POLICY FOR THE TREATMENT OF INFORMATION AND PERSONAL DATA

PKF CABRERA INTERNACIONAL S.A. BIC, with Tax ID No. 805005846-7, domiciled in Cali (hereinafter the “Firm”), with address at Cl 25 Norte # 5N-57, Office 338, email address pkfcabrera.com, and telephone number (+57-2) 485 4141, recognizing the constitutional right of all individuals to access, update, and correct information collected about them in databases or files, as well as the other constitutional rights, freedoms, and guarantees enshrined in the Constitution in this regard, as well as the right to information enshrined in Article 20 of the same Constitution; hereby notifies the Data Subjects whose personal data is processed by the Firm through any means of this Information Processing Policy (the “Policy”), in strict compliance with Law 1581 of 2012 and Decree 1377 of 2013.

LEGAL FRAMEWORK

Statutory Law 1581 of 2012, known as the General Data Protection Regime, “By which general provisions are enacted for the protection of personal data”, and Regulatory Decree 1377 of 2013 “By which the Law 1581 of 2012 is partially regulated, are the normative provisions that within the legal system regulate aspects related to the authorization of the Data Subject for the processing of their personal data, the Data Processing policies of those Responsible and in charge, the exercise of the rights of Data Subjects, the transfers of personal data and the demonstrated responsibility regarding the Processing of personal data.

PURPOSE

The primary purpose of this Policy is to inform Data Subjects of their rights and, likewise, of the mechanisms established by the Firm to effectively enforce those rights, in order to protect the information, they provide by any means and in any form of storage—whether online, by telephone, and/or in person—that is recorded in the company’s database.

DEFINITIONS

Authorization: The prior, express, and informed consent of the Data Subject to process personal data.
Database: It is the organized set of personal data that is subject to Processing.
Dato personal: Se refiere a cualquier información vinculada o que pueda asociarse a una o varias personas naturales determinadas o determinables.
Public Data: Personal data defined as such by the provisions of the law or the Constitution and that is not semi-private, private, or sensitive. Public data includes, among other things, data relating to a person’s marital status, profession or occupation, status as a businessperson or public servant, and data that can be obtained without any restrictions. By its nature, public data may be contained, among other sources, in public records, public documents, official gazettes, and official bulletins.
Sensitive Data: This is personal data that affects the data subject’s privacy or whose improper use may lead to discrimination, such as data regarding racial or ethnic origin, political orientation, religious beliefs, union membership, or membership in other social organizations, as well as data regarding health, sexual life, and biometric data.
Data Controller: A natural or legal person, whether public or private, who, either alone or in association with others, determines the purposes and means of data processing. For the purposes of this Policy, the Firm shall be the data controller.
Data Processor: A natural or legal person, whether public or private, who, either alone or in association with others, processes personal data on behalf of the Data Controller. For the purposes of this Policy, the Firm shall be the Data Processor.
Data Subject: A natural person whose personal data is subject to processing. For the purposes of this Policy, Data Subjects include clients, suppliers, employees, service providers, and, in general, any natural person who has a direct or indirect relationship with the Firm and about whom information is held.
Personal Data Processing: Any systematic operation or procedure, whether electronic or not, that enables the collection, retention, organization, storage, modification, cross-referencing, use, dissemination, evaluation, blocking, destruction, and, in general, the processing of Personal Data, as well as its transfer to third parties through communications, inquiries, interconnections, transfers, and data messages.
Transfer: The processing of personal data that involves the disclosure of such data within or outside the territory of the Republic of Colombia when the purpose is for the processor to carry out processing on behalf of the controller.
Transmission: The processing of Personal Data through which such data is communicated, either internally or to third parties, within or outside the territory of the Republic of Colombia, when the purpose of such communication is for the recipient of the Personal Data to carry out any processing activity.

PRINCIPLES

Principle of Legality: The processing referred to in Law 1581 of 2012 is a regulated activity that must comply with the provisions of that law, Decree 1377 of 2013, and any other regulations that implement, amend, or supplement them.
Principle of Purpose: Data processing must serve a legitimate purpose in accordance with the Constitution and the law, and the data subject must be informed of such purpose.
Principle of Freedom: Data processing may only be carried out with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives the requirement for consent.
Principle of Truthfulness or Quality: Information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of data that is partial, incomplete, fragmented, or misleading is prohibited.
Principle of Transparency: During processing, the Data Subject’s right to obtain from the Firm, at any time and without restrictions, information regarding the existence of data concerning them must be guaranteed.
Principle of Restricted Access and Circulation: Processing is subject to the limitations arising from the nature of personal data, as well as the provisions of the law and the Constitution. In this regard, data processing may only be carried out by people authorized by the Data Subject and/or by people specified by law. Personal data, except for public information, may not be made available on the Internet or through other means of mass dissemination or communication, unless access is technically controllable to ensure that access is restricted solely to Data Subjects or third parties authorized by law.
Security Principle: Information subject to processing by the Firm must be handled using the technical, human, and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, unauthorized or fraudulent access, use, or disclosure.
Principle of Confidentiality: All persons involved in the processing of personal data that is not public in nature are obligated to ensure the confidentiality of the information, even after their involvement in any of the tasks related to such processing has ended; they may only disclose or communicate personal data when such disclosure is necessary for the performance of activities authorized by law and in accordance with its terms.

PROCESSING AND PURPOSES OF DATA PROCESSING

The processing of information and personal data of Data Subjects handled by the Firm will be conducted in accordance with the principles of the Political Constitution of Colombia and the guidelines established by applicable regulations. Likewise, such processing will be strictly limited to the purposes described in the Firm’s corporate purpose, specifically to:

Facilitate the Firm’s commercial, corporate, labor, tax, and accounting purposes.
Carry out marketing and advertising activities to offer new services provided by the Firm, which includes maintaining, updating, and safeguarding the Firm’s database of clients, employees, former employees, contractors, and suppliers.
Comply with internal administrative processes for managing the Firm’s contractors and suppliers, as well as other operational purposes of the Firm.
To provide the services contracted by the Firm’s clients within the scope of the Firm’s corporate purpose and in accordance with clients’ requests and needs.
To fulfill any other purposes that enable the Firm to carry out the activities, functions, and operations included within its corporate purpose and those authorized by law.

RIGHTS OF THE DATA SUBJECT

In accordance with article 8 of Law 1581 of 2012, the following are the following are the rights of the Data Subjects:

a) To know, update, and rectify their personal data with the Firm. This right may be exercised, among others, regarding partial, inaccurate, incomplete, fragmented, misleading data, or data whose Processing is expressly prohibited or has not been authorized.
b) To request proof of the authorization granted to the Firm, except when expressly exempted as a requirement for Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012 and other norms that modify, add to, or complement it.
c) To be informed by the Firm, upon request, regarding the use made of their personal data.
d) To file complaints with the Superintendence of Industry and Commerce for infringements of the provisions of Law 1581 of 2012 and other norms that modify, add to, or complement it.
e) Revoke consent and/or request the deletion of data when the processing fails to respect constitutional and legal principles, rights, and safeguards. Revocation and/or deletion shall be granted when the Superintendency of Industry and Commerce has determined that, in the processing, the Data Controller or Data Processor has engaged in conduct contrary to Law 1581 of 2012 and the Constitution.
f) To request free access to their personal data that has been subject to Processing.

RESPONSIBLE FOR REQUESTS, INQUIRIES, AND COMPLAINTS

The Firm has directly designated the Marketing Department as the entity responsible for addressing and managing the corresponding procedures regarding requests, inquiries, complaints, and/or claims submitted by Data Subjects. The Marketing Department will always act in accordance with the Policy and the law.

The contact information for the Marketing Department is as follows: Address: Cl 25 Norte # 5N-57, Office 338; email: pkfcabrera.com; Phone: (+57-2) 485 4141, Ext. 2020.

PROCEDURE FOR EXERCISING THE DATA SUBJECT’S RIGHTS

Requests or complaints to know, update, rectify, suppress the data, and/or revoke the authorization must be presented by the Titleholder of the information, heirs, the representative and/or attorney-in-fact, the representatives of minors who are Titleholders, and by those for whom it has been stipulated in favor of another or for another. In view of the foregoing, the Firm reserves the right to verify the identity of the petitioner, through any available means.

The Firm will provide the Account Holder or their representative with various means to file the inquiry or complaint they wish to submit. These may be in person at the address Cl 25 Norte # 5N-57, Office 338; electronically via email at protecciondatos@pkfcabrera.com; or by phone at 485 4141 Ext. 2020, Monday through Friday from 7:30 a.m. to 12:30 p.m. and from 2:00 p.m. to 5:30 p.m., and on Saturdays from 8:00 a.m. to 12:00 p.m.

Regardless of the method used, the Firm will retain a record of the inquiry and its response.

Inquiries. Data subjects or those who are legally authorized may request access to the data subject’s personal information stored in any database, whether in the public or private sector. The Firm must provide them with all information contained in the individual record or related to the identification of the data subject.

The request must be made through the channels established by the Firm as described above, provided that proof of the request can be maintained.

If the inquiry is submitted by a person legally authorized to do so, the Marketing Department will respond within a maximum of ten (10) business days from the date of receipt. If it is not possible to respond to the inquiry within that timeframe, the data subject must be notified, stating the reasons for the delay and specifying the date by which the inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the initial timeframe. To do so, the same method or a similar one to that used by the data subject to submit the inquiry will be used.

Provisions contained in special laws or regulations issued by the National Government may establish shorter time limits, depending on the nature of the personal data.

Complaints. The Data Subject or any legally authorized person who believes that the information contained in a database should be corrected, updated, or deleted, or who becomes aware of an alleged breach of any of the obligations set forth in Law 1581 of 2012, may file a complaint with the Firm.

The complaint must include the claimant’s identifying information, a description of the facts giving rise to the complaint, the purpose of filing the complaint, the address, and the documents to be submitted in support of the claim. If the complaint is incomplete, the claimant will be required to correct the deficiencies within five (5) days of receipt of the complaint. If two (2) months have elapsed since the date of the request and the claimant has not submitted the required information, the claim will be deemed withdrawn.

If the person receiving the complaint does not have the authority to resolve it, they will forward it to the appropriate party within a maximum of two (2) business days and inform the complainant of the situation.

Once the complete complaint has been received, a note stating, “complaint pending” and the reason for it will be added to the database within no more than two (2) business days. This note must remain in the database until a decision is made on the complaint.

The maximum term to address the complaint shall be fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to address the complaint within that term, the interested party will be informed of the reasons for the delay and the date by which the complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial term. To do so, the same method or a similar one to the one used by the Data Subject to submit their inquiry will be used.

Requirements for Admissibility. The Account Holder or any legally authorized person may file a complaint with the Superintendency of Industry and Commerce once the consultation or complaint process with the Firm has been exhausted.

TERM OF VALIDITY

This Policy is effective as of October 14, 2020. Personal Data that is stored, used, or transmitted in the Firm’s database will be retained therein for as long as necessary to fulfill the purposes for which it was collected by the Firm.