Privacy Policy

# Privacy Policy

Last updated: April 2026

MASLOW HR INC. (hereinafter "MASLOW", "we" or "our"), with registered address at 108 Escalera Parkway, Georgetown, TX, USA, is committed to protecting the privacy and personal data of users of its website www.maslow.hr (the "Site") and its SaaS platform for managing employee benefits, incentives, and recognition (the "Platform").

This Privacy Policy describes how we collect, use, store, and protect personal information, as well as the rights available to data subjects.

1. Scope

This policy applies to:

• Visitors to the maslow.hr website
• Users of the Maslow Platform (client company administrators and beneficiary employees)
• Individuals who contact us through forms, email, or other channels
• Partners and business associates who interact with our systems

2. Personal Data We Collect

2.1 Data Provided Directly

• Identification data: full name, email address, phone number, job title/position, company
• Account data: Platform access credentials
• Business contact data: information provided when requesting demos, quotes, or support
• Communication data: content of messages sent through contact forms or email

2.2 Data Collected Automatically

• Technical data: IP address, browser type, operating system, screen resolution, preferred language
• Browsing data: pages visited, time spent, referral source, interactions with the Site
• Cookies and similar technologies: session identifiers, user preferences (see section 8)

2.3 Data Provided by Client Companies

When a company contracts the Maslow Platform, it may upload employee data for benefits management. This data is processed by MASLOW as a data processor, under the instructions of the client (data controller).

3. Purposes of Processing

We use personal data for the following purposes:

• Service delivery: operating the Platform, managing user accounts, administering benefits, discounts, recognition, and incentives
• Communication: responding to inquiries, sending requested information, service notifications
• Service improvement: analyzing Site and Platform usage to improve features and user experience
• Marketing: sending commercial communications about our services (with prior consent or legitimate interest, as applicable)
• Legal compliance: fulfilling legal, regulatory, and contractual obligations
• Security: detecting and preventing fraudulent or unauthorized activities

4. Legal Basis for Processing

The processing of personal data is based on:

• Contractual performance: when processing is necessary for the provision of our services
• Consent: for sending commercial communications and using non-essential cookies
• Legitimate interest: for improving our services, security, and fraud prevention
• Legal obligation: when processing is required by applicable law

5. Data Sharing

MASLOW does not sell personal data to third parties. We may share data in the following circumstances:

• Service providers: companies that assist us in operations (hosting, analytics, payment processing, email delivery), subject to confidentiality and data protection agreements
• Client companies: aggregated and anonymized usage data about their employees' use of benefits
• Merchant network: minimal information necessary for the redemption of discounts and benefits (without sharing sensitive employee data)
• Legal requirements: when required by law, court order, or competent authority
• Corporate transfers: in the event of a merger, acquisition, or sale of assets, with appropriate protection guarantees

6. International Transfers

As we operate in over 25 countries, personal data may be transferred to and processed in jurisdictions other than the data subject's country of origin. In these cases:

• We implement standard contractual clauses approved by competent authorities
• We verify that destination countries offer an adequate level of protection
• We apply additional technical and organizational security measures when necessary
• We comply with applicable local regulations in each jurisdiction

7. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Data encryption in transit (TLS/SSL) and at rest
• Role-based access control
• Access monitoring and logging
• Periodic security assessments
• Incident response plans
• Staff training on data protection

No data transmission or storage system is completely secure. While we make our best efforts to protect personal information, we cannot guarantee the absolute security of data transmitted over the Internet.

8. Cookies and Tracking Technologies

The Site uses cookies and similar technologies for:

• Essential cookies: necessary for Site operation (session, authentication, security)
• Analytics cookies: to understand how visitors interact with the Site (Google Analytics)
• Marketing cookies: to personalize content and measure the effectiveness of advertising campaigns

Users can manage their cookie preferences through the cookie banner displayed when accessing the Site, or through their browser settings. Disabling certain cookies may affect Site functionality.

9. Data Subject Rights

Depending on applicable legislation, data subjects may exercise the following rights:

• Access: know what personal data we process and obtain a copy thereof
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of personal data when no longer necessary
• Objection: object to data processing in certain circumstances
• Portability: receive data in a structured, commonly used format
• Restriction: request restriction of processing in certain cases
• Withdrawal of consent: withdraw consent at any time, without retroactive effect

To exercise these rights, contact: contacto@maslow.hr

We will respond to requests within the timeframes established by applicable legislation (generally within 30 days).

10. Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting obligations. Criteria for determining the retention period include:

• Duration of the contractual relationship
• Legal retention obligations
• Applicable limitation periods
• Legitimate operational needs

Once data is no longer needed, it will be securely deleted or anonymized.

11. Protection of Minors

Our services are not directed to individuals under 18 years of age. We do not intentionally collect personal data from minors. If we become aware that we have collected data from a minor, we will promptly delete it.

12. Jurisdiction-Specific Addenda

12.1 Users in the European Union (GDPR)

Users located in the European Economic Area have additional rights under the General Data Protection Regulation (GDPR). They may file complaints with their local data protection authority.

12.2 Users in Argentina (Law 25,326)

Personal data of users in Argentina is protected under Personal Data Protection Law No. 25,326. Data subjects may exercise their rights before the Agency for Access to Public Information (AAIP).

12.3 Users in Mexico (LFPDPPP)

Data processing for users in Mexico is governed by the Federal Law on Protection of Personal Data Held by Private Parties. Data subjects may exercise their ARCO rights (Access, Rectification, Cancellation, and Opposition).

12.4 Users in Brazil (LGPD)

Data of users in Brazil is protected under the Lei Geral de Proteção de Dados (LGPD). Data subjects may direct their requests to MASLOW's encarregado (DPO).

12.5 Users in Chile (Law 19,628)

Data processing for users in Chile is governed by the Law on Protection of Private Life and its amendments. Data subjects may exercise their rights before competent courts.

12.6 Users in Colombia (Law 1581 of 2012)

Data of users in Colombia is protected under the Statutory Law on Personal Data Protection. Data subjects may file complaints with the Superintendency of Industry and Commerce (SIC).

12.7 Users in the United States

For users in states with specific privacy laws (such as California, Virginia, Colorado, among others), additional protections provided by such regulations apply, including the right to know, delete, and opt out of the sale of personal information.

13. Changes to This Policy

MASLOW reserves the right to modify this Privacy Policy at any time. Changes will be posted on this page with the last updated date. We recommend reviewing this policy periodically to stay informed about how we protect personal data.

In the event of substantial changes, we will notify users through a prominent notice on the Site or by email.

14. Contact

For any inquiry, request, or complaint related to this Privacy Policy or the processing of personal data, you may contact us at:

• Email: contacto@maslow.hr
• Website: maslow.hr/contact
• Address: 108 Escalera Parkway, Georgetown, TX, USA