04Suspensions, preventive interruptions or scheduled maintenance of Coloca’s systems or those of its partners.
5. 05Incorrect, incomplete or erroneous data or instructions supplied by the User in the execution of their Orders.
6. 06Breaches, fraud, failures or delays of third parties, Enabled Providers or external networks beyond Coloca’s reasonable control.
7. 07Acts of authority, regulatory changes, conflicts or unforeseeable and irresistible events in the jurisdictions of operation.
8. 08Misuse of credentials, passwords, API keys or security systems attributable to the User or their Authorized Users.
9. 09Commercial, operational, tax, foreign-exchange or financial decisions taken autonomously by the User.
10. 10Legitimate suspensions or rejections arising from compliance, security, anti-money laundering or mandatory payment franchise rules.

These exclusions will not apply where the damage results from wilful misconduct, gross negligence, fraud, misappropriation, breach of legal duties attributable to Coloca or any liability that cannot be excluded. In relationships with Companies, Coloca will not be liable for indirect damages, loss of opportunity, loss of profit, reputational harm or loss of information, except in cases of wilful misconduct, gross negligence or non-limitable obligations.

27.1. Aggregate liability cap (B2B and B2B2C)

Coloca's total and aggregate liability towards a Company, for all events, claims and causes of action arising from these T&C or from the provision of the Services, will not exceed the greater of: (i) the sum of the Fees actually paid by the Company for the affected Service during the six (6) months preceding the event giving rise to the claim; or (ii) the amount of the transaction directly affected by that event.

This cap will not apply in cases of wilful misconduct, gross negligence, fraud, misappropriation of Funds, breach of non-limitable legal duties, or in respect of any other liability that the law does not permit to be limited. A Commercial Proposal may establish different limits agreed between the parties. The cap does not apply to Users who qualify as consumers.

27.2. Indemnity

The User will hold Coloca, its affiliates, directors, employees and Enabled Providers harmless against third-party claims, penalties, costs and damages resulting directly from false information, unlawful or improper use of the Platform, breach of these T&C or of the law, or violation of third-party rights, attributable to the User or their Authorized Users. The User will bear the damages, fines, penalties and awards imposed, as well as the reasonable costs, defence expenses and legal fees incurred.

Coloca must report the claim and allow reasonable participation in its defence. The indemnity will not cover events attributable to Coloca or to the indemnified third party.

The Platform may contain links, integrations, content, networks or services offered by third parties, access to which may be subject to their own terms and policies. Coloca does not control or guarantee external services that it does not provide or manage.

Where a third party participates in a Service marketed or integrated by Coloca, Coloca will provide reasonable support within the scope of its role and will not use the third party's involvement to exclude its own responsibilities. The User must review the third party's terms before contracting or activating the product; acceptance of these T&C does not replace the separate acceptance required by an Issuer or other Enabled Provider.

Entire agreement and order of precedence. These T&C, the Data Policy, the Commercial Proposal, the Particular Terms and other applicable documents constitute the agreement between the parties in respect of the Services and supersede any prior understanding on the same subject matter. In the event of conflict, the following will prevail, in order: mandatory rules and non-waivable consumer rights; the Particular Terms of the Service or of the Enabled Provider within their scope; the Commercial Proposal; and these T&C. A particular condition will not modify other sections unless it expressly so states.

Assignment and subcontracting. The User may not assign, transfer, delegate or subcontract their position without Coloca's prior written consent. Coloca may assign the contract to a successor, affiliate, parent, subsidiary or related company that assumes its obligations, by notifying the User and without reducing their rights, and may subcontract functions to Enabled Providers while retaining the responsibilities it may not delegate.

Severability. If a provision is declared invalid or unenforceable, the others will remain in force provided this does not substantially alter the economic and legal essence of the relationship. The parties will act in good faith to agree valid wording that preserves the original intent and balance.

No waiver and survival. Failure or delay in exercising a right does not constitute a waiver; any waiver must be express and will apply only to the case indicated. Provisions that by their nature must continue after termination will survive.

Term. The relationship will have indefinite duration and will terminate only on the grounds provided in Section 24.

Language, headings and examples. Translations may exist; in the event of conflict and where the law permits, the Spanish version will prevail. Headings are for ease of reading and do not limit scope. The expressions "including", "such as", "by way of example" or equivalents introduce illustrative and non-exhaustive lists.

These T&C will be governed by the laws of the Republic of Colombia, without prejudice to mandatory rules that protect the User in the jurisdiction where the Service is offered.

Any dispute arising from the execution, interpretation, performance or termination of these T&C will first be sought to be resolved through alternative dispute resolution mechanisms, for which the parties will have a term of no more than thirty (30) business days from the formal communication of the disagreement.

Failing agreement, and in the case of B2B and B2B2C Users, the dispute will be resolved by an arbitration tribunal composed of one (1) sole arbitrator where the amount in dispute is less than four hundred (400) current monthly statutory minimum wages, and by three (3) arbitrators where it is equal to or greater. The arbitrators will be appointed by mutual agreement of the parties or, failing that, by drawing lots from the official list of the conciliation and arbitration centre that the parties agree in the Commercial Proposal. The tribunal will rule at law and will sit in the city indicated by the parties; failing indication, at Coloca's principal domicile.

The arbitration agreement does not apply to Users who qualify as consumers (B2C), who fully retain the right to turn to the competent administrative or judicial authorities. Likewise, in the case of small-claims disputes, any User will retain the ability to go directly to the ordinary courts.

This Section does not limit the right of either party to seek precautionary or urgent measures before the competent authority, or to exercise rights subject to lapse or limitation periods.

These T&C will take effect on the date of their publication or on the date disclosed to the User during acceptance, and will remain in force for as long as there is a relationship, Service, transaction or pending obligation. The applicable version will be the one accepted by the User for the corresponding period and Services, together with the amendments validly incorporated in accordance with Section 4.4. Coloca will keep version records and will endeavour to keep the documents in force available and, where reasonably possible, previous versions.